Merge pull request #196 from copenhagentruckwash/fix-sql-injection-in-recommended-order-lookup

Escape plate input to prevent SQL injection in recommended-order lookup

services/nginx/app/objects/orders_o.php

@@ -537,6 +537,7 @@ class orders_o extends db
     {
         global /** @var db $db */
         $db;
+        $plate = $db->escape_string($plate);
         $sql = "SELECT id FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' AND deleted_at IS NULL ORDER BY id DESC LIMIT 5";
         $result = $db->query($sql);
         $orders = $db->fetch_all($result);
@@ -2155,7 +2156,6 @@ class orders_o extends db
         }
         return $orders;
     }
-
     /**
      * @throws Exception
      */