CVE-2014-125101: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is able to address this issue. The identifier of the patch is 58ed88243e17df766036f4857041edaf358076d3. It is recommended to upgrade the affected component. The identifier VDB-230085 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-05-28T13:15Z
Repository: https://github.com/wp-plugins/portfolio-gallery
Language: PHP
Files changed: admin/portfolios_func.php, admin/portfolios_view.php, portfolio-gallery.php, readme.txt
Commit date: 2014-09-19 19:32:45 +0000
Commit message: SQL Injection bag has fixed in Portfolio Gallery

git-svn-id: https://plugins.svn.wordpress.org/portfolio-gallery/trunk@993521 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/admin/portfolios_func.php b/admin/portfolios_func.php
index c45fcfd..15e9c69 100644
--- a/admin/portfolios_func.php
+++ b/admin/portfolios_func.php
@@ -9,134 +9,32 @@ if(!function_exists('current_user_can')){
 
 function showportfolio() 
   {
 	  
   global $wpdb;
-  
-  if(isset($_POST['search_events_by_title']))
-$_POST['search_events_by_title']=esc_html(stripslashes($_POST['search_events_by_title']));
-if(isset($_POST['asc_or_desc']))
-$_POST['asc_or_desc']=esc_js($_POST['asc_or_desc']);
-if(isset($_POST['order_by']))
-$_POST['order_by']=esc_js($_POST['order_by']);
-  $where='';
-  	$sort["custom_style"] ="manage-column column-autor sortable desc";
-	$sort["default_style"]="manage-column column-autor sortable desc";
-	$sort["sortid_by"]='id';
-	$sort["1_or_2"]=1;
-	$order='';
-	
-	if(isset($_POST['page_number']))
-	{
-			
-			if($_POST['asc_or_desc'])
-			{
-				$sort["sortid_by"]=$_POST['order_by'];
-				if($_POST['asc_or_desc']==1)
-				{
-					$sort["custom_style"]="manage-column column-title sorted asc";
-					$sort["1_or_2"]="2";
-					$order="ORDER BY ".$sort["sortid_by"]." ASC";
-				}
-				else
-				{
-					$sort["custom_style"]="manage-column column-title sorted desc";
-					$sort["1_or_2"]="1";
-					$order="ORDER BY ".$sort["sortid_by"]." DESC";
-				}
-			}
-	if($_POST['page_number'])
-		{
-			$limit=($_POST['page_number']-1)*20; 
-		}
-		else
-		{
-			$limit=0;
-		}
-	}
-	else
-		{
-			$limit=0;
-		}
-	if(isset($_POST['search_events_by_title'])){
-		$search_tag=esc_html(stripslashes($_POST['search_events_by_title']));
-		}
-		
-		else
-		{
-		$search_tag="";
-		}		
-		
-	 if(isset($_GET["catid"])){
-	    $cat_id=$_GET["catid"];	
-		}
-       else
-	   {
-       if(isset($_POST['cat_search'])){
-		$cat_id=$_POST['cat_search'];
-		}else{
-		
-		$cat_id=0;}
-       }
-     
- if ( $search_tag ) {
-		$where= " WHERE name LIKE '%".$search_tag."%' ";
-	}
-if($where){
-	  if($cat_id){
-	  $where.=" AND sl_width=" .$cat_id;
-	  }
-	
-	}
-	else{
-	if($cat_id){
-	  $where.=" WHERE sl_width=" .$cat_id;
-	  }
-	
-	}
-	
-	 $cat_row_query="SELECT id,name FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE sl_width=0";
+	$limit=0;
+
+	$search_tag=esc_html(stripslashes($_POST['search_events_by_title']));
+	$cat_row_query="SELECT id,name FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE sl_width=0";
 	$cat_row=$wpdb->get_results($cat_row_query);
 	
-	// get the total number of records
-	$query = "SELECT COUNT(*) FROM ".$wpdb->prefix."huge_itportfolio_portfolios". $where;
+
+	$query = $wpdb->prepare("SELECT COUNT(*) FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE name LIKE '% %s %'" , $search_tag);
 	
 	$total = $wpdb->get_var($query);
-	$pageNav['total'] =$total;
-	$pageNav['limit'] =	 $limit/20+1;
-	
-	if($cat_id){
-	$query ="SELECT  a.* ,  COUNT(b.id) AS count, g.par_name AS par_name FROM ".$wpdb->prefix."huge_itportfolio_portfolios  AS a LEFT JOIN ".$wpdb->prefix."huge_itportfolio_portfolios AS b ON a.id = b.sl_width LEFT JOIN (SELECT  ".$wpdb->prefix."huge_itportfolio_portfolios.ordering as ordering,".$wpdb->prefix."huge_itportfolio_portfolios.id AS id, COUNT( ".$wpdb->prefix."huge_itportfolio_images.portfolio_id ) AS prod_count
-FROM ".$wpdb->prefix."huge_itportfolio_images, ".$wpdb->prefix."huge_itportfolio_portfolios
-WHERE ".$wpdb->prefix."huge_itportfolio_images.portfolio_id = ".$wpdb->prefix."huge_itportfolio_portfolios.id
-GROUP BY ".$wpdb->prefix."huge_itportfolio_images.portfolio_id) AS c ON c.id = a.id LEFT JOIN
-(SELECT ".$wpdb->prefix."huge_itportfolio_portfolios.name AS par_name,".$wpdb->prefix."huge_itportfolio_portfolios.id FROM ".$wpdb->prefix."huge_itportfolio_portfolios) AS g
- ON a.sl_width=g.id WHERE  a.name LIKE '%".$search_tag."%' group by a.id ". $order ." "." LIMIT ".$limit.",20" ; 
 
-	 }
-	 else{
+	if(!($cat_id)){
 	 $query ="SELECT  a.* ,  COUNT(b.id) AS count, g.par_name AS par_name FROM ".$wpdb->prefix."huge_itportfolio_portfolios  AS a LEFT JOIN ".$wpdb->prefix."huge_itportfolio_portfolios AS b ON a.id = b.sl_width LEFT JOIN (SELECT  ".$wpdb->prefix."huge_itportfolio_portfolios.ordering as ordering,".$wpdb->prefix."huge_itportfolio_portfolios.id AS id, COUNT( ".$wpdb->prefix."huge_itportfolio_images.portfolio_id ) AS prod_count
 FROM ".$wpdb->prefix."huge_itportfolio_images, ".$wpdb->prefix."huge_itportfolio_portfolios
 WHERE ".$wpdb->prefix."huge_itportfolio_images.portfolio_id = ".$wpdb->prefix."huge_itportfolio_portfolios.id
 GROUP BY ".$wpdb->prefix."huge_itportfolio_images.portfolio_id) AS c ON c.id = a.id LEFT JOIN
 (SELECT ".$wpdb->prefix."huge_itportfolio_portfolios.name AS par_name,".$wpdb->prefix."huge_itportfolio_portfolios.id FROM ".$wpdb->prefix."huge_itportfolio_portfolios) AS g
- ON a.sl_width=g.id WHERE a.name LIKE '%".$search_tag."%'  group by a.id ". $order ." "." LIMIT ".$limit.",20" ; 
+ ON a.sl_width=g.id WHERE a.name LIKE '%".$search_tag."%'  group by a.id  "; 
 }
 
