diff --git a/htdocs/accountancy/admin/report_list.php b/htdocs/accountancy/admin/report_list.php index 91463a27082..74846999790 100644 --- a/htdocs/accountancy/admin/report_list.php +++ b/htdocs/accountancy/admin/report_list.php @@ -212,7 +212,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) { // List of values if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) { - $sql .= $newid.","; + $sql .= ((int) $newid).","; } $i = 0; foreach ($listfieldinsert as $f => $value) { diff --git a/htdocs/accountancy/class/bookkeepingtemplateline.class.php b/htdocs/accountancy/class/bookkeepingtemplateline.class.php index c6f54b9fdee..3297d987844 100644 --- a/htdocs/accountancy/class/bookkeepingtemplateline.class.php +++ b/htdocs/accountancy/class/bookkeepingtemplateline.class.php @@ -247,10 +247,10 @@ class BookkeepingTemplateLine extends CommonObject * @param int $limit limit * @param int $offset Offset * @param array $filter Filter array. Example array('mystringfield'=>'value', 'myintfield'=>4, 'customsql'=>...) - * @param string $filtermode Filter mode (AND or OR) + * @param 'AND'|'OR' $sqlfiltermode Filter mode (AND or OR) * @return BookkeepingTemplateLine[]|int Array of BookkeepingTemplateLine objects if OK, <0 if KO */ - public function fetchAll($sortorder = '', $sortfield = '', $limit = 0, $offset = 0, array $filter = array(), $filtermode = 'AND') + public function fetchAll($sortorder = '', $sortfield = '', $limit = 0, $offset = 0, array $filter = array(), $sqlfiltermode = 'AND') { dol_syslog(__METHOD__, LOG_DEBUG); @@ -313,7 +313,7 @@ class BookkeepingTemplateLine extends CommonObject } } if (count($sqlwhere) > 0) { - $sql .= " AND (".implode(" ".$filtermode." ", $sqlwhere).")"; + $sql .= " AND (".implode(" ".$sqlfiltermode." ", $sqlwhere).")"; } if (!empty($sortfield)) { diff --git a/htdocs/accountancy/customer/index.php b/htdocs/accountancy/customer/index.php index e7f91c6efb2..6eca51892b5 100644 --- a/htdocs/accountancy/customer/index.php +++ b/htdocs/accountancy/customer/index.php @@ -5,7 +5,7 @@ * Copyright (C) 2014 Juanjo Menent * Copyright (C) 2015 Jean-François Ferry * Copyright (C) 2024 Frédéric France - * Copyright (C) 2025 MDW + * Copyright (C) 2025-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -156,10 +156,10 @@ if ($action == 'validatehistory' && $user->hasRight('accounting', 'bind', 'write } $alias_societe_perentity = !getDolGlobalString('MAIN_COMPANY_PERENTITY_SHARED') ? "s" : "spe"; $alias_product_perentity = !getDolGlobalString('MAIN_PRODUCT_PERENTITY_SHARED') ? "p" : "ppe"; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa ON ".$db->sanitize($alias_product_perentity).".accountancy_code_sell = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".$conf->entity; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa2 ON ".$db->sanitize($alias_product_perentity).".accountancy_code_sell_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".$conf->entity; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa3 ON ".$db->sanitize($alias_product_perentity).".accountancy_code_sell_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".$conf->entity; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa4 ON ".$db->sanitize($alias_societe_perentity).".accountancy_code_sell = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".$conf->entity; + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa ON ".$db->sanitize($alias_product_perentity).".accountancy_code_sell = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".((int) $conf->entity); + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa2 ON ".$db->sanitize($alias_product_perentity).".accountancy_code_sell_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".((int) $conf->entity); + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa3 ON ".$db->sanitize($alias_product_perentity).".accountancy_code_sell_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".((int) $conf->entity); + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa4 ON ".$db->sanitize($alias_societe_perentity).".accountancy_code_sell = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".((int) $conf->entity); $sql .= " WHERE f.fk_statut > 0 AND l.fk_code_ventilation <= 0"; $sql .= " AND l.product_type <= 2"; $sql .= " AND f.entity IN (".getEntity('invoice', 0).")"; // We don't share object for accountancy @@ -356,8 +356,8 @@ for ($i = 1; $i <= 12; $i++) { if ($j > 12) { $j -= 12; } - $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((string) $j), "fd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; - $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((string) $j), "1", "0").") AS nbmonth".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((int) $j), "fd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((int) $j), "1", "0").") AS nbmonth".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; } $sql .= " SUM(fd.total_ht) as total, COUNT(fd.rowid) as nb"; $sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd"; @@ -496,7 +496,7 @@ for ($i = 1; $i <= 12; $i++) { if ($j > 12) { $j -= 12; } - $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((int) $j), "fd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((int) $j), "fd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; } $sql .= " SUM(fd.total_ht) as total"; $sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd"; @@ -599,7 +599,7 @@ if (getDolGlobalString('SHOW_TOTAL_OF_PREVIOUS_LISTS_IN_LIN_PAGE')) { // This pa if ($j > 12) { $j -= 12; } - $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((int) $j), "fd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(f.datef) = ".((int) $j), "fd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; } $sql .= " SUM(fd.total_ht) as total"; $sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd"; @@ -672,7 +672,7 @@ if (getDolGlobalString('SHOW_TOTAL_OF_PREVIOUS_LISTS_IN_LIN_PAGE')) { // This pa " (fd.total_ht * ((fd.situation_percent - COALESCE(prev_fd.situation_percent, 0)) / fd.situation_percent) - (fd.buy_price_ht * fd.qty * ((fd.situation_percent - COALESCE(prev_fd.situation_percent, 0)) / 100)))" ).")", '0' - ).") AS month".str_pad((string) $j, 2, '0', STR_PAD_LEFT).","; + ).") AS month".str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT).","; } $sql .= " SUM(".$db->ifsql( "fd.total_ht < 0", @@ -694,7 +694,7 @@ if (getDolGlobalString('SHOW_TOTAL_OF_PREVIOUS_LISTS_IN_LIN_PAGE')) { // This pa " (fd.total_ht - (fd.buy_price_ht * fd.qty))" ).")", '0' - ).") AS month".str_pad((string) $j, 2, '0', STR_PAD_LEFT).","; + ).") AS month".str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT).","; } $sql .= " SUM(".