Merge pull request #206 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-history

Fix SQL injection in vehicle plate order history lookup
2026-06-01 22:59:14 +02:00
parent 828c177a57 6995c3d1bc
commit ef237b5e87
1 changed files with 2 additions and 0 deletions
@@ -270,6 +270,8 @@ class orders_o extends db
    public function getOrderHistoryByVehiclePlate(string $plate, int $entries = 10): array
    {
        global $db;
+        $plate = $db->escape_string($plate);
+        $entries = max(1, $entries);
        $sql = "SELECT * FROM $this->table WHERE reg_1 = '$plate' OR reg_2 = '$plate' OR reg_3 = '$plate' ORDER BY id DESC LIMIT $entries";
        $result = $db->query($sql);
        return $db->fetch_all($result);