vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Qual: Fix 'SqlInjection' notices (#39219)

Browse source 
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
This commit is contained in:
MDW 2026-07-20 02:50:44 +02:00 committed by GitHub
parent 2fb564d438
commit 1dcd497c69
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
25 changed files with 167 additions and 167 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
htdocs/accountancy/admin/journals_list.php
View file

@ -225,7 +225,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) {
// List of values
if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) {
$sql .= $newid.",";
$sql .= ((int) $newid).",";
}
$i = 0;
foreach ($listfieldinsert as $f => $value) {
@ -239,7 +239,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) {
}
$i++;
}
$sql .= ",1,".$conf->entity.")";
$sql .= ",1,".((int) $conf->entity).")";
dol_syslog("actionadd", LOG_DEBUG);
$result = $db->query($sql);
@ -326,7 +326,7 @@ if ($action == $acts[0]) {
} elseif ($code) {
$sql = "UPDATE ".$db->sanitize($tabname[$id])." SET active = 1 WHERE code = '".$db->escape($code)."'";
}
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$result = $db->query($sql);
if (!$result) {
@ -348,7 +348,7 @@ if ($action == $acts[1]) {
} elseif ($code) {
$sql = "UPDATE ".$db->sanitize($tabname[$id])." SET active = 0 WHERE code='".$db->escape($code)."'";
}
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$result = $db->query($sql);
if (!$result) {

4
htdocs/adherents/card.php
View file

@ -8,7 +8,7 @@
* Copyright (C) 2015-2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
* Copyright (C) 2018-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2021 Waël Almoman <info@almoman.com>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -206,7 +206,7 @@ if (empty($reshook)) {
if ($socid != $object->socid) { // If link differs from currently in database
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."adherent";
$sql .= " WHERE socid = ".((int) $socid);
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);

6
htdocs/admin/system/dolibarr.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2005-2020 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2007-2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -595,11 +595,11 @@ $sql .= ", entity";
$sql .= " FROM ".MAIN_DB_PREFIX."const";
if (!isModEnabled('multicompany')) {
// If no multicompany mode, admins can see global and their constantes
$sql .= " WHERE entity IN (0,".$conf->entity.")";
$sql .= " WHERE entity IN (0,".((int) $conf->entity).")";
} else {
// If multicompany mode, superadmin (user->entity=0) can see everything, admin are limited to their entities.
if ($user->entity) {
$sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".$conf->entity).")";
$sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".((int) $conf->entity)).")";
}
}
$sql .= " ORDER BY entity, name ASC";

4
htdocs/bom/class/bom.class.php
View file

@ -983,14 +983,14 @@ class BOM extends CommonObject
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'bom/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'bom/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;

12
htdocs/commande/class/orderline.class.php
View file

@ -469,7 +469,7 @@ class OrderLine extends CommonOrderLine
$sql .= ' fk_unit,';
$sql .= ' fk_multicurrency, multicurrency_code, multicurrency_subprice, multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc';
$sql .= ')';
$sql .= " VALUES (".$this->fk_commande.",";
$sql .= " VALUES (".((int) $this->fk_commande).",";
$sql .= " ".($this->fk_parent_line > 0 ? "'".$this->db->escape((string) $this->fk_parent_line)."'" : "null").",";
$sql .= " ".(!empty($this->label) ? "'".$this->db->escape($this->label)."'" : "null").",";
$sql .= " '".$this->db->escape($this->desc)."',";
@ -481,15 +481,15 @@ class OrderLine extends CommonOrderLine
$sql .= " '".price2num($this->localtax2_tx)."',";
$sql .= " '".$this->db->escape($this->localtax1_type)."',";
$sql .= " '".$this->db->escape($this->localtax2_type)."',";
$sql .= ' '.((!empty($this->fk_product) && $this->fk_product > 0) ? $this->fk_product : "null").',';
$sql .= ' '.((!empty($this->fk_product) && $this->fk_product > 0) ? ((int) $this->fk_product) : "null").',';
$sql .= " ".((int) $this->product_type).",";
$sql .= " '".price2num($this->remise_percent)."',";
$sql .= " ".(price2num($this->subprice) !== '' ? price2num($this->subprice) : "null").",";
$sql .= " ".($this->price != '' ? "'".price2num($this->price)."'" : "null").",";
$sql .= ' '.(!empty($this->fk_remise_except) ? $this->fk_remise_except : "null").',';
$sql .= ' '.(!empty($this->fk_remise_except) ? ((int) $this->fk_remise_except) : "null").',';
$sql .= ' '.((int) $this->special_code).',';
$sql .= ' '.((int) $this->rang).',';
$sql .= ' '.(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null").',';
$sql .= ' '.(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "null").',';
$sql .= ' '.price2num($this->pa_ht).',';
$sql .= " ".((int) $this->info_bits).",";
$sql .= " ".price2num($this->total_ht, 'MT').",";
@ -653,14 +653,14 @@ class OrderLine extends CommonOrderLine
$sql .= " , total_localtax1=".price2num($this->total_localtax1);
$sql .= " , total_localtax2=".price2num($this->total_localtax2);
}
$sql .= " , fk_product_fournisseur_price=".(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null");
$sql .= " , fk_product_fournisseur_price=".(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "null");
$sql .= " , buy_price_ht='".price2num($this->pa_ht)."'";
$sql .= " , info_bits=".((int) $this->info_bits);
$sql .= " , special_code=".((int) $this->special_code);
$sql .= " , date_start=".(!empty($this->date_start) ? "'".$this->db->idate($this->date_start)."'" : "null");
$sql .= " , date_end=".(!empty($this->date_end) ? "'".$this->db->idate($this->date_end)."'" : "null");
$sql .= " , product_type = ".((int) $this->product_type);
$sql .= " , fk_parent_line=".(!empty($this->fk_parent_line) ? $this->fk_parent_line : "null");
$sql .= " , fk_parent_line=".(!empty($this->fk_parent_line) ? ((int) $this->fk_parent_line) : "null");
if (!empty($this->rang)) {
$sql .= ", rang=".((int) $this->rang);
}