 $rows = $wpdb->get_results($query);
- global $glob_ordering_in_cat;
-if(isset($sort["sortid_by"]))
-{
-	if($sort["sortid_by"]=='ordering'){
-	if($_POST['asc_or_desc']==1){
-		$glob_ordering_in_cat=" ORDER BY ordering ASC";
-	}
-	else{
-		$glob_ordering_in_cat=" ORDER BY ordering DESC";
-	}
-	}
-}
+
 $rows=open_cat_in_tree($rows);
 	$query ="SELECT  ".$wpdb->prefix."huge_itportfolio_portfolios.ordering,".$wpdb->prefix."huge_itportfolio_portfolios.id, COUNT( ".$wpdb->prefix."huge_itportfolio_images.portfolio_id ) AS prod_count
 FROM ".$wpdb->prefix."huge_itportfolio_images, ".$wpdb->prefix."huge_itportfolio_portfolios
 WHERE ".$wpdb->prefix."huge_itportfolio_images.portfolio_id = ".$wpdb->prefix."huge_itportfolio_portfolios.id
 GROUP BY ".$wpdb->prefix."huge_itportfolio_images.portfolio_id " ;
@@ -147,20 +45,14 @@ foreach($rows as $row)
 	foreach($prod_rows as $row_1)
 	{
 		if ($row->id == $row_1->id)
 		{
 			$row->ordering = $row_1->ordering;
-		$row->prod_count = $row_1->prod_count;
-	}
+			$row->prod_count = $row_1->prod_count;
 		}
-	
 	}
-	
-
-	 
-
-	 
+}
 	$cat_row=open_cat_in_tree($cat_row);
 		html_showportfolios( $rows, $pageNav,$sort,$cat_row);
   }
 
 function open_cat_in_tree($catt,$tree_problem='',$hihiih=1){
@@ -173,18 +65,10 @@ $search_tag='';
 if($hihiih)
 $trr_cat=array();
 foreach($catt as $local_cat){
 	$local_cat->name=$tree_problem.$local_cat->name;
 	array_push($trr_cat,$local_cat);
-	$new_cat_query=	"SELECT  a.* ,  COUNT(b.id) AS count, g.par_name AS par_name FROM ".$wpdb->prefix."huge_itportfolio_portfolios  AS a LEFT JOIN ".$wpdb->prefix."huge_itportfolio_portfolios AS b ON a.id = b.sl_width LEFT JOIN (SELECT  ".$wpdb->prefix."huge_itportfolio_portfolios.ordering as ordering,".$wpdb->prefix."huge_itportfolio_portfolios.id AS id, COUNT( ".$wpdb->prefix."huge_itportfolio_images.portfolio_id ) AS prod_count
-FROM ".$wpdb->prefix."huge_itportfolio_images, ".$wpdb->prefix."huge_itportfolio_portfolios
-WHERE ".$wpdb->prefix."huge_itportfolio_images.portfolio_id = ".$wpdb->prefix."huge_itportfolio_portfolios.id
-GROUP BY ".$wpdb->prefix."huge_itportfolio_images.portfolio_id) AS c ON c.id = a.id LEFT JOIN
-(SELECT ".$wpdb->prefix."huge_itportfolio_portfolios.name AS par_name,".$wpdb->prefix."huge_itportfolio_portfolios.id FROM ".$wpdb->prefix."huge_itportfolio_portfolios) AS g
- ON a.sl_width=g.id WHERE a.name LIKE '%".$search_tag."%' AND a.sl_width=".$local_cat->id." group by a.id  ".$glob_ordering_in_cat; 
- $new_cat=$wpdb->get_results($new_cat_query);
- open_cat_in_tree($new_cat,$tree_problem. "— ",0);
 }
 return $trr_cat;
 
 }
 
@@ -194,12 +78,12 @@ function editportfolio($id)
 	  global $wpdb;
 	  
 	  if(isset($_GET["removeslide"])){
 	     if($_GET["removeslide"] != ''){
 	
-
-	  $wpdb->query("DELETE FROM ".$wpdb->prefix."huge_itportfolio_images  WHERE id = ".$_GET["removeslide"]." ");
+		$idfordelete = $_GET["removeslide"];
+	  $wpdb->query($wpdb->prepare("DELETE FROM ".$wpdb->prefix."huge_itportfolio_images  WHERE id = %d ", $idfordelete));
 
 
 	
 	   }
 	   }
@@ -209,11 +93,11 @@ function editportfolio($id)
 	   if(!isset($row->portfolio_list_effects_s))
 	   return 'id not found';
        $images=explode(";;;",$row->portfolio_list_effects_s);
 	   $par=explode('	',$row->param);
 	   $count_ord=count($images);
-	   $cat_row=$wpdb->get_results("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id!=" .$id." and sl_width=0");
+	   $cat_row=$wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id!= %d and sl_width=0", $id));
        $cat_row=open_cat_in_tree($cat_row);
 	   	  $query=$wpdb->prepare("SELECT name,ordering FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE sl_width=%d  ORDER BY `ordering` ",$row->sl_width);
 	   $ord_elem=$wpdb->get_results($query);
 	   
 	    $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_images where portfolio_id = %d order by ordering ASC  ",$row->id);
@@ -310,182 +194,10 @@ INSERT INTO
 	
 	html_add_portfolio($ord_elem, $cat_row);
 	
