Fix SQL injection in vehicle plate order history lookup

2026-06-01 22:55:06 +02:00
parent 7835f068b6
commit bc4b7bde15
1 changed files with 3 additions and 1 deletions
@@ -189,6 +189,8 @@ class orders_o extends db
    public function getOrderHistoryByVehiclePlate(string $plate, int $entries = 10): array
    {
        global $db;
+        $plate = $db->escape_string($plate);
+        $entries = max(1, $entries);
        $sql = "SELECT * FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' ORDER BY id DESC LIMIT $entries";
        $result = $db->query($sql);
        return $db->fetch_all($result);
@@ -1624,4 +1626,4 @@ class orders_o extends db
        }
        return $orders;
    }
-}
+}