150
htdocs/compta/resultat/clientfourn.php
View file

@ -317,7 +317,7 @@ if ($modecompta == 'BOOKKEEPING') {
$sql .= " WHERE 1=1";
$sql .= " AND ".$sanitizedpredefinedgroupwhere;
$sql .= " AND aa.fk_pcg_version = '".$db->escape($charofaccountstring)."'";
$sql .= " AND f.entity = ".$conf->entity;
$sql .= " AND f.entity = ".((int) $conf->entity);
if (!empty($date_start) && !empty($date_end)) {
$sql .= " AND f.doc_date >= '".$db->idate($date_start)."'";
$sql .= " AND f.doc_date <= '".$db->idate($date_end)."'";
@ -587,17 +587,17 @@ if ($modecompta == 'BOOKKEEPING') {
}
}
$sql .= " GROUP BY p.societe, p.firstname, p.lastname, dm";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'p.societe, p.firstname, p.lastname, dm';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'p.societe, p.firstname, p.lastname, dm';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("get dunning");
$result = $db->query($sql);
@ -777,20 +777,20 @@ if ($modecompta == 'BOOKKEEPING') {
$sql .= " AND p.datep >= '".$db->idate($date_start)."' AND p.datep <= '".$db->idate($date_end)."'";
}
}
$sql .= " AND cs.entity = ".$conf->entity;
$sql .= " AND cs.entity = ".((int) $conf->entity);
$sql .= " GROUP BY c.libelle, c.id, c.accountancy_code";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'c.libelle, c.id';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'c.libelle, c.id';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("get social contributions deductible=0", LOG_DEBUG);
$result = $db->query($sql);
@ -868,7 +868,7 @@ if ($modecompta == 'BOOKKEEPING') {
if (!empty($date_start) && !empty($date_end)) {
$sql .= " AND cs.date_ech >= '".$db->idate($date_start)."' AND cs.date_ech <= '".$db->idate($date_end)."'";
}
$sql .= " AND cs.entity = ".$conf->entity;
$sql .= " AND cs.entity = ".((int) $conf->entity);
} elseif ($modecompta == 'RECETTES-DEPENSES') {
$sql = "SELECT c.id, c.libelle as label, c.accountancy_code, sum(p.amount) as amount";
$sql .= " FROM ".MAIN_DB_PREFIX."c_chargesociales as c";
@ -880,20 +880,20 @@ if ($modecompta == 'BOOKKEEPING') {
if (!empty($date_start) && !empty($date_end)) {
$sql .= " AND p.datep >= '".$db->idate($date_start)."' AND p.datep <= '".$db->idate($date_end)."'";
}
$sql .= " AND cs.entity = ".$conf->entity;
$sql .= " AND cs.entity = ".((int) $conf->entity);
}
$sql .= " GROUP BY c.libelle, c.id, c.accountancy_code";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'c.libelle, c.id';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'c.libelle, c.id';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("get social contributions deductible=1", LOG_DEBUG);
$result = $db->query($sql);
@ -989,17 +989,17 @@ if ($modecompta == 'BOOKKEEPING') {
$sql .= " GROUP BY u.rowid, u.firstname, u.lastname, s.fk_user, p.label, dm";
}
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'u.firstname, u.lastname';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'u.firstname, u.lastname';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
}
dol_syslog("get salaries");
@ -1095,11 +1095,11 @@ if ($modecompta == 'BOOKKEEPING') {
} else {
$sql .= " GROUP BY u.rowid, p.rowid, p.ref, u.firstname, u.lastname, dm";
}
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'p.ref';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'p.ref';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
}
print '<tr class="trforbreak"><td colspan="4">'.$langs->trans("ExpenseReport").'</td></tr>';
@ -1320,17 +1320,17 @@ if ($modecompta == 'BOOKKEEPING') {
}
$sql .= " AND f.entity IN (".getEntity('invoice').")";
$sql .= " GROUP BY dm";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'dm';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'dm';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("get vat to pay", LOG_DEBUG);
$result = $db->query($sql);
@ -1376,19 +1376,19 @@ if ($modecompta == 'BOOKKEEPING') {
if (!empty($date_start) && !empty($date_end)) {
$sql .= " AND f.datef >= '".$db->idate($date_start)."' AND f.datef <= '".$db->idate($date_end)."'";
}
$sql .= " AND f.entity = ".$conf->entity;
$sql .= " AND f.entity = ".((int) $conf->entity);
$sql .= " GROUP BY dm";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'dm';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'dm';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("get vat received back", LOG_DEBUG);
$result = $db->query($sql);
@ -1430,19 +1430,19 @@ if ($modecompta == 'BOOKKEEPING') {
if (!empty($date_start) && !empty($date_end)) {
$sql .= " AND t.datev >= '".$db->idate($date_start)."' AND t.datev <= '".$db->idate($date_end)."'";
}
$sql .= " AND t.entity = ".$conf->entity;
$sql .= " AND t.entity = ".((int) $conf->entity);
$sql .= " GROUP BY dm";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'dm';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'dm';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("get vat really paid", LOG_DEBUG);
$result = $db->query($sql);
@ -1485,19 +1485,19 @@ if ($modecompta == 'BOOKKEEPING') {
if (!empty($date_start) && !empty($date_end)) {
$sql .= " AND t.datev >= '".$db->idate($date_start)."' AND t.datev <= '".$db->idate($date_end)."'";
}
$sql .= " AND t.entity = ".$conf->entity;
$sql .= " AND t.entity = ".((int) $conf->entity);
$sql .= " GROUP BY dm";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'dm';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'dm';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("get vat really received back", LOG_DEBUG);
$result = $db->query($sql);

