Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

missing db->escape

Browse Source
This commit is contained in:
Stephane Lesage
2020-11-29 23:36:06 +01:00
parent c0c8aef7aa
commit 7fbf5482fc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/user/list.php
View File

@@ -343,7 +343,7 @@ if ($search_thirdparty != '') $sql .= natural_search(array('s.nom'), $search_thi
if ($search_login != '') $sql .= natural_search("u.login", $search_login);
if ($search_lastname != '') $sql .= natural_search("u.lastname", $search_lastname);
if ($search_firstname != '') $sql .= natural_search("u.firstname", $search_firstname);
if ($search_gender != '' && $search_gender != '-1') $sql .= " AND u.gender = '".$search_gender."'"; // Cannot use natural_search as looking for %man% also includes woman
if ($search_gender != '' && $search_gender != '-1') $sql .= " AND u.gender = '".$db->escape($search_gender)."'"; // Cannot use natural_search as looking for %man% also includes woman
if (is_numeric($search_employee) && $search_employee >= 0) {
$sql .= ' AND u.employee = '.(int) $search_employee;
}