$db->ifsql( "fd.total_ht < 0", diff --git a/htdocs/accountancy/supplier/index.php b/htdocs/accountancy/supplier/index.php index 366c7253f8f..efd583f5a34 100644 --- a/htdocs/accountancy/supplier/index.php +++ b/htdocs/accountancy/supplier/index.php @@ -4,7 +4,7 @@ * Copyright (C) 2013-2022 Alexandre Spangaro * Copyright (C) 2014 Juanjo Menent * Copyright (C) 2024 Frédéric France - * Copyright (C) 2025 MDW + * Copyright (C) 2025-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -155,10 +155,10 @@ if ($action == 'validatehistory' && $user->hasRight('accounting', 'bind', 'write } $alias_societe_perentity = !getDolGlobalString('MAIN_COMPANY_PERENTITY_SHARED') ? "s" : "spe"; $alias_product_perentity = !getDolGlobalString('MAIN_PRODUCT_PERENTITY_SHARED') ? "p" : "ppe"; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa ON " . $alias_product_perentity . ".accountancy_code_buy = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".$conf->entity; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa2 ON " . $alias_product_perentity . ".accountancy_code_buy_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".$conf->entity; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa3 ON " . $alias_product_perentity . ".accountancy_code_buy_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".$conf->entity; - $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa4 ON " . $alias_product_perentity . ".accountancy_code_buy = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".$conf->entity; + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa ON " . $alias_product_perentity . ".accountancy_code_buy = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".((int) $conf->entity); + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa2 ON " . $alias_product_perentity . ".accountancy_code_buy_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".((int) $conf->entity); + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa3 ON " . $alias_product_perentity . ".accountancy_code_buy_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".((int) $conf->entity); + $sql .= " LEFT JOIN ".$db->prefix()."accounting_account as aa4 ON " . $alias_product_perentity . ".accountancy_code_buy = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".((int) $conf->entity); $sql .= " WHERE f.fk_statut > 0 AND l.fk_code_ventilation <= 0"; $sql .= " AND l.product_type <= 2"; $sql .= " AND f.entity IN (".getEntity('facture_fourn', 0).")"; // We don't share object for accountancy @@ -208,9 +208,9 @@ if ($action == 'validatehistory' && $user->hasRight('accounting', 'bind', 'write $product_static->label = $objp->product_label; $product_static->status = !empty($objp->status) ? $objp->status : 0; $product_static->status_buy = !empty($objp->status_buy) ? $objp->status_buy : 0; - $product_static->accountancy_code_sell = !empty($objp->code_sell)? $objp->code_sell : ""; - $product_static->accountancy_code_sell_intra = !empty($objp->code_sell_intra)? $objp->code_sell_intra : ""; - $product_static->accountancy_code_sell_export = !empty($objp->code_sell_export)? $objp->code_sell_export : ""; + $product_static->accountancy_code_sell = !empty($objp->code_sell) ? $objp->code_sell : ""; + $product_static->accountancy_code_sell_intra = !empty($objp->code_sell_intra) ? $objp->code_sell_intra : ""; + $product_static->accountancy_code_sell_export = !empty($objp->code_sell_export) ? $objp->code_sell_export : ""; $product_static->accountancy_code_buy = !empty($objp->code_buy) ? $objp->code_buy : ""; $product_static->accountancy_code_buy_intra = !empty($objp->code_buy_intra) ? $objp->code_buy_intra : ""; $product_static->accountancy_code_buy_export = !empty($objp->code_buy_export) ? $objp->code_buy_export : ""; @@ -342,7 +342,7 @@ for ($i = 1; $i <= 12; $i++) { $param .= '&search_date_endday='.$tmp['mday'].'&search_date_endmonth='.$tmp['mon'].'&search_date_endyear='.$tmp['year']; print ''; } - print $langs->trans('MonthShort'.str_pad((string) $j, 2, '0', STR_PAD_LEFT)); + print $langs->trans('MonthShort'.str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT)); if (!empty($tmp['mday'])) { print ''; } @@ -357,8 +357,8 @@ for ($i = 1; $i <= 12; $i++) { if ($j > 12) { $j -= 12; } - $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((int) $j), "ffd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; - $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((string) $j), "1", "0").") AS nbmonth".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((int) $j), "ffd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((int) $j), "1", "0").") AS nbmonth".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; } $sql .= " SUM(ffd.total_ht) as total, COUNT(ffd.rowid) as nb"; $sql .= " FROM ".$db->prefix()."facture_fourn_det as ffd"; @@ -474,7 +474,7 @@ for ($i = 1; $i <= 12; $i++) { $param .= '&search_date_endday='.$tmp['mday'].'&search_date_endmonth='.$tmp['mon'].'&search_date_endyear='.$tmp['year']; print ''; } - print $langs->trans('MonthShort'.str_pad((string) $j, 2, '0', STR_PAD_LEFT)); + print $langs->trans('MonthShort'.str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT)); if (!empty($tmp['mday'])) { print ''; } @@ -489,7 +489,7 @@ for ($i = 1; $i <= 12; $i++) { if ($j > 12) { $j -= 12; } - $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((int) $j), "ffd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((int) $j), "ffd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; } $sql .= " SUM(ffd.total_ht) as total"; $sql .= " FROM ".$db->prefix()."facture_fourn_det as ffd"; @@ -573,7 +573,7 @@ if (getDolGlobalString('SHOW_TOTAL_OF_PREVIOUS_LISTS_IN_LIN_PAGE')) { // This pa if ($j > 12) { $j -= 12; } - print ''.$langs->trans('MonthShort'.str_pad((string) $j, 2, '0', STR_PAD_LEFT)).''; + print ''.$langs->trans('MonthShort'.str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT)).''; } print ''.$langs->trans("Total").''; @@ -583,7 +583,7 @@ if (getDolGlobalString('SHOW_TOTAL_OF_PREVIOUS_LISTS_IN_LIN_PAGE')) { // This pa if ($j > 12) { $j -= 12; } - $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((int) $j), "ffd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).","; + $sql .= " SUM(".$db->ifsql("MONTH(ff.datef) = ".((int) $j), "ffd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).","; } $sql .= " SUM(ffd.total_ht) as total"; $sql .= " FROM ".