 }
 
-function popup_posts($id)
-{
-	  global $wpdb;
-	 
-	     if(isset($_GET["removeslide"])){
-	     if($_GET["removeslide"] != ''){
-	
-
-	  $wpdb->query("DELETE FROM ".$wpdb->prefix."huge_itportfolio_images  WHERE id = ".$_GET["removeslide"]." ");
-
-
-	
-	   }
-	   }
-
-	   $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id= %d",$id);
-	   $row=$wpdb->get_row($query);
-	   if(!isset($row->portfolio_list_effects_s))
-	   return 'id not found';
-       $images=explode(";;;",$row->portfolio_list_effects_s);
-	   $par=explode('	',$row->param);
-	   $count_ord=count($images);
-	   $cat_row=$wpdb->get_results("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id!=" .$id." and sl_width=0");
-       $cat_row=open_cat_in_tree($cat_row);
-	   	  $query=$wpdb->prepare("SELECT name,ordering FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE sl_width=%d  ORDER BY `ordering` ",$row->sl_width);
-	   $ord_elem=$wpdb->get_results($query);
-	   
-	    $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_images where portfolio_id = %d order by id ASC  ",$row->id);
-			   $rowim=$wpdb->get_results($query);
-			   
-			   if(isset($_GET["addslide"])){
-			   if($_GET["addslide"] == 1){
-	
-$table_name = $wpdb->prefix . "huge_itportfolio_images";
-    $sql_2 = "
-INSERT INTO 
-
-`" . $table_name . "` ( `name`, `portfolio_id`, `description`, `image_url`, `sl_url`, `ordering`, `published`, `published_in_sl_width`) VALUES
-( '', '".$row->id."', '', '', '', 'par_TV', 2, '1' )";
-
-    $wpdb->query($sql_huge_itportfolio_images);
-	
-
-      $wpdb->query($sql_2);
-	
-	   }
-	   }
-	
-	   
-	   $query="SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios order by id ASC";
-			   $rowsld=$wpdb->get_results($query);
-			  
-			    $query = "SELECT *  from " . $wpdb->prefix . "huge_itportfolio_params ";
-
-    $rowspar = $wpdb->get_results($query);
-
-    $paramssld = array();
-    foreach ($rowspar as $rowpar) {
-        $key = $rowpar->name;
-        $value = $rowpar->value;
-        $paramssld[$key] = $value;
-    }
-	
-	 $query="SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' order by id ASC";
-			   $rowsposts=$wpdb->get_results($query);
-			   
-			   $categories = get_categories(  );
-		if(isset($_POST["iframecatid"])){
-		$iframecatid = $_POST["iframecatid"];
-		}
-		else
-		{
-		$iframecatid = $categories[0]->cat_ID;
-		}
-	 
-	 	  $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."term_relationships where term_taxonomy_id = %d order by object_id ASC",$iframecatid);
-		$rowsposts8=$wpdb->get_results($query);
-
-
-	 
-
-			   foreach($rowsposts8 as $rowsposts13){
-	 $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' and ID = %d  order by ID ASC",$rowsposts13->object_id);
-			   $rowsposts1=$wpdb->get_results($query);
-			   
-			   $postsbycat = $rowsposts1;
-			   
-	 }
-
-	  if(isset($_GET["closepop"])){
-	  if($_GET["closepop"] == 1){
-
-	      if($_POST["popupposts"] != 'none' and $_POST["popupposts"] != ''){
-		  
-		/*  	echo $_GET["closepop"].'sdasdasdsad';
-	echo $_POST["popupposts"].'dddddddd';*/
-
-$popuppostsposts = explode(";", $_POST["popupposts"]);
-
-array_pop($popuppostsposts);
-
-		foreach($popuppostsposts as $popuppostsposts1){
-		$my_id = $popuppostsposts1;
-		
-$post_id_1 = get_post($my_id); 
-
-
-
-			   $post_image = wp_get_attachment_url( get_post_thumbnail_id($popuppostsposts1) );
-		$posturl=get_permalink($popuppostsposts1);
-$table_name = $wpdb->prefix . "huge_itportfolio_images";
-
-$descnohtmlnoq=strip_tags($post_id_1->post_content);
-$descnohtmlnoq1 = html_entity_decode($descnohtmlnoq);
-$descnohtmlnoq1 = htmlentities($descnohtmlnoq1, ENT_QUOTES, "UTF-8");
-
-
-    $sql_posts = "
-INSERT INTO 
-
-`" . $table_name . "` ( `name`, `portfolio_id`, `description`, `image_url`, `sl_url`, `sl_type`, `link_target`, `ordering`, `published`, `published_in_sl_width`) VALUES
-( '".$post_id_1->post_title."', '".$row->id."', '".$descnohtmlnoq1."', '".$post_image ."', '".$posturl."', 'image', 'on', '0', '2', '1' )";
-
-
-
-      $wpdb->query($sql_posts);
-	  
-	
-
-		}
-		
-	}
-	if(!($_POST["lastposts"])){
-	 $wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET published = '".$_POST["posthuge-it-description-length"]."' WHERE id = '".$_GET['id']."' ");
-	 }
-	  }
-	  }
-
-if(isset($_POST["lastposts"])){
-$query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' order by id DESC LIMIT 0, ".$_POST["lastposts"]."");
-			   $rowspostslast=$wpdb->get_results($query);
-			   foreach($rowspostslast as $rowspostslastfor){
-			   
-			   		$my_id = $rowspostslastfor;
-$post_id_1 = get_post($my_id); 
-
-
-
-			   $post_image = wp_get_attachment_url( get_post_thumbnail_id($rowspostslastfor) );
-		$posturl=get_permalink($rowspostslastfor);
-$table_name = $wpdb->prefix . "huge_itportfolio_images";
-$descnohtmlno=strip_tags($post_id_1->post_content);
-$descnohtmlno1 = html_entity_decode($descnohtmlno);
-$lengthtextpost = '300';
-$descnohtmlno2 = substr_replace($descnohtmlno1, "", $lengthtextpost);
-$descnohtmlno3 = htmlentities($descnohtmlno2, ENT_QUOTES, "UTF-8");
-$posttitle = htmlentities($post_id_1->post_title, ENT_QUOTES, "UTF-8");
-$posturl2 = htmlentities($posturl, ENT_QUOTES, "UTF-8");
-
-			   
-			       $sql_lastposts = "INSERT INTO 
-`" . $table_name . "` ( `name`, `portfolio_id`, `description`, `image_url`, `sl_url`, `ordering`, `published`, `published_in_sl_width`) VALUES
-( '".$posttitle."', '".$row->id."', '".$descnohtmlno3."', '".$post_image ."', '".$posturl."', 'par_TV', 2, '1' )";
-
-    $wpdb->query($sql_huge_itportfolio_images);
-
-      $wpdb->query($sql_lastposts);
-	  }
-}
-	   	   
-    Html_popup_posts($ord_elem, $count_ord, $images, $row, $cat_row, $rowim, $rowsld, $paramssld, $rowsposts, $rowsposts8, $postsbycat);
-}
 
 function removeportfolio($id)
 {
 
 	global $wpdb;
@@ -524,19 +236,19 @@ function apply_cat($id)
       
 	if(isset($_POST["content"])){
 	$script_cat = preg_replace('#<script(.*?)>(.*?)</script>#is', '', stripslashes($_POST["content"]));
 	}
 
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  name = '".$_POST["name"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_width = '".$_POST["sl_width"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_height = '".$_POST["sl_height"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  pause_on_hover = '".$_POST["pause_on_hover"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  portfolio_list_effects_s = '".$_POST["portfolio_effects_list"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  description = '".$_POST["sl_pausetime"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  param = '".$_POST["sl_changespeed"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_position = '".$_POST["sl_position"]."'  WHERE id = '".$id."' ");
-			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  ordering = '1'  WHERE id = '".$id."' ");
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  name = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_width = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_height = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  pause_on_hover = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  portfolio_list_effects_s = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  description = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  param = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_position = %s  WHERE id = %d ", $_POST["name"], $id));
+	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  ordering = '1'  WHERE id = %d ", $id));
 
 		
 	$query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id = %d", $id);
 	   $row=$wpdb->get_row($query);
 
diff --git a/admin/portfolios_view.php b/admin/portfolios_view.php
index bda3bfa..e2492b0 100644
--- a/admin/portfolios_view.php
+++ b/admin/portfolios_view.php
@@ -595,190 +595,6 @@ jQuery(document).ready(function($){
 </div>
 
