In arrowchat to show the list of connected friends the following query is performed. In this query does not take into account if the request of friendship was accepted, for this the field Check has to be 1.
$sql = ("
SELECT DISTINCT " . TABLE_PREFIX . DB_USERTABLE . "." . DB_USERTABLE_USERID . " userid, " . TABLE_PREFIX . DB_USERTABLE . "." . DB_USERTABLE_NAME . " username, arrowchat_status.session_time lastactivity, " . TABLE_PREFIX . DB_USERTABLE . "." . DB_USERTABLE_AVATAR . " avatar, " . TABLE_PREFIX . DB_USERTABLE . "." . DB_USERTABLE_NAME . " link, arrowchat_status.is_admin, arrowchat_status.status
FROM (SELECT ID, profile FROM sys_friend_list UNION SELECT profile, ID FROM sys_friend_list) friends
JOIN " . TABLE_PREFIX . DB_USERTABLE . "
ON " . TABLE_PREFIX . DB_FRIENDSTABLE . "." . DB_FRIENDSTABLE_FRIENDID . " = " . TABLE_PREFIX . DB_USERTABLE . "." . DB_USERTABLE_USERID . "
LEFT JOIN arrowchat_status
ON " . TABLE_PREFIX . DB_USERTABLE . "." . DB_USERTABLE_USERID . " = arrowchat_status.userid
WHERE " . TABLE_PREFIX . DB_FRIENDSTABLE . "." . DB_FRIENDSTABLE_USERID . " = '" . $db->escape_string($userid) . "'
AND arrowchat_status.session_time > (" . time() . " - " . $online_timeout . " - 60)
ORDER BY " . TABLE_PREFIX . DB_USERTABLE . "." . DB_USERTABLE_NAME . " ASC
");
How can it be improved?