14
htdocs/contrat/class/contratligne.class.php
View file

@ -691,19 +691,19 @@ class ContratLigne extends CommonObjectLine
$sql .= " localtax2_tx = ".price2num($this->localtax2_tx).",";
$sql .= " qty = ".price2num($this->qty).",";
$sql .= " remise_percent = ".price2num($this->remise_percent).",";
$sql .= " fk_remise_except = ".($this->fk_remise_except > 0 ? $this->fk_remise_except : "null").",";
$sql .= " subprice = ".($this->subprice != '' ? $this->subprice : "null").",";
$sql .= " fk_remise_except = ".($this->fk_remise_except > 0 ? ((int) $this->fk_remise_except) : "null").",";
$sql .= " subprice = ".($this->subprice != '' ? ((float) $this->subprice) : "null").",";
$sql .= " total_ht = ".((float) $this->total_ht).",";
$sql .= " total_tva = ".((float) $this->total_tva).",";
$sql .= " total_localtax1 = ".((float) $this->total_localtax1).",";
$sql .= " total_localtax2 = ".((float) $this->total_localtax2).",";
$sql .= " total_ttc = ".((float) $this->total_ttc).",";
$sql .= " fk_product_fournisseur_price = ".(!empty($this->fk_fournprice) ? $this->fk_fournprice : "NULL").",";
$sql .= " fk_product_fournisseur_price = ".(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "NULL").",";
$sql .= " buy_price_ht = '".price2num($this->pa_ht)."',";
$sql .= " info_bits = '".$this->db->escape((string) $this->info_bits)."',";
$sql .= " fk_user_author = ".($this->fk_user_author >= 0 ? $this->fk_user_author : "NULL").",";
$sql .= " fk_user_ouverture = ".($this->fk_user_ouverture > 0 ? $this->fk_user_ouverture : "NULL").",";
$sql .= " fk_user_cloture = ".($this->fk_user_cloture > 0 ? $this->fk_user_cloture : "NULL").",";
$sql .= " fk_user_author = ".($this->fk_user_author >= 0 ? ((int) $this->fk_user_author) : "NULL").",";
$sql .= " fk_user_ouverture = ".($this->fk_user_ouverture > 0 ? ((int) $this->fk_user_ouverture) : "NULL").",";
$sql .= " fk_user_cloture = ".($this->fk_user_cloture > 0 ? ((int) $this->fk_user_cloture) : "NULL").",";
$sql .= " commentaire = '".$this->db->escape($this->commentaire)."',";
$sql .= " fk_unit = ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)).",";
$sql .= " rang = ".(empty($this->rang) ? '0' : ((int) $this->rang));
@ -834,7 +834,7 @@ class ContratLigne extends CommonObjectLine
$sql .= ",date_fin_validite";
}
$sql .= ") VALUES (".((int) $this->fk_contrat).", '', '".$this->db->escape($this->description)."',";
$sql .= ($this->fk_product > 0 ? $this->fk_product : "null").",";
$sql .= ($this->fk_product > 0 ? ((int) $this->fk_product) : "null").",";
$sql .= " '".$this->db->escape((string) $this->qty)."',";
$sql .= " '".$this->db->escape($this->vat_src_code)."',";
$sql .= " '".$this->db->escape($this->tva_tx)."',";