 <?php
 
 }
-
-
-function html_popup_posts($ord_elem, $count_ord,$images,$row,$cat_row, $rowim, $rowsld, $paramssld, $rowsposts, $rowsposts8, $postsbycat){
-	global $wpdb;
-
-?>
-			<style>
-				html.wp-toolbar {
-					padding:0px !important;
-				}
-				#wpadminbar,#adminmenuback,#screen-meta, .update-nag,#dolly {
-					display:none;
-				}
-				#wpbody-content {
-					padding-bottom:30px;
-				}
-				#adminmenuwrap {display:none !important;}
-				.auto-fold #wpcontent, .auto-fold #wpfooter {
-					margin-left: 0px;
-				}
-				#wpfooter {display:none;}
-			</style>
-			<script type="text/javascript">
-				jQuery(document).ready(function() {
-
-					jQuery('.huge-it-insert-post-button').on('click', function() {
-						var ID1 = jQuery('#huge-it-add-posts-params').val();
-						if(ID1==""){alert("Please select images to insert into portfolio.");return false;}
-						
-						window.parent.uploadID.val(ID1);
-						
-						tb_remove();
-						jQuery("#save-buttom").click();
-						
-					});
-						
-					jQuery('.huge-it-post-checked').change(function(){
-						if(jQuery(this).is(':checked')){
-							jQuery(this).addClass('active');
-							jQuery(this).parent().addClass('active');
-						}else {
-							jQuery(this).removeClass('active');
-							jQuery(this).parent().removeClass('active');
-						}
-						
-						var inputval="";
-						jQuery('#huge-it-add-posts-params').val("");
-						jQuery('.huge-it-post-checked').each(function(){
-							if(jQuery(this).is(':checked')){
-								inputval+=jQuery(this).val()+";";
-							}
-						});
-						jQuery('#huge-it-add-posts-params').val(inputval);
-					});
-	
-					
-					jQuery("#huge-it-categories-list").change(function(){
-						var currentCategoryID=jQuery(this).val();
-					
-						jQuery('#huge-it-posts-list li').not("#huge-it-posts-list-heading").css({"display":"none"});
-						jQuery('li[data-id*="'+currentCategoryID+'"]').css({"display":"block"});
-						
-					});
-					//jQuery("#huge-it-categories-list").change();
-										
-					jQuery('#huge_it_portfolio_add_posts_wrap .view-type-block a').click(function(){
-						jQuery('#huge_it_portfolio_add_posts_wrap .view-type-block a').removeClass('active');
-						jQuery(this).addClass('active');
-						var strtype=jQuery(this).attr('href').replace('#','');
-						jQuery('#huge-it-posts-list').removeClass('list').removeClass('thumbs');
-						jQuery('#huge-it-posts-list').addClass(strtype);
-						return false;
-					});
-					
-					
-					jQuery('.updated').css({"display":"none"});
-				<?php	if($_GET["closepop"] == 1){ ?>
-					jQuery("#closepopup").click();
-					self.parent.location.reload();
-				<?php	} ?>
-				});
-				
-			</script>
-			<a id="closepopup"  onclick=" parent.eval('tb_remove()')" style="display:none;" > [X] </a>
-	
-	
-	<div id="huge_it_portfolio_add_posts">
-					<div id="huge_it_portfolio_add_posts_wrap">
-						<h2>Add post</h2>
-						<div class="control-panel">
-						<form method="post"  onkeypress="doNothing()" action="admin.php?page=portfolios_huge_it_portfolio&task=popup_posts&id=<?php echo $_GET['id']; ?>" id="huge-it-category-form" name="admin_form">
-							<label for="huge-it-categories-list">Select Category <select id="huge-it-categories-list" name="iframecatid" onchange="this.form.submit()">
-
-							 <?php $categories = get_categories(  ); ?>
-
-							<?php	 foreach ($categories as $strcategories){
-							if(isset($_POST["iframecatid"])){
-?>
-								 <option value="<?php echo $strcategories->cat_ID; ?>" <?php if($strcategories->cat_ID == $_POST["iframecatid"]){echo 'selected="selected"';} ?>><?php echo $strcategories->cat_name; ?></option>';
-								
-							<?php	}
-else
-{
-?>
-								<option value="<?php echo $strcategories->cat_ID; ?>"><?php echo $strcategories->cat_name; ?></option>';
-<?php
-}							}
-							?> 
-							</select></label>
-							</form>
-							<form method="post"  onkeypress="doNothing()" action="admin.php?page=portfolios_huge_it_portfolio&task=popup_posts&id=<?php echo $_GET['id']; ?>&closepop=1" id="admin_form" name="admin_form">
-							<button class='save-portfolio-options button-primary huge-it-insert-post-button' id='huge-it-insert-post-button-top'>Insert Posts</button>
-							<label for="huge-it-description-length">Description Length <input id="huge-it-description-length" type="text" name="posthuge-it-description-length" value="<?php echo $row->published; ?>" placeholder="Description length" /></label>
-							<div class="view-type-block">
-								<a class="view-type list active" href="#list">View List</a>
-								<a class="view-type thumbs" href="#thumbs">View List</a>
-							</div>
-						</div>
-						<div style="clear:both;"></div>
-						<ul id="huge-it-posts-list" class="list">
-							<li id="huge-it-posts-list-heading" class="hascolor">
-								<div class="huge-it-posts-list-image">Image</div>
-								<div class="huge-it-posts-list-title">Title</div>
-								<div class="huge-it-posts-list-description">
-									Description
-									
-								</div>
-								<div class="huge-it-posts-list-link">Link</div>
-								<div class="huge-it-posts-list-category">Category</div>
-							</li>
-							<?php 
-
-
-
-							$strx=1;
-							foreach($rowsposts8 as $rowspostspop1){
-								 $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' and ID = %d  order by ID ASC", $rowspostspop1->object_id);
-							$rowspostspop=$wpdb->get_results($query);
-							//print_r($rowspostspop);
-							
-							
-								$post_categories =  wp_get_post_categories( $rowspostspop[0]->ID, $rowspostspop[0]->ID ); 
-								$cats = array();
-								
-								
-								foreach($post_categories as $c){
-									$cat = get_category( $c );
-									$cats[] = array( 'name' => $cat->name, 'slug' => $cat->slug, 'id' => $cat->term_id );
-									//echo	$cat->slug;
-								}
-								if(get_the_post_thumbnail($rowspostspop[0]->ID, 'thumbnail') != ''){
-									$strx++;
-									$hascolor="";
-									if($strx%2==0){$hascolor='class="hascolor"';}
-							?>
-								
-								<li <?php echo $hascolor; ?>>
-									<input type="checkbox" class="huge-it-post-checked"  value="<?php echo $rowspostspop[0]->ID; ?>">
-									<div class="huge-it-posts-list-image"><?php echo get_the_post_thumbnail($rowspostspop[0]->ID, 'thumbnail'); ?></div>
-									<div class="huge-it-posts-list-title"><?php echo $rowspostspop[0]->post_title;	?></div>
-									<div class="huge-it-posts-list-description"><?php echo	$rowspostspop[0]->post_content;	?></div>
-									<div class="huge-it-posts-list-link"><?php echo	$rowspostspop[0]->guid; ?></div>
-									<div class="huge-it-posts-list-category"><?php echo	$cat->slug;	?></div>
-								</li>
-							<?php }
-								}	?>
-						</ul>
-						<input id="huge-it-add-posts-params" type="hidden" name="popupposts" value="" />
-						<div class="clear"></div>
-						<button class='save-portfolio-options button-primary huge-it-insert-post-button' id='huge-it-insert-post-button-bottom'>Insert Posts</button>
-						</form>
-						
-					</div>
-				</div>		
-			
-
-	<?php
-	
-	
-	
-	
-}
-?>
-
-
+?>
\ No newline at end of file
diff --git a/portfolio-gallery.php b/portfolio-gallery.php
index cfc8073..6f69f72 100644
--- a/portfolio-gallery.php
+++ b/portfolio-gallery.php
@@ -2,11 +2,11 @@
 