$db->prefix()."facture_fourn_det as ffd"; diff --git a/htdocs/comm/mailing/class/advtargetemailing.class.php b/htdocs/comm/mailing/class/advtargetemailing.class.php index 2e7f7ed560c..954c9a3740a 100644 --- a/htdocs/comm/mailing/class/advtargetemailing.class.php +++ b/htdocs/comm/mailing/class/advtargetemailing.class.php @@ -2,7 +2,7 @@ /* Advance Targeting Emailing for mass emailing module * Copyright (C) 2013 Florian Henry * Copyright (C) 2024 Frédéric France - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -430,7 +430,7 @@ class AdvanceTargetingMailing extends CommonObject $sql .= " name=".(isset($this->name) ? "'".$this->db->escape($this->name)."'" : "''").","; $sql .= " entity=".((int) $conf->entity).","; - $sql .= " fk_element=".(isset($this->fk_element) ? $this->fk_element : "null").","; + $sql .= " fk_element=".(isset($this->fk_element) ? ((int) $this->fk_element) : "null").","; $sql .= " type_element=".(isset($this->type_element) ? "'".$this->db->escape($this->type_element)."'" : "null").","; $sql .= " filtervalue=".(isset($this->filtervalue) ? "'".$this->db->escape($this->filtervalue)."'" : "null").","; $sql .= " fk_user_mod=".((int) $user->id); @@ -573,8 +573,8 @@ class AdvanceTargetingMailing extends CommonObject $sqlwhere[] = $this->transformToSQL('t.town', $arrayquery['cust_city']); } if (!empty($arrayquery['cust_mothercompany'])) { - $str = $this->transformToSQL('nom', $arrayquery['cust_mothercompany']); - $sqlwhere[] = " (t.parent IN (SELECT rowid FROM ".MAIN_DB_PREFIX."societe WHERE (".$str.")))"; + $sqlStr = $this->transformToSQL('nom', $arrayquery['cust_mothercompany']); + $sqlwhere[] = " (t.parent IN (SELECT rowid FROM ".MAIN_DB_PREFIX."societe WHERE (".$sqlStr.")))"; } if (!empty($arrayquery['cust_status']) && count($arrayquery['cust_status']) > 0) { $sqlwhere[] = " (t.status IN (".$this->db->sanitize(implode(',', $arrayquery['cust_status']))."))"; @@ -646,7 +646,7 @@ class AdvanceTargetingMailing extends CommonObject if (count($arrayquery['options_'.$key])) { $i2 = 0; $field = "te.".$key; - $sqlwhereselllist=""; + $sqlwhereselllist = ""; foreach ($arrayquery['options_'.$key] as $data) { $data = trim($data); if ($data) { @@ -751,13 +751,13 @@ class AdvanceTargetingMailing extends CommonObject $sqlwhere[] = " (t.civility IN (".$this->db->sanitize("'".implode("','", $arrayquery['contact_civility'])."'", 1)."))"; } if ($arrayquery['contact_no_email'] != '') { - $tmpwhere = ''; + $sqlTmpWhere = ''; if (!empty($arrayquery['contact_no_email'])) { - $tmpwhere .= "(t.email IN (SELECT email FROM ".MAIN_DB_PREFIX."mailing_unsubscribe WHERE t.entity IN (".getEntity('mailing').") AND email = '".$this->db->escape($arrayquery['contact_no_email'])."'))"; + $sqlTmpWhere .= "(t.email IN (SELECT email FROM ".MAIN_DB_PREFIX."mailing_unsubscribe WHERE t.entity IN (".getEntity('mailing').") AND email = '".$this->db->escape($arrayquery['contact_no_email'])."'))"; } else { - $tmpwhere .= "(t.email NOT IN (SELECT email FROM ".MAIN_DB_PREFIX."mailing_unsubscribe WHERE t.entity IN (".getEntity('mailing').") AND email = '".$this->db->escape((string) $arrayquery['contact_no_email'])."'))"; + $sqlTmpWhere .= "(t.email NOT IN (SELECT email FROM ".MAIN_DB_PREFIX."mailing_unsubscribe WHERE t.entity IN (".getEntity('mailing').") AND email = '".$this->db->escape((string) $arrayquery['contact_no_email'])."'))"; } - $sqlwhere[] = $tmpwhere; + $sqlwhere[] = $sqlTmpWhere; } if ($arrayquery['contact_update_st_dt'] != '') { $sqlwhere[] = " (t.tms >= '".$this->db->idate($arrayquery['contact_update_st_dt'])."' AND t.tms <= '".$this->db->idate($arrayquery['contact_update_end_dt'])."')"; @@ -807,14 +807,14 @@ class AdvanceTargetingMailing extends CommonObject } } elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'link') { if ($arrayquery['options_'.$key."_cnct"] > 0) { - $sqlwhere[]= " (te.".$key." = ".((int) $arrayquery["options_".$key."_cnct"]).")"; + $sqlwhere[] = " (te.".$key." = ".((int) $arrayquery["options_".$key."_cnct"]).")"; } } elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'chkbxlst' && is_array($arrayquery['options_'.$key.'_cnct'])) { if (count($arrayquery['options_'.$key.'_cnct'])) { $i2 = 0; $field = "te.".$key; - $sqlwhereselllist=""; + $sqlwhereselllist = ""; foreach ($arrayquery['options_'.$key.'_cnct'] as $data) { $data = trim($data); if ($data) { @@ -863,8 +863,8 @@ class AdvanceTargetingMailing extends CommonObject $sqlwhere[] = $this->transformToSQL('ts.town', $arrayquery['cust_city']); } if (!empty($arrayquery['cust_mothercompany'])) { - $str = $this->transformToSQL('nom', $arrayquery['cust_mothercompany']); - $sqlwhere[] = " (ts.parent IN (SELECT rowid FROM ".MAIN_DB_PREFIX."societe WHERE (".$str.")))"; + $sql_str = $this->transformToSQL('nom', $arrayquery['cust_mothercompany']); + $sqlwhere[] = " (ts.parent IN (SELECT rowid FROM ".MAIN_DB_PREFIX."societe WHERE (".$sql_str.")))"; } if (!empty($arrayquery['cust_status']) && count($arrayquery['cust_status']) > 0) { $sqlwhere[] = " (ts.status IN (".$this->db->sanitize(implode(',', $arrayquery['cust_status']))."))"; @@ -936,14 +936,14 @@ class AdvanceTargetingMailing extends CommonObject } } elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'link') { if ($arrayquery['options_'.$key] > 0) { - $sqlwhere[]= " (te.".$key." = ".((int) $arrayquery["options_".$key]).")"; + $sqlwhere[] = " (te.".$key." = ".((int) $arrayquery["options_".$key]).")"; } } elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'chkbxlst' && is_array($arrayquery['options_'.$key])) { if (count($arrayquery['options_'.$key])) { $i2 = 0; $field = "tse.".$key; - $sqlwhereselllist=""; + $sqlwhereselllist = ""; foreach ($arrayquery['options_'.$key] as $data) { $data = trim($data); if ($data) { diff --git a/htdocs/comm/remx.php b/htdocs/comm/remx.php index 987a213001d..48515a90b5c 100644 --- a/htdocs/comm/remx.php +++ b/htdocs/comm/remx.php @@ -1159,18 +1159,18 @@ if ($socid > 0) { $num = $db->num_rows($resql); if ($num > 0) { for ($i = 0; $i < $num; $i++) { - $sqlobj = $db->fetch_object($resql); - $tab_sqlobj[] = $sqlobj; - $tab_sqlobjOrder[] = $db->jdate($sqlobj->dc); + $fetched_obj = $db->fetch_object($resql); + $tab_sqlobj[] = $fetched_obj; + $tab_sqlobjOrder[] = $db->jdate($fetched_obj->dc); } } $db->free($resql); $num = $db->num_rows($resql2); for ($i = 0; $i < $num; $i++) { - $sqlobj = $db->fetch_object($resql2); - $tab_sqlobj[] = $sqlobj; - $tab_sqlobjOrder[] = $db->jdate($sqlobj->dc); + $fetched_obj = $db->fetch_object($resql2); + $tab_sqlobj[] = $fetched_obj; + $tab_sqlobjOrder[] = $db->jdate($fetched_obj->dc); } $db->free($resql2); $array1_sort_order = SORT_DESC; @@ -1329,18 +1329,18 @@ if ($socid > 0) { $num = $db->num_rows($resql); if ($num > 0) { for ($i = 0; $i < $num; $i++) { - $sqlobj = $db->fetch_object($resql); - $tab_sqlobj[] = $sqlobj; - $tab_sqlobjOrder[] = $db->jdate($sqlobj->dc); + $fetched_obj = $db->fetch_object($resql); + $tab_sqlobj[] = $fetched_obj; + $tab_sqlobjOrder[] = $db->jdate($fetched_obj->dc); } } $db->free($resql); $num = $db->num_rows($resql2); for ($i = 0; $i < $num; $i++) { - $sqlobj = $db->fetch_object($resql2); - $tab_sqlobj[] = $sqlobj; - $tab_sqlobjOrder[] = $db->jdate($sqlobj->dc); + $fetched_obj = $db->fetch_object($resql2); + $tab_sqlobj[] = $fetched_obj; + $tab_sqlobjOrder[] = $db->jdate($fetched_obj->dc); } $db->free($resql2); $array1_sort_order = SORT_DESC; diff --git a/htdocs/compta/paiement/cheque/class/remisecheque.class.php b/htdocs/compta/paiement/cheque/class/remisecheque.class.php index d639939ecbd..70d0ea5fdd3 100644 --- a/htdocs/compta/paiement/cheque/class/remisecheque.class.php +++ b/htdocs/compta/paiement/cheque/class/remisecheque.class.php @@ -5,7 +5,7 @@ * Copyright (C) 2011-2016 Juanjo Menent * Copyright (C) 2015 Marcos García * Copyright (C) 2024-2026 Frédéric France - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -128,7 +128,7 @@ class RemiseCheque extends CommonObject $sql .= " ba.label as account_label"; $sql .= " FROM ".MAIN_DB_PREFIX."bordereau_cheque as bc"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_account as ba ON bc.fk_bank_account = ba.rowid"; - $sql .= " WHERE bc.entity = ".$conf->entity; + $sql .= " WHERE bc.entity = ".((int) $conf->entity); if ($id) { $sql .= " AND bc.rowid = ".((int) $id); } @@ -230,7 +230,7 @@ class RemiseCheque extends CommonObject if ($this->id > 0 && $this->errno == 0) { $sql = "UPDATE ".MAIN_DB_PREFIX."bordereau_cheque"; - $sql .= " SET ref = '(PROV".$this->id.")'"; + $sql .= " SET ref = '(PROV".((int) $this->id).")'"; $sql .= " WHERE rowid=".((int) $this->id); $resql = $this->db->query($sql); @@ -333,7 +333,7 @@ class RemiseCheque extends CommonObject $sql = "DELETE FROM ".MAIN_DB_PREFIX."bordereau_cheque"; $sql .= " WHERE rowid = ".((int) $this->id); - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if ($resql) { @@ -633,7 +633,7 @@ class RemiseCheque extends CommonObject $sql .= " WHERE b.fk_account = ba.rowid"; $sql .= " AND b.fk_bordereau = bc.rowid"; $sql .= " AND bc.rowid = ".((int) $this->id); - $sql .= " AND bc.entity = ".$conf->entity; + $sql .= " AND bc.entity = ".((int) $conf->entity); $sql .= " ORDER BY b.dateo ASC, b.rowid ASC"; dol_syslog("RemiseCheque::generatePdf", LOG_DEBUG); diff --git a/htdocs/compta/resultat/index.php b/htdocs/compta/resultat/index.php index f45d29f28cd..b24d6baf7f2 100644 --- a/htdocs/compta/resultat/index.php +++ b/htdocs/compta/resultat/index.php @@ -936,8 +936,8 @@ if (isModEnabled('accounting') && ($modecompta == 'BOOKKEEPING')) { $sql = "SELECT b.doc_ref, b.numero_compte, b.subledger_account, b.subledger_label, aa.pcg_type, date_format(b.doc_date,'%Y-%m') as dm, sum(b.debit) as debit, sum(b.credit) as credit, sum(b.montant) as amount"; $sql .= " FROM ".MAIN_DB_PREFIX."accounting_bookkeeping as b, ".MAIN_DB_PREFIX."accounting_account as aa"; - $sql .= " WHERE b.entity = ".$conf->entity; - $sql .= " AND aa.entity = ".$conf->entity; + $sql .= " WHERE b.entity = ".((int) $conf->entity); + $sql .= " AND aa.entity = ".((int) $conf->entity); $sql .= " AND b.numero_compte = aa.account_number"; $sql .= " AND ".$sanitizedpredefinedgroupwhere; $sql .= " AND fk_pcg_version = '".$db->escape($charofaccountstring)."'"; diff --git a/htdocs/compta/stats/index.php b/htdocs/compta/stats/index.php index 1197cf9646f..1ca065bdd7b 100644 --- a/htdocs/compta/stats/index.php +++ b/htdocs/compta/stats/index.php @@ -236,9 +236,9 @@ if (isModEnabled('accounting')) { $sql = "SELECT b.rowid "; $sql .= " FROM ".MAIN_DB_PREFIX."accounting_bookkeeping as b,"; $sql .= " ".MAIN_DB_PREFIX."accounting_account as aa"; - $sql .= " WHERE b.entity = ".$conf->entity; // In module double party accounting, we never share entities + $sql .= " WHERE b.entity = ".((int) $conf->entity); // In module double party accounting, we never share entities $sql .= " AND b.numero_compte = aa.account_number"; - $sql .= " AND aa.entity = ".$conf->entity; + $sql .= " AND aa.entity = ".((int) $conf->entity); $sql .= " AND aa.fk_pcg_version = '".$db->escape($pcgvercode)."'"; $sql .= $db->plimit(1); @@ -290,10 +290,10 @@ if ($modecompta == 'CREANCES-DETTES') { $sql = "SELECT date_format(b.doc_date, '%Y-%m') as dm, sum(b.credit - b.debit) as amount_ttc"; $sql .= " FROM ".MAIN_DB_PREFIX."accounting_bookkeeping as b,"; $sql .= " ".MAIN_DB_PREFIX."accounting_account as aa"; - $sql .= " WHERE b.entity = ".$conf->entity; // In module double party accounting, we never share entities + $sql .= " WHERE b.entity = ".((int) $conf->entity); // In module double party accounting, we never share entities $sql .= " AND b.numero_compte = aa.account_number"; $sql .= " AND b.doc_type = 'customer_invoice'"; - $sql .= " AND aa.entity = ".$conf->entity; + $sql .= " AND aa.entity = ".((int) $conf->entity); $sql .= " AND aa.fk_pcg_version = '".$db->escape($pcgvercode)."'"; $sql .= " AND aa.pcg_type = 'INCOME'"; // TODO Be able to use a custom group } diff --git a/htdocs/compta/tva/class/tva.class.php b/htdocs/compta/tva/class/tva.class.php index aae7f71f06f..e81795533a1 100644 --- a/htdocs/compta/tva/class/tva.class.php +++ b/htdocs/compta/tva/class/tva.class.php @@ -264,7 +264,7 @@ class Tva extends CommonObject $sql .= " label='".$this->db->escape($this->label)."',"; $sql .= " note='".$this->db->escape($this->note)."',"; $sql .= " fk_user_creat=".((int) $this->fk_user_creat).","; - $sql .= " fk_user_modif=".((int) ($this->fk_user_modif > 0 ? $this->fk_user_modif : $user->id)); + $sql .= " fk_user_modif=".((int) ($this->fk_user_modif > 0 ? ((int) $this->fk_user_modif) : ((int) $user->id))); $sql .= " WHERE rowid=".((int) $this->id); dol_syslog(get_class($this)."::update", LOG_DEBUG); diff --git a/htdocs/core/actions_extrafields.inc.php b/htdocs/core/actions_extrafields.inc.php index 5c660999c43..0c78d82d6b7 100644 --- a/htdocs/core/actions_extrafields.inc.php +++ b/htdocs/core/actions_extrafields.inc.php @@ -1,7 +1,7 @@ * Copyright (C) 2024 Frédéric France - * Copyright (C) 2025 MDW + * Copyright (C) 2025-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -521,7 +521,7 @@ if ($action == 'encrypt') { $newpassword = dolEncrypt($pass); $sqlupdate = "UPDATE ".MAIN_DB_PREFIX.$db->sanitize($arrayofelement['table_element']).'_extrafields'; - $sqlupdate .= " SET ".$attributekey." = '".$db->escape($newpassword)."'"; + $sqlupdate .= " SET ".$db->sanitize($attributekey)." = '".$db->escape($newpassword)."'"; $sqlupdate .= " WHERE rowid = ".