From bc4b7bde15eba719b003184d849d1f749eb8283c Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:55:06 +0200
Subject: [PATCH] Fix SQL injection in vehicle plate order history lookup

---
 services/nginx/app/objects/orders_o.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/services/nginx/app/objects/orders_o.php b/services/nginx/app/objects/orders_o.php
index 1122ce4c..9800d3bd 100644
--- a/services/nginx/app/objects/orders_o.php
+++ b/services/nginx/app/objects/orders_o.php
@@ -189,6 +189,8 @@ class orders_o extends db
     public function getOrderHistoryByVehiclePlate(string $plate, int $entries = 10): array
     {
         global $db;
+        $plate = $db->escape_string($plate);
+        $entries = max(1, $entries);
         $sql = "SELECT * FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' ORDER BY id DESC LIMIT $entries";
         $result = $db->query($sql);
         return $db->fetch_all($result);
@@ -1624,4 +1626,4 @@ class orders_o extends db
         }
         return $orders;
     }
-}
\ No newline at end of file
+}