diff --git a/services/nginx/app/objects/orders_o.php b/services/nginx/app/objects/orders_o.php
index e20ccade..878d2110 100644
--- a/services/nginx/app/objects/orders_o.php
+++ b/services/nginx/app/objects/orders_o.php
@@ -593,8 +593,14 @@ class orders_o extends db
     public function get_vehicle_order_history(string $plate): array
     {
         global $db;
-        $sql = "SELECT * FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' AND deleted_at IS NULL ORDER BY id DESC LIMIT 5";
-        $result = $db->query($sql);
+        $stmt = $db->prepare("SELECT * FROM $this->table WHERE (reg_1 = ? OR reg_2 = ? OR reg_3 = ?) AND deleted_at IS NULL ORDER BY id DESC LIMIT 5");
+        if (!$stmt) {
+            return [];
+        }
+        $stmt->bind_param('sss', $plate, $plate, $plate);
+        $stmt->execute();
+        $result = $stmt->get_result();
+        $stmt->close();
         return $db->fetch_all($result);
     }