 /*
 Plugin Name: Huge IT Portfolio Gallery
 Plugin URI: http://huge-it.com/portfolio-gallery
 Description: Portfolio Gallery is a great plugin for adding specialized portfolios or gallery to your site. There are various view options for the images to choose from.
-Version: 1.1.8
+Version: 1.1.9
 Author: http://huge-it.com/
 License: GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
 */
 
 
@@ -289,19 +289,10 @@ function portfolios_huge_it_portfolio()
     global $wpdb;
     switch ($task) {
 
         case 'add_cat':
             add_portfolio();
-            break;
-
-		case 'popup_posts':
-            if ($id)
-                popup_posts($id);
-            else {
-                $id = $wpdb->get_var("SELECT MAX( id ) FROM " . $wpdb->prefix . "huge_itportfolio_portfolios");
-                popup_posts($id);
-            }
             break;
         case 'edit_cat':
             if ($id)
                 editportfolio($id);
             else {
@@ -423,12 +414,10 @@ class Huge_it_portfolio_Widget extends WP_Widget {
 				<?php
 				 global $wpdb;
 				$query="SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios ";
 				$rowwidget=$wpdb->get_results($query);
 				foreach($rowwidget as $rowwidgetecho){
-				
-				selected
 				?>
 					<option <?php if($rowwidgetecho->id == $instance['portfolio_id']){ echo 'selected'; } ?> value="<?php echo $rowwidgetecho->id; ?>"><?php echo $rowwidgetecho->name; ?></option>
 
 					<?php } ?>
 				</select>
diff --git a/readme.txt b/readme.txt
index f45fc7c..caea805 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: Huge-IT
 Donate link: http://huge-it.com/portfolio-gallery/
 Tags: Portfolio Gallery, portfolio, portfolios, page, pages, picture, pictures, album, custom fields, image, image description, images, image display, image-size, images gallery, gallery, jpeg, jpg, png, labels, posts, post, visual items, thumbnails, screenshots, screenshot, image gallery, FAQ, FAQ widget, answer, answers, wordpress FAQ, questions, list, grid, web designer, slider, sliders, wordpress slider, wordpress slideshow, wp slider, slide, slide show, slider, slider plugin, slider widget, slides, slideshow, slideshow manager, gallery description, slideshow plugin, gallery slider,  galeri, galerie, widget, widget slider, widget slideshow, widgets, foto, seo, posts slider, responsive, responsive slider, responsive slideshow, Photo Slider, plugin, Image Rotator, carousel, wordpress photo gallery plugin, wordpress gallery, wordpress gallery plugin, banner rotator, best gallery, best gallery plugin, image album, image gallery plugin, images gallery, media, photo, photo album, photo albums, photo gallery, photogallery, photos, nextgen, nextgen gallery, photoset, picture, pictures, Simple gallery, website gallery, widget gallery, wp gallery plugins, wp gallery, photoalbum, view images, multiple pictures, category, categories, plugin, plugins, thumbs, shortcode, lightbox, lightbox photo, image lightbox, gallery lightbox, content slider, wordpress portfolio, galleries, galleria, wordpress portfolio plugin, project, photography, dashboard, projects, custom, filterable gallery, filterable portfolio, jquery portfolio, jquery gallery, sortable portfolio, prettyphoto, picture gallery, picture portfolio, fullscreen gallery, fullscreen, thumbnail, iphone gallery, free photo gallery, widget portfolio, fullscreen photo, free gallery, best portfolio plugin,
 Requires at least: 3.0.1
 Tested up to: 4.0
-Stable tag: 1.1.8
+Stable tag: 1.1.9
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Portfolio Gallery is a great plugin for adding specialized portfolios or gallery to your site. There are various view options for the images to choose
 
@@ -93,10 +93,13 @@ Now you can set your Portfolio Gallery options, images and use our portfolio gal
 11.  [WordPress Portfolio Gallery](http://wordpress.org/plugins/portfolio-gallery/) - Portfolio Gallery admin page  
 
 
 == Changelog ==
 
+= 1.1.9 =
+* SQL Injection bag fixed in portfolio gallery.
+
 = 1.1.8 =
 *  Add image Bug fixed in portfolio gallery.
 
 = 1.1.7 =
 *  Bug fixed in portfolio gallery.

Vulnerable code:   
  if(isset($_POST['search_events_by_title']))
$_POST['search_events_by_title']=esc_html(stripslashes($_POST['search_events_by_title']));
if(isset($_POST['asc_or_desc']))
$_POST['asc_or_desc']=esc_js($_POST['asc_or_desc']);
if(isset($_POST['order_by']))
$_POST['order_by']=esc_js($_POST['order_by']);
  $where='';
  	$sort["custom_style"] ="manage-column column-autor sortable desc";
	$sort["default_style"]="manage-column column-autor sortable desc";
	$sort["sortid_by"]='id';
	$sort["1_or_2"]=1;
	$order='';
	
	if(isset($_POST['page_number']))
	{
			
			if($_POST['asc_or_desc'])
			{
				$sort["sortid_by"]=$_POST['order_by'];
				if($_POST['asc_or_desc']==1)
				{
					$sort["custom_style"]="manage-column column-title sorted asc";
					$sort["1_or_2"]="2";
					$order="ORDER BY ".$sort["sortid_by"]." ASC";
				}
				else
				{
					$sort["custom_style"]="manage-column column-title sorted desc";
					$sort["1_or_2"]="1";
					$order="ORDER BY ".$sort["sortid_by"]." DESC";
				}
			}
	if($_POST['page_number'])
		{
			$limit=($_POST['page_number']-1)*20; 
		}
		else
		{
			$limit=0;
		}
	}
	else
		{
			$limit=0;
		}
	if(isset($_POST['search_events_by_title'])){
		$search_tag=esc_html(stripslashes($_POST['search_events_by_title']));
		}
		
		else
		{
		$search_tag="";
		}		
		
	 if(isset($_GET["catid"])){
	    $cat_id=$_GET["catid"];	
		}
       else
	   {
       if(isset($_POST['cat_search'])){
		$cat_id=$_POST['cat_search'];
		}else{
		
