diff --git a/campaign.php b/campaign.php index 7d2aba36..a7e5edac 100644 --- a/campaign.php +++ b/campaign.php @@ -31,15 +31,15 @@ if(isset($_GET['campaign_id'])){ //Get Stat Counts //Subscribers - $subscriber_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_campaign_id = $campaign_id")); + $subscriber_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_campaign_id = $campaign_id")); //Sent - $sent_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_sent_at IS NOT NULL AND message_campaign_id = $campaign_id")); + $sent_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_sent_at IS NOT NULL AND message_campaign_id = $campaign_id")); //Opem - $open_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_opened_at IS NOT NULL AND message_campaign_id = $campaign_id")); + $open_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_opened_at IS NOT NULL AND message_campaign_id = $campaign_id")); //Click - $click_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_clicked_at IS NOT NULL AND message_campaign_id = $campaign_id")); + $click_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_clicked_at IS NOT NULL AND message_campaign_id = $campaign_id")); //Fail - $fail_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_bounced_at IS NOT NULL AND message_campaign_id = $campaign_id")); + $fail_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_bounced_at IS NOT NULL AND message_campaign_id = $campaign_id")); ?> diff --git a/clients.php b/clients.php index 05464625..953e8237 100644 --- a/clients.php +++ b/clients.php @@ -217,7 +217,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); } $client_tag_id_array[] = $client_tag_id; - $client_tag_name_display_array[] = " $client_tag_name "; + if(empty($client_tag_color)){ + $client_tag_name_display_array[] = "$client_tag_name "; + }else{ + $client_tag_name_display_array[] = " $client_tag_name "; + } } $client_tags_display = implode('', $client_tag_name_display_array); diff --git a/guest_view_invoice.php b/guest_view_invoice.php index 3d8ad279..232cd4be 100644 --- a/guest_view_invoice.php +++ b/guest_view_invoice.php @@ -64,10 +64,9 @@ if(isset($_GET['invoice_id'], $_GET['url_key'])){ $config_stripe_publishable = $row['config_stripe_publishable']; $config_stripe_secret = $row['config_stripe_secret']; - $ip = get_ip(); - $os = get_os(); - $browser = get_web_browser(); - $device = get_device(); + $ip = strip_tags(mysqli_real_escape_string($mysqli,get_ip())); + $os = strip_tags(mysqli_real_escape_string($mysqli,get_os())); + $browser = strip_tags(mysqli_real_escape_string($mysqli,get_web_browser())); //Set Badge color based off of invoice status if($invoice_status == "Sent"){ @@ -90,9 +89,11 @@ if(isset($_GET['invoice_id'], $_GET['url_key'])){ } //Mark viewed in history - mysqli_query($mysqli,"INSERT INTO history SET history_date = CURDATE(), history_status = '$invoice_status', history_description = 'Invoice viewed - $ip - $os - $browser - $device', history_created_at = NOW(), history_invoice_id = $invoice_id, company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO history SET history_date = CURDATE(), history_status = '$invoice_status', history_description = 'Invoice viewed - $ip - $os - $browser', history_created_at = NOW(), history_invoice_id = $invoice_id, company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO alerts SET alert_type = 'Invoice Viewed', alert_message = 'Invoice $invoice_number has been viewed by $client_name - $ip - $os - $browser - $device', alert_date = NOW(), company_id = $company_id"); + //Prevent SQL Error if client_name has ' in their name example Bill's Market + $client_name_escaped = mysqli_escape_string($mysqli,$client_name); + mysqli_query($mysqli,"INSERT INTO alerts SET alert_type = 'Invoice Viewed', alert_message = 'Invoice $invoice_number has been viewed by $client_name_escaped - $ip - $os - $browser', alert_date = NOW(), company_id = $company_id"); $sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC"); diff --git a/post.php b/post.php index 27183961..e514500d 100644 --- a/post.php +++ b/post.php @@ -1836,7 +1836,7 @@ if(isset($_POST['test_campaign'])){ //Mail Server Settings - $mail->SMTPDebug = 2; // Enable verbose debug output + //$mail->SMTPDebug = 2; // Enable verbose debug output $mail->isSMTP(); // Set mailer to use SMTP $mail->Host = $config_smtp_host; // Specify main and backup SMTP servers $mail->SMTPAuth = true; // Enable SMTP authentication