((int) $id); $resupdate = $db->query($sqlupdate); diff --git a/htdocs/core/lib/invoice.lib.php b/htdocs/core/lib/invoice.lib.php index 06fe1196383..db908458aba 100644 --- a/htdocs/core/lib/invoice.lib.php +++ b/htdocs/core/lib/invoice.lib.php @@ -1303,7 +1303,7 @@ function getPurchaseInvoiceUnpaidOpenTable($maxCount = 500, $socid = 0) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc"; } $sql .= " WHERE s.rowid = ff.fk_soc"; - $sql .= " AND ff.entity = ".$conf->entity; + $sql .= " AND ff.entity = ".((int) $conf->entity); $sql .= " AND ff.paye = 0"; $sql .= " AND ff.fk_statut = ".FactureFournisseur::STATUS_VALIDATED; if (empty($user->socid) && !$user->hasRight('societe', 'client', 'voir')) { diff --git a/htdocs/core/modules/modAgenda.class.php b/htdocs/core/modules/modAgenda.class.php index 2299028922f..121abdec703 100644 --- a/htdocs/core/modules/modAgenda.class.php +++ b/htdocs/core/modules/modAgenda.class.php @@ -498,10 +498,10 @@ class modAgenda extends DolibarrModules $this->export_sql_end[$r] .= " LEFT JOIN ".MAIN_DB_PREFIX."projet as p ON p.rowid = ac.fk_project"; $this->export_sql_end[$r] .= ' WHERE ac.entity IN ('.getEntity('agenda').')'; if (!empty($user) && !$user->hasRight('societe', 'client', 'voir')) { - $this->export_sql_end[$r] .= ' AND (sc.fk_user = '.(empty($user) ? 0 : $user->id).' OR ac.fk_soc IS NULL)'; + $this->export_sql_end[$r] .= ' AND (sc.fk_user = '.(empty($user) ? 0 : ((int) $user->id)).' OR ac.fk_soc IS NULL)'; } if (!empty($user) && !$user->hasRight('agenda', 'allactions', 'read')) { - $this->export_sql_end[$r] .= ' AND acr.fk_element = '.(empty($user) ? 0 : $user->id); + $this->export_sql_end[$r] .= ' AND acr.fk_element = '.(empty($user) ? 0 : ((int) $user->id)); } $this->export_sql_end[$r] .= ' AND ac.entity IN ('.getEntity('agenda').')'; $this->export_sql_order[$r] = ' ORDER BY ac.datep'; @@ -541,7 +541,7 @@ class modAgenda extends DolibarrModules // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'actioncomm' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'actioncomm' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { diff --git a/htdocs/core/modules/modSociete.class.php b/htdocs/core/modules/modSociete.class.php index f7c76f59d2a..ba1d86d0ecb 100644 --- a/htdocs/core/modules/modSociete.class.php +++ b/htdocs/core/modules/modSociete.class.php @@ -6,7 +6,7 @@ * Copyright (C) 2005-2013 Regis Houssin * Copyright (C) 2012-2014 Juanjo Menent * Copyright (C) 2022 Ferran Marcet - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024-2026 Frédéric France * Copyright (C) 2026 Alexandre Spangaro * @@ -618,7 +618,7 @@ class modSociete extends DolibarrModules } } // Add extra fields - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'societe' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'societe' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on old database (during migration for example) while ($obj = $this->db->fetch_object($resql)) { @@ -859,7 +859,7 @@ class modSociete extends DolibarrModules } } // Add extra fields - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'socpeople' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'socpeople' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on an old database (during a migration for example) while ($obj = $this->db->fetch_object($resql)) { diff --git a/htdocs/core/tpl/extrafields_list_search_sql.tpl.php b/htdocs/core/tpl/extrafields_list_search_sql.tpl.php index 095886ff424..7b05df462d1 100644 --- a/htdocs/core/tpl/extrafields_list_search_sql.tpl.php +++ b/htdocs/core/tpl/extrafields_list_search_sql.tpl.php @@ -1,6 +1,7 @@ * Copyright (C) 2025 Laurent Destailleur + * Copyright (C) 2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -53,7 +54,7 @@ if (!empty($extrafieldsobjectkey) && !empty($search_array_options) && is_array($ $search_options_pattern = 'search_options_'; } - $morewhere = ''; + $sqlMoreWhere = ''; foreach ($search_array_options as $key => $val) { $crit = $val; @@ -66,23 +67,23 @@ if (!empty($extrafieldsobjectkey) && !empty($search_array_options) && is_array($ include_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; $crit = dol_get_first_hour($crit); } - $morewhere .= " AND ".$extrafieldsobjectprefix.$tmpkey." = '".$db->idate($crit)."'"; + $sqlMoreWhere .= " AND ".$db->sanitize($extrafieldsobjectprefix.$tmpkey)." = '".$db->idate($crit)."'"; } elseif (is_array($crit)) { if (!is_null($crit['start']) && $crit['start'] !== '' && !is_null($crit['end']) && $crit['end'] !== '') { - $morewhere .= " AND (".$extrafieldsobjectprefix.$tmpkey." BETWEEN '". $db->idate($crit['start']). "' AND '".$db->idate($crit['end']) . "')"; + $sqlMoreWhere .= " AND (".$db->sanitize($extrafieldsobjectprefix.$tmpkey)." BETWEEN '". $db->idate($crit['start']). "' AND '".$db->idate($crit['end']) . "')"; } elseif (!is_null($crit['start']) && $crit['start'] !== '') { - $morewhere .= " AND (".$extrafieldsobjectprefix.$tmpkey." >= '". $db->idate($crit['start'])."')"; + $sqlMoreWhere .= " AND (".$db->sanitize($extrafieldsobjectprefix.$tmpkey)." >= '". $db->idate($crit['start'])."')"; } elseif (!is_null($crit['end']) && $crit['end'] !== '') { - $morewhere .= " AND (".$extrafieldsobjectprefix.$tmpkey." <= '". $db->idate($crit['end'])."')"; + $sqlMoreWhere .= " AND (".$db->sanitize($extrafieldsobjectprefix.$tmpkey)." <= '". $db->idate($crit['end'])."')"; } } } elseif (in_array($typ, array('boolean'))) { if ($crit !== '-1' && $crit !== '') { - $morewhere .= " AND (".$extrafieldsobjectprefix.$tmpkey." = '".$db->escape($crit)."'"; + $sqlMoreWhere .= " AND (".$db->sanitize($extrafieldsobjectprefix.$tmpkey)." = '".$db->escape($crit)."'"; if ($crit == '0') { - $morewhere .= " OR ".$extrafieldsobjectprefix.$tmpkey." IS NULL"; + $sqlMoreWhere .= " OR ".$db->sanitize($extrafieldsobjectprefix.$tmpkey)." IS NULL"; } - $morewhere .= ")"; + $sqlMoreWhere .= ")"; } } elseif ($crit != '' && (!in_array($typ, array('select', 'sellist', 'select', 'link')) || $crit != '0') @@ -104,12 +105,12 @@ if (!empty($extrafieldsobjectkey) && !empty($search_array_options) && is_array($ $crit = implode(' ', $crit); // natural_search() expects a string } elseif ($typ === 'select' and is_string($crit) and strpos($crit, ',') === false) { $sanitizedCritSelect = "'".implode("','", array_map(array($db, 'escape'), explode(',', $crit)))."'"; - $morewhere .= " AND (".$extrafieldsobjectprefix.$tmpkey." IN (".$sanitizedCritSelect.") )"; + $sqlMoreWhere .= " AND (".$db->sanitize($extrafieldsobjectprefix.$tmpkey)." IN (".$sanitizedCritSelect.") )"; continue; } - $morewhere .= natural_search($extrafieldsobjectprefix.$tmpkey, $crit, $mode_search); + $sqlMoreWhere .= natural_search($db->sanitize($extrafieldsobjectprefix.$tmpkey), $crit, $mode_search); } } - $sql .= $morewhere; + $sql .