		$cat_id=0;}
       }
     
 if ( $search_tag ) {
		$where= " WHERE name LIKE '%".$search_tag."%' ";
	}
if($where){
	  if($cat_id){
	  $where.=" AND sl_width=" .$cat_id;
	  }
	
	}
	else{
	if($cat_id){
	  $where.=" WHERE sl_width=" .$cat_id;
	  }
	
	}
	
	 $cat_row_query="SELECT id,name FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE sl_width=0";
	// get the total number of records
	$query = "SELECT COUNT(*) FROM ".$wpdb->prefix."huge_itportfolio_portfolios". $where;
	$pageNav['total'] =$total;
	$pageNav['limit'] =	 $limit/20+1;
	
	if($cat_id){
	$query ="SELECT  a.* ,  COUNT(b.id) AS count, g.par_name AS par_name FROM ".$wpdb->prefix."huge_itportfolio_portfolios  AS a LEFT JOIN ".$wpdb->prefix."huge_itportfolio_portfolios AS b ON a.id = b.sl_width LEFT JOIN (SELECT  ".$wpdb->prefix."huge_itportfolio_portfolios.ordering as ordering,".$wpdb->prefix."huge_itportfolio_portfolios.id AS id, COUNT( ".$wpdb->prefix."huge_itportfolio_images.portfolio_id ) AS prod_count
FROM ".$wpdb->prefix."huge_itportfolio_images, ".$wpdb->prefix."huge_itportfolio_portfolios
WHERE ".$wpdb->prefix."huge_itportfolio_images.portfolio_id = ".$wpdb->prefix."huge_itportfolio_portfolios.id
GROUP BY ".$wpdb->prefix."huge_itportfolio_images.portfolio_id) AS c ON c.id = a.id LEFT JOIN
(SELECT ".$wpdb->prefix."huge_itportfolio_portfolios.name AS par_name,".$wpdb->prefix."huge_itportfolio_portfolios.id FROM ".$wpdb->prefix."huge_itportfolio_portfolios) AS g
 ON a.sl_width=g.id WHERE  a.name LIKE '%".$search_tag."%' group by a.id ". $order ." "." LIMIT ".$limit.",20" ; 
	 }
	 else{
 ON a.sl_width=g.id WHERE a.name LIKE '%".$search_tag."%'  group by a.id ". $order ." "." LIMIT ".$limit.",20" ; 
 global $glob_ordering_in_cat;
if(isset($sort["sortid_by"]))
{
	if($sort["sortid_by"]=='ordering'){
	if($_POST['asc_or_desc']==1){
		$glob_ordering_in_cat=" ORDER BY ordering ASC";
	}
	else{
		$glob_ordering_in_cat=" ORDER BY ordering DESC";
	}
	}
}
		$row->prod_count = $row_1->prod_count;
	}
	
	

	 

	 
	$new_cat_query=	"SELECT  a.* ,  COUNT(b.id) AS count, g.par_name AS par_name FROM ".$wpdb->prefix."huge_itportfolio_portfolios  AS a LEFT JOIN ".$wpdb->prefix."huge_itportfolio_portfolios AS b ON a.id = b.sl_width LEFT JOIN (SELECT  ".$wpdb->prefix."huge_itportfolio_portfolios.ordering as ordering,".$wpdb->prefix."huge_itportfolio_portfolios.id AS id, COUNT( ".$wpdb->prefix."huge_itportfolio_images.portfolio_id ) AS prod_count
FROM ".$wpdb->prefix."huge_itportfolio_images, ".$wpdb->prefix."huge_itportfolio_portfolios
WHERE ".$wpdb->prefix."huge_itportfolio_images.portfolio_id = ".$wpdb->prefix."huge_itportfolio_portfolios.id
GROUP BY ".$wpdb->prefix."huge_itportfolio_images.portfolio_id) AS c ON c.id = a.id LEFT JOIN
(SELECT ".$wpdb->prefix."huge_itportfolio_portfolios.name AS par_name,".$wpdb->prefix."huge_itportfolio_portfolios.id FROM ".$wpdb->prefix."huge_itportfolio_portfolios) AS g
 ON a.sl_width=g.id WHERE a.name LIKE '%".$search_tag."%' AND a.sl_width=".$local_cat->id." group by a.id  ".$glob_ordering_in_cat; 
 $new_cat=$wpdb->get_results($new_cat_query);
 open_cat_in_tree($new_cat,$tree_problem. "— ",0);

	  $wpdb->query("DELETE FROM ".$wpdb->prefix."huge_itportfolio_images  WHERE id = ".$_GET["removeslide"]." ");
	   $cat_row=$wpdb->get_results("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id!=" .$id." and sl_width=0");
function popup_posts($id)
{
	  global $wpdb;
	 
	     if(isset($_GET["removeslide"])){
	     if($_GET["removeslide"] != ''){
	

	  $wpdb->query("DELETE FROM ".$wpdb->prefix."huge_itportfolio_images  WHERE id = ".$_GET["removeslide"]." ");


	
	   }
	   }

	   $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id= %d",$id);
	   $row=$wpdb->get_row($query);
	   if(!isset($row->portfolio_list_effects_s))
	   return 'id not found';
       $images=explode(";;;",$row->portfolio_list_effects_s);
	   $par=explode('	',$row->param);
	   $count_ord=count($images);
	   $cat_row=$wpdb->get_results("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id!=" .$id." and sl_width=0");
       $cat_row=open_cat_in_tree($cat_row);
	   	  $query=$wpdb->prepare("SELECT name,ordering FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE sl_width=%d  ORDER BY `ordering` ",$row->sl_width);
	   $ord_elem=$wpdb->get_results($query);
	   
	    $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_images where portfolio_id = %d order by id ASC  ",$row->id);
			   $rowim=$wpdb->get_results($query);
			   
			   if(isset($_GET["addslide"])){
			   if($_GET["addslide"] == 1){
	
$table_name = $wpdb->prefix . "huge_itportfolio_images";
    $sql_2 = "
INSERT INTO 

`" . $table_name . "` ( `name`, `portfolio_id`, `description`, `image_url`, `sl_url`, `ordering`, `published`, `published_in_sl_width`) VALUES
( '', '".$row->id."', '', '', '', 'par_TV', 2, '1' )";

    $wpdb->query($sql_huge_itportfolio_images);
	

      $wpdb->query($sql_2);
	
	   }
	   }
	
	   
	   $query="SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios order by id ASC";
			   $rowsld=$wpdb->get_results($query);
			  
			    $query = "SELECT *  from " . $wpdb->prefix . "huge_itportfolio_params ";

    $rowspar = $wpdb->get_results($query);

