fix: improve album ID handling in search query for better SQL preparation

Author: the-hercules

app/main/controllers/template/rtmedia-filters.php

@@ -772,7 +772,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {
 			if ( ! empty( $search_by ) ) {
 
 				if ( ! empty( $rtmedia_current_album ) ) {
-					$where .= $wpdb->prepare( " $table_name.album_id = %s AND ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+					$where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
 				}
 
 				if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) {
@@ -798,7 +798,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {
 			} else {
 
 				if ( ! empty( $rtmedia_current_album ) ) {
-					$where .= $wpdb->prepare( " $table_name.album_id = %s AND ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+					$where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
 				}
 
 				if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) {
@@ -824,7 +824,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {
 
 			// Reset data for album's media.
 			if ( '' !== $search && ! empty( $rtmedia_current_album ) ) {
-					$where .= $wpdb->prepare( " AND $table_name.album_id = %s ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+					$where .= $wpdb->prepare( " AND $table_name.album_id = %d ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
 			}
 
 			// Reset data for particular media type.
@@ -873,10 +873,13 @@ function rtmedia_search_fillter_join_query( $join, $table_name ) {
 			$request_uri = rtm_get_server_var( 'REQUEST_URI', 'FILTER_SANITIZE_URL' );
 			$request_url = explode( '/', $request_uri );
 			if ( ! empty( $search_by ) && 'attribute' === $search_by && ! in_array( 'attribute', $request_url, true ) ) {
-				$join .= " 	INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = '$media_type' )
-		                    INNER JOIN $terms_table ON ( $terms_table.slug IN (" . $wpdb->prepare( '%s', $search ) . ") )
+				$join .= $wpdb->prepare(
+					" 	INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = '$media_type' )
+		                    INNER JOIN $terms_table ON ( $terms_table.slug IN (%s) )
 		                    INNER JOIN $term_taxonomy_table ON ( $term_taxonomy_table.term_id = $terms_table.term_id )
-		                    INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) ";
+		                    INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) ",
+					$search
+				); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
 			}
 		}
 	}