Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Fix escaping

Browse Source
This commit is contained in:
Laurent Destailleur
2020-09-19 23:30:29 +02:00
parent c191dd1a34
commit 216b3c885d
75 changed files with 486 additions and 436 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/commande/class/commande.class.php
View File

@@ -1122,7 +1122,7 @@ class Commande extends CommonOrder
}
$sqlcontact = "SELECT ctc.code, ctc.source, ec.fk_socpeople FROM ".MAIN_DB_PREFIX."element_contact as ec, ".MAIN_DB_PREFIX."c_type_contact as ctc";
$sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$originforcontact."'";
$sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$this->db->escape($originforcontact)."'";
$resqlcontact = $this->db->query($sqlcontact);
if ($resqlcontact)