From c2370f352b0cb610b63c85c802c01954e57d534b Mon Sep 17 00:00:00 2001
From: Florian HENRY <florian.henry@open-concept.pro>
Date: Fri, 16 May 2014 15:03:28 +0200
Subject: [PATCH] escape for insert SQL expedition module
---
htdocs/expedition/class/expedition.class.php | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/htdocs/expedition/class/expedition.class.php b/htdocs/expedition/class/expedition.class.php
index ba956ccdef4..3f41cdbc07b 100644
--- a/htdocs/expedition/class/expedition.class.php
+++ b/htdocs/expedition/class/expedition.class.php
@@ -203,8 +203,8 @@ class Expedition extends CommonObject
$sql.= ") VALUES (";
$sql.= "'(PROV)'";
$sql.= ", ".$conf->entity;
- $sql.= ", ".($this->ref_customer?"'".$this->ref_customer."'":"null");
- $sql.= ", ".($this->ref_int?"'".$this->ref_int."'":"null");
+ $sql.= ", ".($this->ref_customer?"'".$this->db->escape($this->ref_customer)."'":"null");
+ $sql.= ", ".($this->ref_int?"'".$this->db->escape($this->ref_int)."'":"null");
$sql.= ", '".$this->db->idate($now)."'";
$sql.= ", ".$user->id;
$sql.= ", ".($this->date_expedition>0?"'".$this->db->idate($this->date_expedition)."'":"null");
--
GitLab