14
htdocs/core/class/comment.class.php
View file

@ -1,6 +1,6 @@
<?php
/* Copyright (C) 2019 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -114,11 +114,11 @@ class Comment extends CommonObject
$sql .= ") VALUES (";
$sql .= "'".$this->db->escape($this->description)."'";
$sql .= ", ".($this->datec != '' ? "'".$this->db->idate($this->datec)."'" : 'null');
$sql .= ", '".(isset($this->fk_element) ? $this->fk_element : "null")."'";
$sql .= ", '".(isset($this->fk_element) ? ((int) $this->fk_element) : "null")."'";
$sql .= ", '".$this->db->escape($this->element_type)."'";
$sql .= ", '".(isset($this->fk_user_author) ? $this->fk_user_author : "null")."'";
$sql .= ", '".(isset($this->fk_user_author) ? ((int) $this->fk_user_author) : "null")."'";
$sql .= ", ".((int) $user->id);
$sql .= ", ".(!empty($this->entity) ? $this->entity : '1');
$sql .= ", ".(!empty($this->entity) ? ((int) $this->entity) : '1');
$sql .= ", ".(!empty($this->import_key) ? "'".$this->db->escape($this->import_key)."'" : "null");
$sql .= ")";
@ -246,10 +246,10 @@ class Comment extends CommonObject
$sql = "UPDATE ".$this->db->prefix().$this->table_element." SET";
$sql .= " description = ".(isset($this->description) ? "'".$this->db->escape($this->description)."'" : "null").",";
$sql .= " datec = ".($this->datec != '' ? "'".$this->db->idate($this->datec)."'" : 'null').",";
$sql .= " fk_element = ".(isset($this->fk_element) ? $this->fk_element : "null").",";
$sql .= " fk_element = ".(isset($this->fk_element) ? ((int) $this->fk_element) : "null").",";
$sql .= " element_type = '".$this->db->escape($this->element_type)."',";
$sql .= " fk_user_modif = ".((int) $user->id).",";
$sql .= " entity = ".(!empty($this->entity) ? $this->entity : '1').",";
$sql .= " entity = ".(!empty($this->entity) ? ((int) $this->entity) : '1').",";
$sql .= " import_key = ".(!empty($this->import_key) ? "'".$this->db->escape($this->import_key)."'" : "null");
$sql .= " WHERE rowid = ".((int) $this->id);
@ -358,7 +358,7 @@ class Comment extends CommonObject
$sql .= " FROM ".$this->db->prefix().$this->table_element." as c";
$sql .= " WHERE c.fk_element = ".((int) $fk_element);
$sql .= " AND c.element_type = '".$this->db->escape($element_type)."'";
$sql .= " AND c.entity = ".$conf->entity;
$sql .= " AND c.entity = ".((int) $conf->entity);
$sql .= " ORDER BY c.tms DESC";
dol_syslog(get_class($this).'::'.__METHOD__, LOG_DEBUG);

