diff --git a/campaign.php b/campaign.php
index 7d2aba36..a7e5edac 100644
--- a/campaign.php
+++ b/campaign.php
@@ -31,15 +31,15 @@ if(isset($_GET['campaign_id'])){
//Get Stat Counts
//Subscribers
- $subscriber_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_campaign_id = $campaign_id"));
+ $subscriber_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_campaign_id = $campaign_id"));
//Sent
- $sent_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_sent_at IS NOT NULL AND message_campaign_id = $campaign_id"));
+ $sent_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_sent_at IS NOT NULL AND message_campaign_id = $campaign_id"));
//Opem
- $open_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_opened_at IS NOT NULL AND message_campaign_id = $campaign_id"));
+ $open_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_opened_at IS NOT NULL AND message_campaign_id = $campaign_id"));
//Click
- $click_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_clicked_at IS NOT NULL AND message_campaign_id = $campaign_id"));
+ $click_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_clicked_at IS NOT NULL AND message_campaign_id = $campaign_id"));
//Fail
- $fail_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM campaign_messages WHERE message_bounced_at IS NOT NULL AND message_campaign_id = $campaign_id"));
+ $fail_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT message_id FROM campaign_messages WHERE message_bounced_at IS NOT NULL AND message_campaign_id = $campaign_id"));
?>
diff --git a/clients.php b/clients.php
index 05464625..953e8237 100644
--- a/clients.php
+++ b/clients.php
@@ -217,7 +217,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
}
$client_tag_id_array[] = $client_tag_id;
- $client_tag_name_display_array[] = " $client_tag_name ";
+ if(empty($client_tag_color)){
+ $client_tag_name_display_array[] = "$client_tag_name ";
+ }else{
+ $client_tag_name_display_array[] = " $client_tag_name ";
+ }
}
$client_tags_display = implode('', $client_tag_name_display_array);
diff --git a/guest_view_invoice.php b/guest_view_invoice.php
index 3d8ad279..232cd4be 100644
--- a/guest_view_invoice.php
+++ b/guest_view_invoice.php
@@ -64,10 +64,9 @@ if(isset($_GET['invoice_id'], $_GET['url_key'])){
$config_stripe_publishable = $row['config_stripe_publishable'];
$config_stripe_secret = $row['config_stripe_secret'];
- $ip = get_ip();
- $os = get_os();
- $browser = get_web_browser();
- $device = get_device();
+ $ip = strip_tags(mysqli_real_escape_string($mysqli,get_ip()));
+ $os = strip_tags(mysqli_real_escape_string($mysqli,get_os()));
+ $browser = strip_tags(mysqli_real_escape_string($mysqli,get_web_browser()));
//Set Badge color based off of invoice status
if($invoice_status == "Sent"){
@@ -90,9 +89,11 @@ if(isset($_GET['invoice_id'], $_GET['url_key'])){
}
//Mark viewed in history
- mysqli_query($mysqli,"INSERT INTO history SET history_date = CURDATE(), history_status = '$invoice_status', history_description = 'Invoice viewed - $ip - $os - $browser - $device', history_created_at = NOW(), history_invoice_id = $invoice_id, company_id = $company_id");
+ mysqli_query($mysqli,"INSERT INTO history SET history_date = CURDATE(), history_status = '$invoice_status', history_description = 'Invoice viewed - $ip - $os - $browser', history_created_at = NOW(), history_invoice_id = $invoice_id, company_id = $company_id");
- mysqli_query($mysqli,"INSERT INTO alerts SET alert_type = 'Invoice Viewed', alert_message = 'Invoice $invoice_number has been viewed by $client_name - $ip - $os - $browser - $device', alert_date = NOW(), company_id = $company_id");
+ //Prevent SQL Error if client_name has ' in their name example Bill's Market
+ $client_name_escaped = mysqli_escape_string($mysqli,$client_name);
+ mysqli_query($mysqli,"INSERT INTO alerts SET alert_type = 'Invoice Viewed', alert_message = 'Invoice $invoice_number has been viewed by $client_name_escaped - $ip - $os - $browser', alert_date = NOW(), company_id = $company_id");
$sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
diff --git a/post.php b/post.php
index 27183961..e514500d 100644
--- a/post.php
+++ b/post.php
@@ -1836,7 +1836,7 @@ if(isset($_POST['test_campaign'])){
//Mail Server Settings
- $mail->SMTPDebug = 2; // Enable verbose debug output
+ //$mail->SMTPDebug = 2; // Enable verbose debug output
$mail->isSMTP(); // Set mailer to use SMTP
$mail->Host = $config_smtp_host; // Specify main and backup SMTP servers
$mail->SMTPAuth = true; // Enable SMTP authentication