    $paramssld = array();
    foreach ($rowspar as $rowpar) {
        $key = $rowpar->name;
        $value = $rowpar->value;
        $paramssld[$key] = $value;
    }
	
	 $query="SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' order by id ASC";
			   $rowsposts=$wpdb->get_results($query);
			   
			   $categories = get_categories(  );
		if(isset($_POST["iframecatid"])){
		$iframecatid = $_POST["iframecatid"];
		}
		else
		{
		$iframecatid = $categories[0]->cat_ID;
		}
	 
	 	  $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."term_relationships where term_taxonomy_id = %d order by object_id ASC",$iframecatid);
		$rowsposts8=$wpdb->get_results($query);


	 

			   foreach($rowsposts8 as $rowsposts13){
	 $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' and ID = %d  order by ID ASC",$rowsposts13->object_id);
			   $rowsposts1=$wpdb->get_results($query);
			   
			   $postsbycat = $rowsposts1;
			   
	 }

	  if(isset($_GET["closepop"])){
	  if($_GET["closepop"] == 1){

	      if($_POST["popupposts"] != 'none' and $_POST["popupposts"] != ''){
		  
		/*  	echo $_GET["closepop"].'sdasdasdsad';
	echo $_POST["popupposts"].'dddddddd';*/

$popuppostsposts = explode(";", $_POST["popupposts"]);

array_pop($popuppostsposts);

		foreach($popuppostsposts as $popuppostsposts1){
		$my_id = $popuppostsposts1;
		
$post_id_1 = get_post($my_id); 



			   $post_image = wp_get_attachment_url( get_post_thumbnail_id($popuppostsposts1) );
		$posturl=get_permalink($popuppostsposts1);
$table_name = $wpdb->prefix . "huge_itportfolio_images";

$descnohtmlnoq=strip_tags($post_id_1->post_content);
$descnohtmlnoq1 = html_entity_decode($descnohtmlnoq);
$descnohtmlnoq1 = htmlentities($descnohtmlnoq1, ENT_QUOTES, "UTF-8");


    $sql_posts = "
INSERT INTO 

`" . $table_name . "` ( `name`, `portfolio_id`, `description`, `image_url`, `sl_url`, `sl_type`, `link_target`, `ordering`, `published`, `published_in_sl_width`) VALUES
( '".$post_id_1->post_title."', '".$row->id."', '".$descnohtmlnoq1."', '".$post_image ."', '".$posturl."', 'image', 'on', '0', '2', '1' )";



      $wpdb->query($sql_posts);
	  
	

		}
		
	}
	if(!($_POST["lastposts"])){
	 $wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET published = '".$_POST["posthuge-it-description-length"]."' WHERE id = '".$_GET['id']."' ");
	 }
	  }
	  }

if(isset($_POST["lastposts"])){
$query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' order by id DESC LIMIT 0, ".$_POST["lastposts"]."");
			   $rowspostslast=$wpdb->get_results($query);
			   foreach($rowspostslast as $rowspostslastfor){
			   
			   		$my_id = $rowspostslastfor;
$post_id_1 = get_post($my_id); 



			   $post_image = wp_get_attachment_url( get_post_thumbnail_id($rowspostslastfor) );
		$posturl=get_permalink($rowspostslastfor);
$table_name = $wpdb->prefix . "huge_itportfolio_images";
$descnohtmlno=strip_tags($post_id_1->post_content);
$descnohtmlno1 = html_entity_decode($descnohtmlno);
$lengthtextpost = '300';
$descnohtmlno2 = substr_replace($descnohtmlno1, "", $lengthtextpost);
$descnohtmlno3 = htmlentities($descnohtmlno2, ENT_QUOTES, "UTF-8");
$posttitle = htmlentities($post_id_1->post_title, ENT_QUOTES, "UTF-8");
$posturl2 = htmlentities($posturl, ENT_QUOTES, "UTF-8");

			   
			       $sql_lastposts = "INSERT INTO 
`" . $table_name . "` ( `name`, `portfolio_id`, `description`, `image_url`, `sl_url`, `ordering`, `published`, `published_in_sl_width`) VALUES
( '".$posttitle."', '".$row->id."', '".$descnohtmlno3."', '".$post_image ."', '".$posturl."', 'par_TV', 2, '1' )";

    $wpdb->query($sql_huge_itportfolio_images);

      $wpdb->query($sql_lastposts);
	  }
}
	   	   
    Html_popup_posts($ord_elem, $count_ord, $images, $row, $cat_row, $rowim, $rowsld, $paramssld, $rowsposts, $rowsposts8, $postsbycat);
}
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  name = '".$_POST["name"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_width = '".$_POST["sl_width"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_height = '".$_POST["sl_height"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  pause_on_hover = '".$_POST["pause_on_hover"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  portfolio_list_effects_s = '".$_POST["portfolio_effects_list"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  description = '".$_POST["sl_pausetime"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  param = '".$_POST["sl_changespeed"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_position = '".$_POST["sl_position"]."'  WHERE id = '".$id."' ");
			$wpdb->query("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  ordering = '1'  WHERE id = '".$id."' ");


function html_popup_posts($ord_elem, $count_ord,$images,$row,$cat_row, $rowim, $rowsld, $paramssld, $rowsposts, $rowsposts8, $postsbycat){
	global $wpdb;

?>
			<style>
				html.wp-toolbar {
					padding:0px !important;
				}
				#wpadminbar,#adminmenuback,#screen-meta, .update-nag,#dolly {
					display:none;
				}
				#wpbody-content {
					padding-bottom:30px;
				}
				#adminmenuwrap {display:none !important;}
				.auto-fold #wpcontent, .auto-fold #wpfooter {
					margin-left: 0px;
				}
				#wpfooter {display:none;}
			</style>
			<script type="text/javascript">
				jQuery(document).ready(function() {

					jQuery('.huge-it-insert-post-button').on('click', function() {
						var ID1 = jQuery('#huge-it-add-posts-params').val();
						if(ID1==""){alert("Please select images to insert into portfolio.");return false;}
						
						window.parent.uploadID.val(ID1);
						
						tb_remove();
						jQuery("#save-buttom").click();
						
					});
						
					jQuery('.huge-it-post-checked').change(function(){
						if(jQuery(this).is(':checked')){
							jQuery(this).addClass('active');
							jQuery(this).parent().addClass('active');
						}else {
							jQuery(this).removeClass('active');
							jQuery(this).parent().removeClass('active');
						}
						
						var inputval="";
						jQuery('#huge-it-add-posts-params').val("");
						jQuery('.huge-it-post-checked').each(function(){
							if(jQuery(this).is(':checked')){
								inputval+=jQuery(this).val()+";";
							}
						});
						jQuery('#huge-it-add-posts-params').val(inputval);
					});
	
					
					jQuery("#huge-it-categories-list").change(function(){
						var currentCategoryID=jQuery(this).val();
					
						jQuery('#huge-it-posts-list li').not("#huge-it-posts-list-heading").css({"display":"none"});
						jQuery('li[data-id*="'+currentCategoryID+'"]').css({"display":"block"});
						