= $sqlMoreWhere; } diff --git a/htdocs/core/tpl/list_print_total.tpl.php b/htdocs/core/tpl/list_print_total.tpl.php index fa3821d00df..8674f3c0f04 100644 --- a/htdocs/core/tpl/list_print_total.tpl.php +++ b/htdocs/core/tpl/list_print_total.tpl.php @@ -126,15 +126,15 @@ if (isset($totalarray['pos'])) { if (getDolGlobalString('MAIN_GRANDTOTAL_LIST_SHOW') && (!(is_null($limit) || $num < $limit))) { if (isset($totalarray['pos']) && is_array($totalarray['pos']) && count($totalarray['pos']) > 0) { $sumsarray = false; - $tbsumfields = []; + $sanitized_tbsumfields = []; foreach ($totalarray['pos'] as $field) { - $fieldforsum = preg_replace('/[^a-z0-9]/', '', $field); - $tbsumfields[] = "sum($field) as $fieldforsum"; + $sanitized_fieldforsum = preg_replace('/[^a-z0-9]/', '', $field); + $sanitized_tbsumfields[] = "sum($field) as $sanitized_fieldforsum"; } if (isset($sqlfields)) { // In project, commande list, this var is defined - $sqlforgrandtotal = preg_replace('/^'.preg_quote($sqlfields, '/').'/', 'SELECT '. implode(",", $tbsumfields), $sql); + $sqlforgrandtotal = preg_replace('/^'.preg_quote($sqlfields, '/').'/', 'SELECT '. implode(",", $sanitized_tbsumfields), $sql); } else { - $sqlforgrandtotal = preg_replace('/^SELECT[a-zA-Z0-9\._\s\(\),=<>\:\-\']+\sFROM/', 'SELECT '. implode(",", $tbsumfields). ' FROM ', $sql); + $sqlforgrandtotal = preg_replace('/^SELECT[a-zA-Z0-9\._\s\(\),=<>\:\-\']+\sFROM/', 'SELECT '. implode(",", $sanitized_tbsumfields). ' FROM ', $sql); } $sqlforgrandtotal = preg_replace('/GROUP BY .*$/', '', $sqlforgrandtotal). ''; $resql = $db->query($sqlforgrandtotal); diff --git a/htdocs/eventorganization/class/conferenceorboothattendee.class.php b/htdocs/eventorganization/class/conferenceorboothattendee.class.php index 49c80af2030..486ab4ed32c 100644 --- a/htdocs/eventorganization/class/conferenceorboothattendee.class.php +++ b/htdocs/eventorganization/class/conferenceorboothattendee.class.php @@ -639,14 +639,14 @@ class ConferenceOrBoothAttendee extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'conferenceorboothattendee/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'conferenceorboothattendee/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'conferenceorboothattendee/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'conferenceorboothattendee/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'conferenceorboothattendee/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'conferenceorboothattendee/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/fichinter/class/fichinterrec.class.php b/htdocs/fichinter/class/fichinterrec.class.php index a66556bba76..0979a0e16fb 100644 --- a/htdocs/fichinter/class/fichinterrec.class.php +++ b/htdocs/fichinter/class/fichinterrec.class.php @@ -9,7 +9,7 @@ * Copyright (C) 2016-2018 Charlie Benke * Copyright (C) 2024 William Mead * Copyright (C) 2024-2026 Frédéric France - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -570,16 +570,16 @@ class FichinterRec extends Fichinter $sql .= ", ".((int) $duration); //$sql.= ", ".(!empty($qty)? $qty :(!empty($duration)? $duration :"null")); //$sql.= ", ".price2num($txtva); - $sql .= ", ".(!empty($fk_product) ? $fk_product : "null"); + $sql .= ", ".(!empty($fk_product) ? ((int) $fk_product) : "null"); $sql .= ", ".((int) $product_type); - $sql .= ", ".(!empty($remise_percent) ? $remise_percent : "null"); + $sql .= ", ".(!empty($remise_percent) ? ((float) $remise_percent) : "null"); $sql .= ", '".price2num($pu_ht)."'"; $sql .= ", '".price2num($total_ht)."'"; $sql .= ", '".price2num($total_tva)."'"; $sql .= ", '".price2num($total_ttc)."'"; $sql .= ", ".(int) $rang; //$sql.= ", ".$special_code; - $sql .= ", ".(!empty($fk_unit) ? $fk_unit : "null"); + $sql .= ", ".(!empty($fk_unit) ? ((int) $fk_unit) : "null"); $sql .= ")"; dol_syslog(get_class($this)."::addLineRec", LOG_DEBUG); diff --git a/htdocs/fourn/class/fournisseur.facture.ligne.class.php b/htdocs/fourn/class/fournisseur.facture.ligne.class.php index e2fdaa94edc..20b164cd392 100644 --- a/htdocs/fourn/class/fournisseur.facture.ligne.class.php +++ b/htdocs/fourn/class/fournisseur.facture.ligne.class.php @@ -700,7 +700,7 @@ class SupplierInvoiceLine extends CommonObjectLine $sql .= ' info_bits, total_ht, tva, total_ttc, total_localtax1, total_localtax2, fk_unit'; $sql .= ', fk_multicurrency, multicurrency_code, multicurrency_subprice, multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc'; $sql .= ')'; - $sql .= " VALUES (".$this->fk_facture_fourn.","; + $sql .= " VALUES (".((int) $this->fk_facture_fourn).","; $sql .= " ".($this->fk_parent_line > 0 ? "'".$this->db->escape((string) $this->fk_parent_line)."'" : "null").","; $product_label = !empty($this->product_label) @@ -717,7 +717,7 @@ class SupplierInvoiceLine extends CommonObjectLine $sql .= " ".price2num($this->localtax2_tx).","; $sql .= " '".$this->db->escape((string) $this->localtax1_type)."',"; $sql .= " '".$this->db->escape((string) $this->localtax2_type)."',"; - $sql .= ' '.((!empty($this->fk_product) && $this->fk_product > 0) ? $this->fk_product : "null").','; + $sql .= ' '.((!empty($this->fk_product) && $this->fk_product > 0) ? ((int) $this->fk_product) : "null").','; $sql .= " ".((int) $this->product_type).","; $sql .= " ".price2num($this->remise_percent).","; $sql .= ' '.(!empty($this->fk_remise_except) ? ((int) $this->fk_remise_except) : "null").','; @@ -725,7 +725,7 @@ class SupplierInvoiceLine extends CommonObjectLine $sql .= " ".(!empty($this->qty) ? price2num($this->total_ttc / $this->qty) : price2num($this->total_ttc)).","; $sql .= " ".(!empty($this->date_start) ? "'".$this->db->idate($this->date_start)."'" : "null").","; $sql .= " ".(!empty($this->date_end) ? "'".$this->db->idate($this->date_end)."'" : "null").","; - $sql .= ' '.(!empty($this->fk_code_ventilation) ? $this->fk_code_ventilation : 0).','; + $sql .= ' '.(!empty($this->fk_code_ventilation) ? ((int) $this->fk_code_ventilation) : 0).','; $sql .= ' '.((int) $this->rang).','; $sql .= ' '.((int) $this->special_code).','; $sql .= " ".