2
htdocs/core/class/html.formaccounting.class.php
View file

@ -179,7 +179,7 @@ class FormAccounting extends Form
$sql = "SELECT rowid, code, label, nature, entity, active";
$sql .= " FROM ".$this->db->prefix()."accounting_journal";
$sql .= " WHERE active = 1";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
if ($nature && is_numeric($nature)) {
$sql .= " AND nature = ".((int) $nature);
}

6
htdocs/core/class/menubase.class.php
View file

@ -230,7 +230,7 @@ class Menubase
$maxrowid = 1;
}
$sql = "SELECT setval('".$this->db->prefix()."menu_rowid_seq', ".($maxrowid).")";
$sql = "SELECT setval('".$this->db->prefix()."menu_rowid_seq', ".((int) $maxrowid).")";
//print $sql; exit;
$resqlrowidset = $this->db->query($sql);
if (!$resqlrowidset) {
@ -248,7 +248,7 @@ class Menubase
$sql .= " AND fk_menu = ".((int) $this->fk_menu);
$sql .= " AND position = ".((int) $this->position);
$sql .= " AND url = '".$this->db->escape($this->url)."'";
$sql .= " AND entity IN (0, ".$conf->entity.")";
$sql .= " AND entity IN (0, ".((int) $conf->entity).")";
$result = $this->db->query($sql);
if ($result) {
@ -649,7 +649,7 @@ class Menubase
$sql = "SELECT m.rowid, m.type, m.module, m.fk_menu, m.fk_mainmenu, m.fk_leftmenu, m.url, m.titre,";
$sql .= " m.prefix, m.langs, m.perms, m.enabled, m.target, m.mainmenu, m.leftmenu, m.position, m.showtopmenuinframe";
$sql .= " FROM ".$this->db->prefix()."menu as m";
$sql .= " WHERE m.entity IN (0,".$conf->entity.")";
$sql .= " WHERE m.entity IN (0,".((int) $conf->entity).")";
$sql .= " AND m.menu_handler IN ('".$this->db->escape($menu_handler)."','all')";
if ($type_user == 0) {
$sql .= " AND m.usertype IN (0,2)";

10
htdocs/core/db/sqlite3.class.php
View file

@ -887,7 +887,7 @@ class DoliDBSqlite3 extends DoliDB
$sanitizedlike = "LIKE '".$this->escape($tmptable)."'";
}
$sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database);
$sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database); // @phan-suppress-current-line SqlInjection
$sql = "SHOW TABLES FROM ".$sanitizedtmpdatabase." ".$sanitizedlike.";";
//print $sql;
@ -919,7 +919,7 @@ class DoliDBSqlite3 extends DoliDB
$sanitizedlike = "LIKE '".$this->escape($tmptable)."'";
}
$sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database);
$sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database); // @phan-suppress-current-line SqlInjection
$sql = "SHOW FULL TABLES FROM ".$sanitizedtmpdatabase." ".$sanitizedlike.";";
//print $sql;
@ -1223,7 +1223,7 @@ class DoliDBSqlite3 extends DoliDB
// phpcs:enable
$sql = "INSERT INTO user ";
$sql .= "(Host,User,password,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Index_Priv,Alter_priv,Lock_tables_priv)";
$sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_user)."',password('".addslashes($dolibarr_main_db_pass)."')";
$sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_user)."',password('".$this->escape($dolibarr_main_db_pass)."')";
$sql .= ",'Y','Y','Y','Y','Y','Y','Y','Y','Y')";
dol_syslog(get_class($this)."::DDLCreateUser", LOG_DEBUG); // No sql to avoid password in log
@ -1234,7 +1234,7 @@ class DoliDBSqlite3 extends DoliDB
$sql = "INSERT INTO db ";
$sql .= "(Host,Db,User,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Index_Priv,Alter_priv,Lock_tables_priv)";
$sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_name)."','".addslashes($dolibarr_main_db_user)."'";
$sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_name)."','".$this->escape($dolibarr_main_db_user)."'";
$sql .= ",'Y','Y','Y','Y','Y','Y','Y','Y','Y')";
dol_syslog(get_class($this)."::DDLCreateUser", LOG_DEBUG);
@ -1371,7 +1371,7 @@ class DoliDBSqlite3 extends DoliDB
// TODO prendre en compte le filtre
foreach ($pragmas as $var) {
$sql = "PRAGMA $var";
$sql = "PRAGMA $var"; // @phan-suppress-current-line SqlInjection
$resql = $this->query($sql);
if ($resql) {
$obj = $this->fetch_row($resql);

