SQL injection in maybe_delete_stats()

[GreggFranklin]

File: includes/class-holler-reporting.php

Existing:

<?php
public function maybe_delete_stats( $post_id, $post ) {

    if ( $post->post_type !== 'hollerbox' ) {
        return;
    }

    global $wpdb;

    $wpdb->query( "DELETE FROM $this->table_name WHERE popup_id = $post_id" );
}

Fixed:

<?php
public function maybe_delete_stats( $post_id, $post ) {

    if ( $post->post_type !== 'hollerbox' ) {
        return;
    }

    global $wpdb;

    $wpdb->query( $wpdb->prepare(
        "DELETE FROM {$this->table_name} WHERE popup_id = %d",
        $post_id
    ) );
}

What changed: $post_id is now passed as a %d placeholder through $wpdb->prepare() instead of being interpolated directly into the SQL string. prepare() casts it to an integer and escapes it, so no value in that position can alter the query structure. The table name stays interpolated (it can't be a placeholder), but it's a plugin-controlled constant, not user input. Wrapping it in {} is just clarity, not security.