((int) $this->info_bits).","; diff --git a/htdocs/install/step2.php b/htdocs/install/step2.php index 383cec1df67..d751ba9f639 100644 --- a/htdocs/install/step2.php +++ b/htdocs/install/step2.php @@ -353,7 +353,7 @@ if ($action == "set") { // Test on permission not required. Already managed by fclose($fp); // If several requests, we loop on each - $listesql = explode(';', $buffer); + $listesql = explode(';', $buffer); // @phan-suppress-current-line SqlInjection foreach ($listesql as $req) { $buffer = trim($req); if ($buffer) { @@ -441,7 +441,7 @@ if ($action == "set") { // Test on permission not required. Already managed by //$buffer=preg_replace('/;\';/',";'§",$buffer); // If several requests, we loop on each of them - $listesql = explode('§', $buffer); + $listesql = explode('§', $buffer); // @phan-suppress-current-line SqlInjection foreach ($listesql as $buffer) { $buffer = trim($buffer); if ($buffer) { diff --git a/htdocs/knowledgemanagement/class/knowledgerecord.class.php b/htdocs/knowledgemanagement/class/knowledgerecord.class.php index 83c2dbd47a9..65e7551317c 100644 --- a/htdocs/knowledgemanagement/class/knowledgerecord.class.php +++ b/htdocs/knowledgemanagement/class/knowledgerecord.class.php @@ -645,14 +645,14 @@ class KnowledgeRecord extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'knowledgerecord/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'knowledgerecord/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'knowledgerecord/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'knowledgerecord/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'knowledgerecord/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'knowledgerecord/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/loan/class/loanschedule.class.php b/htdocs/loan/class/loanschedule.class.php index c66f243cb63..5ff930a65b5 100644 --- a/htdocs/loan/class/loanschedule.class.php +++ b/htdocs/loan/class/loanschedule.class.php @@ -1,7 +1,7 @@ * Copyright (C) 2018-2025 Frédéric France - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -209,7 +209,7 @@ class LoanSchedule extends CommonObject if ($totalamount != 0) { $sql = "INSERT INTO ".MAIN_DB_PREFIX.$this->table_element." (fk_loan, datec, datep, amount_capital, amount_insurance, amount_interest,"; $sql .= " fk_typepayment, fk_user_creat, fk_bank)"; - $sql .= " VALUES (".$this->fk_loan.", '".$this->db->idate($now)."',"; + $sql .= " VALUES (".((int) $this->fk_loan).", '".$this->db->idate($now)."',"; $sql .= " '".$this->db->idate($this->datep)."',"; $sql .= " ".price2num($this->amount_capital).","; $sql .= " ".price2num($this->amount_insurance).","; @@ -357,14 +357,14 @@ class LoanSchedule extends CommonObject // Update request $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET"; - $sql .= " fk_loan=".(isset($this->fk_loan) ? $this->fk_loan : "null").","; + $sql .= " fk_loan=".(isset($this->fk_loan) ? ((int) $this->fk_loan) : "null").","; $sql .= " datec=".(dol_strlen($this->datec) != 0 ? "'".$this->db->idate($this->datec)."'" : 'null').","; $sql .= " tms=".(dol_strlen((string) $this->tms) != 0 ? "'".$this->db->idate($this->tms)."'" : 'null').","; $sql .= " datep=".(dol_strlen($this->datep) != 0 ? "'".$this->db->idate($this->datep)."'" : 'null').","; - $sql .= " amount_capital=".(isset($this->amount_capital) ? $this->amount_capital : "null").","; - $sql .= " amount_insurance=".(isset($this->amount_insurance) ? $this->amount_insurance : "null").","; - $sql .= " amount_interest=".(isset($this->amount_interest) ? $this->amount_interest : "null").","; - $sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? $this->fk_typepayment : "null").","; + $sql .= " amount_capital=".(isset($this->amount_capital) ? ((float) $this->amount_capital) : "null").","; + $sql .= " amount_insurance=".(isset($this->amount_insurance) ? ((float) $this->amount_insurance) : "null").","; + $sql .= " amount_interest=".(isset($this->amount_interest) ? ((float) $this->amount_interest) : "null").","; + $sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? ((int) $this->fk_typepayment) : "null").","; $sql .= " num_payment=".(isset($this->num_payment) ? "'".$this->db->escape($this->num_payment)."'" : "null").","; $sql .= " note_private=".(isset($this->note_private) ? "'".$this->db->escape($this->note_private)."'" : "null").","; $sql .= " note_public=".(isset($this->note_public) ? "'".$this->db->escape($this->note_public)."'" : "null").","; diff --git a/htdocs/loan/class/paymentloan.class.php b/htdocs/loan/class/paymentloan.class.php index c9f03a8e47e..9a41ad38c35 100644 --- a/htdocs/loan/class/paymentloan.class.php +++ b/htdocs/loan/class/paymentloan.class.php @@ -2,7 +2,7 @@ /* Copyright (C) 2014-2025 Alexandre Spangaro * Copyright (C) 2015-2024 Frédéric France * Copyright (C) 2020 Maxime DEMAREST - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -222,12 +222,12 @@ class PaymentLoan extends CommonObject if ($totalamount != 0) { $sql = "INSERT INTO ".MAIN_DB_PREFIX."payment_loan (fk_loan, datec, datep, amount_capital, amount_insurance, amount_interest,"; $sql .= " fk_typepayment, num_payment, note_private, note_public, fk_user_creat, fk_bank)"; - $sql .= " VALUES (".$this->chid.", '".$this->db->idate($now)."',"; + $sql .= " VALUES (".((int) $this->chid).", '".$this->db->idate($now)."',"; $sql .= " '".$this->db->idate($this->datep)."',"; $sql .= " ".price2num($this->amount_capital).","; $sql .= " ".price2num($this->amount_insurance).","; $sql .= " ".price2num($this->amount_interest).","; - $sql .= " ".((int) $this->paymenttype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note_private)."', '".$this->db->escape($this->note_public)."', ".$user->id.","; + $sql .= " ".((int) $this->paymenttype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note_private)."', '".$this->db->escape($this->note_public)."', ".((int) $user->id).","; $sql .= " 0)"; dol_syslog(get_class($this)."::create", LOG_DEBUG); @@ -372,14 +372,14 @@ class PaymentLoan extends CommonObject // Update request $sql = "UPDATE ".MAIN_DB_PREFIX."payment_loan SET"; - $sql .= " fk_loan=".(isset($this->fk_loan) ? $this->fk_loan : "null").","; + $sql .= " fk_loan=".(isset($this->fk_loan) ? ((int) $this->fk_loan) : "null").","; $sql .= " datec=".(dol_strlen($this->datec) != 0 ? "'".$this->db->idate($this->datec)."'" : 'null').","; $sql .= " tms=".(dol_strlen((string) $this->tms) != 0 ? "'".$this->db->idate($this->tms)."'" : 'null').","; $sql .= " datep=".(dol_strlen($this->datep) != 0 ? "'".$this->db->idate($this->datep)."'" : 'null').","; - $sql .= " amount_capital=".(isset($this->amount_capital) ? $this->amount_capital : "null").","; - $sql .= " amount_insurance=".(isset($this->amount_insurance) ? $this->amount_insurance : "null").","; - $sql .= " amount_interest=".(isset($this->amount_interest) ? $this->amount_interest : "null").","; - $sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? $this->fk_typepayment : "null").","; + $sql .= " amount_capital=".(isset($this->amount_capital) ? ((float) $this->amount_capital) : "null").","; + $sql .= " amount_insurance=".(isset($this->amount_insurance) ? ((float) $this->amount_insurance) : "null").","; + $sql .= " amount_interest=".