16
htdocs/core/modules/modProduct.class.php
View file

@ -8,7 +8,7 @@
* Copyright (C) 2014 Christophe Battarel <contact@altairis.fr>
* Copyright (C) 2014 Cedric Gross <c.gross@kreiz-it.fr>
* Copyright (C) 2020-2021 Alexandre Spangaro <aspangaro@open-dsi.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 Pierre Ardoin <developpeur@lesmetiersdubatiment.fr>
*
@ -147,7 +147,7 @@ class modProduct extends DolibarrModules
$this->rights[$r][5] = 'read_supplier_prices';
$r++;
// EN: Advanced permission to write supplier prices
// EN: Advanced permission to write supplier prices
$this->rights[$r][0] = 36; // id de la permission
$this->rights[$r][1] = 'Write supplier prices'; // libelle de la permission
$this->rights[$r][2] = 'w'; // type de la permission (deprecated)
@ -387,7 +387,7 @@ class modProduct extends DolibarrModules
);
$this->export_sql_start[$r] = 'SELECT DISTINCT ';
$this->export_sql_end[$r] = ' FROM '.MAIN_DB_PREFIX.'product as p';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.$conf->entity; // export prices only for the current entity
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.((int) $conf->entity); // export prices only for the current entity
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_price_extrafields as extra ON pr.rowid = extra.fk_object';
$this->export_sql_end[$r] .= ' WHERE p.entity IN ('.getEntity('product').')'; // For product and service profile
$this->export_sql_end[$r] .= ' AND pr.date_price = (SELECT MAX(pr2.date_price) FROM '.MAIN_DB_PREFIX.'product_price as pr2 WHERE pr2.fk_product = pr.fk_product AND pr2.price_level = pr.price_level AND pr2.entity IN ('.getEntity('product').'))'; // export only latest prices not full history
@ -435,7 +435,7 @@ class modProduct extends DolibarrModules
'pr.datec' => "product");
$this->export_sql_start[$r] = 'SELECT DISTINCT ';
$this->export_sql_end[$r] = ' FROM '.MAIN_DB_PREFIX.'product as p';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_customer_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.$conf->entity; // export prices only for the current entity
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_customer_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.((int) $conf->entity); // export prices only for the current entity
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'societe as s ON pr.fk_soc = s.rowid';
$this->export_sql_end[$r] .= ' WHERE p.entity IN ('.getEntity('product').')'; // For product and service profile
}
@ -703,7 +703,7 @@ class modProduct extends DolibarrModules
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product' AND entity IN (0, ".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product' AND entity IN (0, ".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) { // This can fail when class is used on old database (during migration for example)
while ($obj = $this->db->fetch_object($resql)) {
@ -896,7 +896,7 @@ class modProduct extends DolibarrModules
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_fournisseur_price' AND entity IN (0, ".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_fournisseur_price' AND entity IN (0, ".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) { // This can fail when class is used on old database (during migration for example)
while ($obj = $this->db->fetch_object($resql)) {
@ -995,7 +995,7 @@ class modProduct extends DolibarrModules
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_price' AND entity IN (0, ".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_price' AND entity IN (0, ".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) { // This can fail when class is used on old database (during migration for example)
while ($obj = $this->db->fetch_object($resql)) {
@ -1065,7 +1065,7 @@ class modProduct extends DolibarrModules
'sp.tva_tx' => '20',
'sp.default_vat_code' => '5',
'sp.discount_percent' => '30',
'sp.price_base_type'=> 'HT (for excl tax) or TTC (for inc tax)',
'sp.price_base_type' => 'HT (for excl tax) or TTC (for inc tax)',
'sp.price' => "100",
'sp.price_min' => "80",
'sp.price_ttc' => "120",

