'defaultlang' attribute was not filtered before database request which cause an SQL injection.

FIX Link to preview on thirdparty broken with multicompany

for some raeson the code was checking for already existing extra fields before even fetching it. removed the if condition, now it works fine.

civility added + extrafields for external contacts + isInternal to decide in template wether to list internal or not