(isset($this->amount_interest) ? ((float) $this->amount_interest) : "null").","; + $sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? ((int) $this->fk_typepayment) : "null").","; $sql .= " num_payment=".(isset($this->num_payment) ? "'".$this->db->escape($this->num_payment)."'" : "null").","; $sql .= " note_private=".(isset($this->note_private) ? "'".$this->db->escape($this->note_private)."'" : "null").","; $sql .= " note_public=".(isset($this->note_public) ? "'".$this->db->escape($this->note_public)."'" : "null").","; diff --git a/htdocs/loan/list.php b/htdocs/loan/list.php index 5871bab5b6c..5f190594934 100644 --- a/htdocs/loan/list.php +++ b/htdocs/loan/list.php @@ -3,6 +3,7 @@ * Copyright (C) 2015-2026 Frédéric France * Copyright (C) 2015 Juanjo Menent * Copyright (C) 2016 Laurent Destailleur + * Copyright (C) 2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -90,11 +91,11 @@ foreach ($object->fields as $key => $val) { if (!empty($val['visible'])) { $visible = (int) dol_eval((string) $val['visible'], 1); $arrayfields['t.'.$key] = array( - 'label'=>$val['label'], - 'checked'=>(($visible < 0) ? 0 : 1), - 'enabled'=>(abs($visible) != 3 && (bool) dol_eval((string) $val['enabled'], 1)), - 'position'=>$val['position'], - 'help'=> isset($val['help']) ? $val['help'] : '' + 'label' => $val['label'], + 'checked' => (($visible < 0) ? 0 : 1), + 'enabled' => (abs($visible) != 3 && (bool) dol_eval((string) $val['enabled'], 1)), + 'position' => $val['position'], + 'help' => isset($val['help']) ? $val['help'] : '' ); } } @@ -164,10 +165,10 @@ $sql .= " SUM(pl.amount_capital) as alreadypaid"; $sqlfields = $sql; // $sql fields to remove for count total $sql .= " FROM ".MAIN_DB_PREFIX."loan as l"; -$linktopl = " LEFT JOIN ".MAIN_DB_PREFIX."payment_loan AS pl ON l.rowid = pl.fk_loan"; -$sql .= $linktopl; +$sql_linktopl = " LEFT JOIN ".MAIN_DB_PREFIX."payment_loan AS pl ON l.rowid = pl.fk_loan"; +$sql .= $sql_linktopl; -$sql .= " WHERE l.entity = ".$conf->entity; +$sql .= " WHERE l.entity = ".((int) $conf->entity); if ($search_amount) { $sql .= natural_search("l.capital", $search_amount, 1); } @@ -184,7 +185,7 @@ $nbtotalofrecords = ''; if (!getDolGlobalInt('MAIN_DISABLE_FULL_SCANLIST')) { /* The fast and low memory method to get and count full list converts the sql into a sql count */ $sqlforcount = preg_replace('/^'.preg_quote($sqlfields, '/').'/', 'SELECT COUNT(*) as nbtotalofrecords', $sql); - $sqlforcount = preg_replace('/'.preg_quote($linktopl, '/').'/', '', $sqlforcount); + $sqlforcount = preg_replace('/'.preg_quote($sql_linktopl, '/').'/', '', $sqlforcount); $sqlforcount = preg_replace('/GROUP BY .*$/', '', $sqlforcount); $resql = $db->query($sqlforcount); if ($resql) { @@ -278,8 +279,8 @@ if (!empty($socid)) { $url .= '&socid='.$socid; } $newcardbutton = ''; -$newcardbutton .= dolGetButtonTitle($langs->trans('ViewList'), '', 'fa fa-bars imgforviewmode', $_SERVER["PHP_SELF"].'?mode=common'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ((empty($mode) || $mode == 'common') ? 2 : 1), array('morecss'=>'reposition')); -$newcardbutton .= dolGetButtonTitle($langs->trans('ViewKanban'), '', 'fa fa-th-list imgforviewmode', $_SERVER["PHP_SELF"].'?mode=kanban'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ($mode == 'kanban' ? 2 : 1), array('morecss'=>'reposition')); +$newcardbutton .= dolGetButtonTitle($langs->trans('ViewList'), '', 'fa fa-bars imgforviewmode', $_SERVER["PHP_SELF"].'?mode=common'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ((empty($mode) || $mode == 'common') ? 2 : 1), array('morecss' => 'reposition')); +$newcardbutton .= dolGetButtonTitle($langs->trans('ViewKanban'), '', 'fa fa-th-list imgforviewmode', $_SERVER["PHP_SELF"].'?mode=kanban'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ($mode == 'kanban' ? 2 : 1), array('morecss' => 'reposition')); $newcardbutton .= dolGetButtonTitleSeparator(); $newcardbutton .= dolGetButtonTitle($langs->trans('NewLoan'), '', 'fa fa-plus-circle', $url, '', $permissiontoadd); @@ -300,8 +301,8 @@ print ''; print ''; $newcardbutton = ''; -$newcardbutton .= dolGetButtonTitle($langs->trans('ViewList'), '', 'fa fa-bars imgforviewmode', $_SERVER["PHP_SELF"].'?mode=common'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ((empty($mode) || $mode == 'common') ? 2 : 1), array('morecss'=>'reposition')); -$newcardbutton .= dolGetButtonTitle($langs->trans('ViewKanban'), '', 'fa fa-th-list imgforviewmode', $_SERVER["PHP_SELF"].'?mode=kanban'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ($mode == 'kanban' ? 2 : 1), array('morecss'=>'reposition')); +$newcardbutton .= dolGetButtonTitle($langs->trans('ViewList'), '', 'fa fa-bars imgforviewmode', $_SERVER["PHP_SELF"].'?mode=common'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ((empty($mode) || $mode == 'common') ? 2 : 1), array('morecss' => 'reposition')); +$newcardbutton .= dolGetButtonTitle($langs->trans('ViewKanban'), '', 'fa fa-th-list imgforviewmode', $_SERVER["PHP_SELF"].'?mode=kanban'.preg_replace('/(&|\?)*mode=[^&]+/', '', $param), '', ($mode == 'kanban' ? 2 : 1), array('morecss' => 'reposition')); $newcardbutton .= dolGetButtonTitleSeparator(); $newcardbutton .= dolGetButtonTitle($langs->trans('New'), '', 'fa fa-plus-circle', dol_buildpath('/loan/card.php', 1).'?action=create&backtopage='.urlencode($_SERVER['PHP_SELF']), '', $permissiontoadd); @@ -416,7 +417,7 @@ while ($i < $imaxinloop) { $object->ref = $obj->rowid; $object->label = $obj->label; $object->paid = $obj->paid; - $object->datestart= $db->jdate($obj->datestart); + $object->datestart = $db->jdate($obj->datestart); $object->dateend = $db->jdate($obj->dateend); if ($mode == 'kanban') { @@ -489,7 +490,7 @@ if ($num == 0) { $db->free($resql); -$parameters = array('arrayfields'=>$arrayfields, 'sql'=>$sql); +$parameters = array('arrayfields' => $arrayfields, 'sql' => $sql); $reshook = $hookmanager->executeHooks('printFieldListFooter', $parameters, $object, $action); // Note that $action and $object may have been modified by hook print $hookmanager->resPrint; diff --git a/htdocs/product/stock/stocktransfer/class/stocktransfer.class.php b/htdocs/product/stock/stocktransfer/class/stocktransfer.class.php index a5331d30fcf..134f9263bae 100644 --- a/htdocs/product/stock/stocktransfer/class/stocktransfer.class.php +++ b/htdocs/product/stock/stocktransfer/class/stocktransfer.class.php @@ -657,7 +657,7 @@ class StockTransfer extends CommonObject $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'stocktransfer/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'stocktransfer/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'stocktransfer/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++;