4
htdocs/core/modules/modProjet.class.php
View file

@ -307,7 +307,7 @@ class modProjet extends DolibarrModules
$this->import_fields_array[$r] = array('t.ref' => 'ProjectRef*', 't.title' => 'Label*', 't.description' => "Description", 't.fk_soc' => 'ThirdPartyName', 't.public' => "Public", 't.fk_statut' => "Status");
$this->import_fields_array[$r] = array_merge($this->import_fields_array[$r], array('t.fk_opp_status' => "OpportunityStatus", 't.opp_percent' => "OpportunityProbability", 't.opp_amount' => "OpportunityAmount", 't.note_public' => "NotePublic", 't.note_private' => "NotePrivate", 't.budget_amount' => "Budget", 't.dateo' => "DateStart", 't.datee' => "DateEnd", 't.usage_opportunity' => "UsageOpportunity", 't.usage_task' => 'UsageTasks', 't.usage_bill_time' => 'UsageBillTimeShort'));
// Add extra fields
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet' AND entity IN (0,".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet' AND entity IN (0,".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) { // This can fail when class is used on old database (during migration for example)
while ($obj = $this->db->fetch_object($resql)) {
@ -353,7 +353,7 @@ class modProjet extends DolibarrModules
$this->import_tables_array[$r] = array('t' => MAIN_DB_PREFIX.'projet_task', 'extra' => MAIN_DB_PREFIX.'projet_task_extrafields'); // List of tables to insert into (insert done in same order)
$this->import_fields_array[$r] = array('t.fk_projet' => 'ProjectRef*', 't.ref' => 'RefTask*', 't.label' => 'LabelTask*', 't.dateo' => "DateStart", 't.datee' => "DateEnd", 't.planned_workload' => "PlannedWorkload", 't.progress' => "Progress", 't.note_private' => "NotePrivate", 't.note_public' => "NotePublic", 't.datec' => "DateCreation");
// Add extra fields
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet_task' AND entity IN (0,".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet_task' AND entity IN (0,".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) { // This can fail when class is used on old database (during migration for example)
while ($obj = $this->db->fetch_object($resql)) {

8
htdocs/cron/class/cronjob.class.php
View file

@ -904,7 +904,7 @@ class Cronjob extends CommonObject
// Update request
$sql = "UPDATE ".MAIN_DB_PREFIX."cronjob SET";
$sql .= " entity=".(isset($this->entity) ? ((int) $this->entity) : $conf->entity).",";
$sql .= " entity=".(isset($this->entity) ? ((int) $this->entity) : ((int) $conf->entity)).",";
$sql .= " label=".(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null").",";
$sql .= " jobtype=".(isset($this->jobtype) ? "'".$this->db->escape($this->jobtype)."'" : "null").",";
$sql .= " command=".(isset($this->command) ? "'".$this->db->escape($this->command)."'" : "null").",";
@ -925,13 +925,13 @@ class Cronjob extends CommonObject
$sql .= " unitfrequency=".(isset($this->unitfrequency) ? "'".$this->db->escape($this->unitfrequency)."'" : "null").",";
$sql .= " frequency=".(isset($this->frequency) ? ((int) $this->frequency) : "null").",";
$sql .= " status=".(isset($this->status) ? ((int) $this->status) : "null").",";
$sql .= " processing=".((isset($this->processing) && $this->processing > 0) ? $this->processing : "0").",";
$sql .= " processing=".((isset($this->processing) && $this->processing > 0) ? ((int) $this->processing) : "0").",";
$sql .= " pid=".(isset($this->pid) ? ((int) $this->pid) : "null").",";
$sql .= " email_alert = ".(isset($this->email_alert) ? "'".$this->db->escape($this->email_alert)."'" : "null").",";
$sql .= " fk_user_mod = ".((int) $user->id).",";
$sql .= " note=".(isset($this->note_private) ? "'".$this->db->escape($this->note_private)."'" : "null").",";
$sql .= " nbrun=".((isset($this->nbrun) && $this->nbrun > 0) ? $this->nbrun : "null").",";
$sql .= " maxrun=".((isset($this->maxrun) && $this->maxrun > 0) ? $this->maxrun : "0").",";
$sql .= " nbrun=".((isset($this->nbrun) && $this->nbrun > 0) ? ((int) $this->nbrun) : "null").",";
$sql .= " maxrun=".((isset($this->maxrun) && $this->maxrun > 0) ? ((int) $this->maxrun) : "0").",";
$sql .= " libname=".(isset($this->libname) ? "'".$this->db->escape($this->libname)."'" : "null").",";
$sql .= " test=".(isset($this->test) ? "'".$this->db->escape($this->test)."'" : "null");
$sql .= " WHERE rowid=".((int) $this->id);