					});
					//jQuery("#huge-it-categories-list").change();
										
					jQuery('#huge_it_portfolio_add_posts_wrap .view-type-block a').click(function(){
						jQuery('#huge_it_portfolio_add_posts_wrap .view-type-block a').removeClass('active');
						jQuery(this).addClass('active');
						var strtype=jQuery(this).attr('href').replace('#','');
						jQuery('#huge-it-posts-list').removeClass('list').removeClass('thumbs');
						jQuery('#huge-it-posts-list').addClass(strtype);
						return false;
					});
					
					
					jQuery('.updated').css({"display":"none"});
				<?php	if($_GET["closepop"] == 1){ ?>
					jQuery("#closepopup").click();
					self.parent.location.reload();
				<?php	} ?>
				});
				
			</script>
			<a id="closepopup"  onclick=" parent.eval('tb_remove()')" style="display:none;" > [X] </a>
	
	
	<div id="huge_it_portfolio_add_posts">
					<div id="huge_it_portfolio_add_posts_wrap">
						<h2>Add post</h2>
						<div class="control-panel">
						<form method="post"  onkeypress="doNothing()" action="admin.php?page=portfolios_huge_it_portfolio&task=popup_posts&id=<?php echo $_GET['id']; ?>" id="huge-it-category-form" name="admin_form">
							<label for="huge-it-categories-list">Select Category <select id="huge-it-categories-list" name="iframecatid" onchange="this.form.submit()">

							 <?php $categories = get_categories(  ); ?>

							<?php	 foreach ($categories as $strcategories){
							if(isset($_POST["iframecatid"])){
?>
								 <option value="<?php echo $strcategories->cat_ID; ?>" <?php if($strcategories->cat_ID == $_POST["iframecatid"]){echo 'selected="selected"';} ?>><?php echo $strcategories->cat_name; ?></option>';
								
							<?php	}
else
{
?>
								<option value="<?php echo $strcategories->cat_ID; ?>"><?php echo $strcategories->cat_name; ?></option>';
<?php
}							}
							?> 
							</select></label>
							</form>
							<form method="post"  onkeypress="doNothing()" action="admin.php?page=portfolios_huge_it_portfolio&task=popup_posts&id=<?php echo $_GET['id']; ?>&closepop=1" id="admin_form" name="admin_form">
							<button class='save-portfolio-options button-primary huge-it-insert-post-button' id='huge-it-insert-post-button-top'>Insert Posts</button>
							<label for="huge-it-description-length">Description Length <input id="huge-it-description-length" type="text" name="posthuge-it-description-length" value="<?php echo $row->published; ?>" placeholder="Description length" /></label>
							<div class="view-type-block">
								<a class="view-type list active" href="#list">View List</a>
								<a class="view-type thumbs" href="#thumbs">View List</a>
							</div>
						</div>
						<div style="clear:both;"></div>
						<ul id="huge-it-posts-list" class="list">
							<li id="huge-it-posts-list-heading" class="hascolor">
								<div class="huge-it-posts-list-image">Image</div>
								<div class="huge-it-posts-list-title">Title</div>
								<div class="huge-it-posts-list-description">
									Description
									
								</div>
								<div class="huge-it-posts-list-link">Link</div>
								<div class="huge-it-posts-list-category">Category</div>
							</li>
							<?php 



							$strx=1;
							foreach($rowsposts8 as $rowspostspop1){
								 $query=$wpdb->prepare("SELECT * FROM ".$wpdb->prefix."posts where post_type = 'post' and post_status = 'publish' and ID = %d  order by ID ASC", $rowspostspop1->object_id);
							$rowspostspop=$wpdb->get_results($query);
							//print_r($rowspostspop);
							
							
								$post_categories =  wp_get_post_categories( $rowspostspop[0]->ID, $rowspostspop[0]->ID ); 
								$cats = array();
								
								
								foreach($post_categories as $c){
									$cat = get_category( $c );
									$cats[] = array( 'name' => $cat->name, 'slug' => $cat->slug, 'id' => $cat->term_id );
									//echo	$cat->slug;
								}
								if(get_the_post_thumbnail($rowspostspop[0]->ID, 'thumbnail') != ''){
									$strx++;
									$hascolor="";
									if($strx%2==0){$hascolor='class="hascolor"';}
							?>
								
								<li <?php echo $hascolor; ?>>
									<input type="checkbox" class="huge-it-post-checked"  value="<?php echo $rowspostspop[0]->ID; ?>">
									<div class="huge-it-posts-list-image"><?php echo get_the_post_thumbnail($rowspostspop[0]->ID, 'thumbnail'); ?></div>
									<div class="huge-it-posts-list-title"><?php echo $rowspostspop[0]->post_title;	?></div>
									<div class="huge-it-posts-list-description"><?php echo	$rowspostspop[0]->post_content;	?></div>
									<div class="huge-it-posts-list-link"><?php echo	$rowspostspop[0]->guid; ?></div>
									<div class="huge-it-posts-list-category"><?php echo	$cat->slug;	?></div>
								</li>
							<?php }
								}	?>
						</ul>
						<input id="huge-it-add-posts-params" type="hidden" name="popupposts" value="" />
						<div class="clear"></div>
						<button class='save-portfolio-options button-primary huge-it-insert-post-button' id='huge-it-insert-post-button-bottom'>Insert Posts</button>
						</form>
						
					</div>
				</div>		
			

	<?php
	
	
	
	
}
?>


Version: 1.1.8
            break;

		case 'popup_posts':
            if ($id)
                popup_posts($id);
            else {
                $id = $wpdb->get_var("SELECT MAX( id ) FROM " . $wpdb->prefix . "huge_itportfolio_portfolios");
                popup_posts($id);
            }
				
				selected
Stable tag: 1.1.8
Fixed code: 	$limit=0;

	$search_tag=esc_html(stripslashes($_POST['search_events_by_title']));
	$cat_row_query="SELECT id,name FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE sl_width=0";

	$query = $wpdb->prepare("SELECT COUNT(*) FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE name LIKE '% %s %'" , $search_tag);
	if(!($cat_id)){
 ON a.sl_width=g.id WHERE a.name LIKE '%".$search_tag."%'  group by a.id  "; 

			$row->prod_count = $row_1->prod_count;
}
		$idfordelete = $_GET["removeslide"];
	  $wpdb->query($wpdb->prepare("DELETE FROM ".$wpdb->prefix."huge_itportfolio_images  WHERE id = %d ", $idfordelete));
	   $cat_row=$wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."huge_itportfolio_portfolios WHERE id!= %d and sl_width=0", $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  name = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_width = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_height = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  pause_on_hover = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  portfolio_list_effects_s = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  description = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  param = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  sl_position = %s  WHERE id = %d ", $_POST["name"], $id));
	$wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."huge_itportfolio_portfolios SET  ordering = '1'  WHERE id = %d ", $id));
?>
Version: 1.1.9
Stable tag: 1.1.9
= 1.1.9 =
* SQL Injection bag fixed in portfolio gallery.