From d1871f14203b596a6f5e2a8a3e6ae8180c0eb1c1 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 23:03:18 +0200
Subject: [PATCH] Fix SQL injection in vehicle plate order history lookup

---
 services/nginx/app/objects/orders_o.php | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/services/nginx/app/objects/orders_o.php b/services/nginx/app/objects/orders_o.php
index 1122ce4c..00425fec 100644
--- a/services/nginx/app/objects/orders_o.php
+++ b/services/nginx/app/objects/orders_o.php
@@ -484,8 +484,14 @@ class orders_o extends db
     public function get_vehicle_order_history(string $plate): array
     {
         global $db;
-        $sql = "SELECT * FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' AND deleted_at IS NULL ORDER BY id DESC LIMIT 5";
-        $result = $db->query($sql);
+        $stmt = $db->prepare("SELECT * FROM $this->table WHERE (reg_1 = ? OR reg_2 = ? OR reg_3 = ?) AND deleted_at IS NULL ORDER BY id DESC LIMIT 5");
+        if (!$stmt) {
+            return [];
+        }
+        $stmt->bind_param('sss', $plate, $plate, $plate);
+        $stmt->execute();
+        $result = $stmt->get_result();
+        $stmt->close();
         return $db->fetch_all($result);
     }
 
@@ -1624,4 +1630,4 @@ class orders_o extends db
         }
         return $orders;
     }
-}
\ No newline at end of file
+}