Fix SQL injection in vehicle plate order history lookup

services/nginx/app/objects/orders_o.php

@@ -484,8 +484,14 @@ class orders_o extends db
     public function get_vehicle_order_history(string $plate): array
     {
         global $db;
-        $sql = "SELECT * FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' AND deleted_at IS NULL ORDER BY id DESC LIMIT 5";
-        $result = $db->query($sql);
+        $stmt = $db->prepare("SELECT * FROM $this->table WHERE (reg_1 = ? OR reg_2 = ? OR reg_3 = ?) AND deleted_at IS NULL ORDER BY id DESC LIMIT 5");
+        if (!$stmt) {
+            return [];
+        }
+        $stmt->bind_param('sss', $plate, $plate, $plate);
+        $stmt->execute();
+        $result = $stmt->get_result();
+        $stmt->close();
         return $db->fetch_all($result);
     }
 
@@ -1624,4 +1630,4 @@ class orders_o extends db
         }
         return $orders;
     }
-}
+}