MySQL database error

Hi,

I get the following errors regularly in my WordPress installation:


PHP Warning: mysql_real_escape_string(): Access denied for user '(user)'@'(host)' (using password: NO) in .../module.ajax-setup.php:58
PHP Warning: mysql_real_escape_string(): A link to the server could not be established in .../module.ajax-setup.php:58
WordPress database error You have an error in your SQL syntax; ...


The message refers to a mysql_real_escape_string call in the Leads (v1.6.8) plugin. This call fails because it tries to create a new connection without supplying a password. I think the plugin should use the existing database connection through the $wpdb global if possible.

The following patch fixes this one issue only, but I found more mysql_... calls which could lead to similar problems.


--- module.ajax-setup.php
+++ module.ajax-setup.php
@@ -52,11 +52,11 @@
if (isset($wp_lead_id) && is_numeric($wp_lead_id)) {
global $wpdb;
$data = array();
- $wpdb->query("
+ $wpdb->query($wpdb->prepare("
SELECT meta_key, meta_value
FROM $wpdb->postmeta
- WHERE post_id = ".mysql_real_escape_string($wp_lead_id)."
- ");
+ WHERE post_id = %d", $wp_lead_id
+ ));
foreach($wpdb->last_result as $k => $v) {
$data[$v->meta_key] = $v->meta_value;


https://ww.wp.xz.cn/plugins/leads/