--- a/ad.module	Thu Apr 02 15:28:21 2009 +0000
+++ b/ad.module	Wed Apr 15 07:58:32 2009 +0000
@@ -1,5 +1,5 @@
 <?php
-// $Id: ad.module,v 1.2.2.29.2.83.2.16.2.12 2009/03/31 04:41:03 jeremy Exp $
+// $Id: ad.module,v 1.2.2.29.2.83.2.16.2.16 2009/04/14 14:02:11 jeremy Exp $
 
 /**
  * @file
@@ -157,7 +157,7 @@
       else {
         $query['u'] = $_GET['q'];
       }
-      $src = url($base_url .'/'. $adserve, array('query' => $query));
+      $src = htmlentities(url($base_url .'/'. $adserve, array('query' => $query)));
       if ($options['ad_display'] == 'iframe') {
         // TODO: We need to know the IFrame size before it is displayed.  This
         // limits the flexibility of what can be displayed in these frames.
@@ -1334,9 +1334,11 @@
         'expired' => t('Email @when after the advertisement is expired.'),
         '-active' => t('Email @when before the advertisement will be activated (if scheduled).'),
         'active' => t('Email @when after the advertisement is activated.'),
+        'offline' => t('Email @when after the advertisement is taken offline.'),
         'click' => t('Email @when after the advertisement is clicked.'),
         'approved' => t('Email @when after the advertisement is approved.'),
         'denied' => t('Email @when after the advertisement is denied.'),
+        'update' => t('Email @when after the advertisement is updated.'),
       );
       break;
     case '-expired':
@@ -1531,25 +1533,16 @@
 /**
  * Builds the necessary HTML to display an image-based impressions counter.
  */
-function ad_display_image($ad, $css = TRUE) {
+function ad_display_image($aid, $css = TRUE) {
   global $base_url;
   $adserve = variable_get('adserve', '');
   $cache = variable_get('ad_cache', 'none');
   $variables = "?o=image";
-  if (is_object($ad)) {
-    $aid = $ad->aid;
+  $variables .= "&a=$aid";
+  if ($cache != 'none') {
+    $variables .= '&c='. $cache . module_invoke('ad_cache_'. $cache, 'adcacheapi', 'display_variables', array());
   }
-  else {
-    /**
-     * No ad is specified, so we're just tracking traffic.
-     */
-    $aid = 0;
-  }
-  $variables .= "&amp;a=$aid";
-  if ($cache != 'none') {
-    $variables .= '&amp;c='. $cache . module_invoke('ad_cache_'. $cache, 'adcacheapi', 'display_variables', array());
-  }
-  $output = '<img src="'. url($base_url .'/'. $adserve . $variables) .'" height="0" width="0" alt="view counter" />';
+  $output = '<img src="'. htmlentities(url($base_url .'/'. $adserve . $variables)) .'" height="0" width="0" alt="view counter" />';
   if ($css) {
     return '<div class="ad-image-counter">'. $output .'</div>';
   }