I was right, it was sus

1 files changed, 6 insertions, 4 deletions

diff --git a/inbox_settings.php b/inbox_settings.php
index a0b36b5..5a7658b 100644
--- a/inbox_settings.php
+++ b/inbox_settings.php
@@ -180,7 +180,7 @@ class inbox_settings extends rcube_plugin {
     }
 
     function delete_selected_keys() {
-        run_query('delete_keys', $_POST['keys']);
+        $this->run_query('delete_keys', ['%k' => $_POST['keys']]);
         $this->rcmail->output->set_pagetitle($this->gettext('deleting_key'));
         $this->rcmail->output->send('plugin');
     }
@@ -271,9 +271,11 @@ class inbox_settings extends rcube_plugin {
 
     private static function quote_replacement($db, $value) {
         if (!is_array($value)) return $db->quote($value, 'text');
-        return '(' . implode(', ', array_map(function ($inner) {
-                return self::quote_replacement($db, $inner);
-            }, $value)) . ')';
+        $quoted = [];
+        foreach ($value as $item) {
+            $quoted[] = self::quote_replacement($db, $item);
+        }
+        return '(' . implode(', ', $quoted) . ')';
     }
 
     private static function parse_dsn($dsn) {