8
htdocs/delivery/class/delivery.class.php
View file

@ -7,7 +7,7 @@
* Copyright (C) 2013 Florian Henry <florian.henry@open-concept.pro>
* Copyright (C) 2014-2015 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2023-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -193,7 +193,7 @@ class Delivery extends CommonObject
$sql .= ", '".$this->db->idate($now)."'";
$sql .= ", ".((int) $user->id);
$sql .= ", ".($this->date_delivery ? "'".$this->db->idate($this->date_delivery)."'" : "null");
$sql .= ", ".($this->fk_delivery_address > 0 ? $this->fk_delivery_address : "null");
$sql .= ", ".($this->fk_delivery_address > 0 ? ((int) $this->fk_delivery_address) : "null");
$sql .= ", ".(!empty($this->note_private) ? "'".$this->db->escape($this->note_private)."'" : "null");
$sql .= ", ".(!empty($this->note_public) ? "'".$this->db->escape($this->note_public)."'" : "null");
$sql .= ", ".(!empty($this->model_pdf) ? "'".$this->db->escape($this->model_pdf)."'" : "null");
@ -293,7 +293,7 @@ class Delivery extends CommonObject
$sql = "INSERT INTO ".MAIN_DB_PREFIX."deliverydet (fk_delivery, fk_origin_line,";
$sql .= " fk_product, description, qty)";
$sql .= " VALUES (".$this->id.",".((int) $origin_id).",";
$sql .= " VALUES (".((int) $this->id).",".((int) $origin_id).",";
$sql .= " ".($fk_product > 0 ? ((int) $fk_product) : "null").",";
$sql .= " ".($description ? "'".$this->db->escape($description)."'" : "null").",";
$sql .= (price2num($qty, 'MS')).")";
@ -501,7 +501,7 @@ class Delivery extends CommonObject
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'expedition/receipt/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'expedition/receipt/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'expedition/receipt/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;

14
htdocs/don/class/don.class.php
View file

@ -8,7 +8,7 @@
* Copyright (C) 2019 Thibault FOUCART <support@ptibogxiv.net>
* Copyright (C) 2019-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2021 Maxime DEMAREST <maxime@indelog.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -258,7 +258,7 @@ class Don extends CommonObject
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."societe";
$sql .= " WHERE client IN (1, 3)";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$sql .= " LIMIT 10";
$resql = $this->db->query($sql);
@ -436,8 +436,8 @@ class Don extends CommonObject
$sql .= "'".$this->db->idate($this->date ? $this->date : $now)."'";
$sql .= ", ".((int) $conf->entity);
$sql .= ", ".((float) $this->amount);
$sql .= ", ".($this->modepaymentid ? $this->modepaymentid : "null");
$sql .= ", ".($this->socid > 0 ? $this->socid : "null");
$sql .= ", ".($this->modepaymentid ? ((int) $this->modepaymentid) : "null");
$sql .= ", ".($this->socid > 0 ? ((int) $this->socid) : "null");
$sql .= ", '".$this->db->escape($this->firstname)."'";
$sql .= ", '".$this->db->escape($this->lastname)."'";
$sql .= ", '".$this->db->escape($this->societe)."'";
@ -529,7 +529,7 @@ class Don extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."don SET";
$sql .= " amount = ".((float) $this->amount);
$sql .= ", fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null");
$sql .= ", fk_payment = ".($this->modepaymentid ? ((int) $this->modepaymentid) : "null");
$sql .= ", firstname = '".$this->db->escape($this->firstname)."'";
$sql .= ", lastname='".$this->db->escape($this->lastname)."'";
$sql .= ", societe='".$this->db->escape($this->societe)."'";
@ -538,7 +538,7 @@ class Don extends CommonObject
$sql .= ", town='".$this->db->escape($this->town)."'";
$sql .= ", fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0');
$sql .= ", public=".((int) $this->public);
$sql .= ", fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null');
$sql .= ", fk_projet=".($this->fk_project > 0 ? ((int) $this->fk_project) : 'null');
$sql .= ", note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
$sql .= ", note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
$sql .= ", datedon='".$this->db->idate($this->date)."'";
@ -904,7 +904,7 @@ class Don extends CommonObject
$sql = "SELECT sum(amount) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."don";
$sql .= " WHERE fk_statut = ".((int) $param);
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if ($resql) {

12
htdocs/ecm/class/ecmfiles.class.php
View file

@ -464,7 +464,7 @@ class EcmFiles extends CommonObject
if (isset($entity)) {
$sql .= " AND t.entity = " . (int) $entity;
} else {
$sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index
$sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index
}
$filterfound++;
}
@ -473,7 +473,7 @@ class EcmFiles extends CommonObject
if (isset($entity)) {
$sql .= " AND t.entity = " . (int) $entity;
} else {
$sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index
$sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index
}
$filterfound++;
}
@ -482,7 +482,7 @@ class EcmFiles extends CommonObject
if (isset($entity)) {
$sql .= " AND t.entity = " . (int) $entity;
} else {
$sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index
$sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index
}
$filterfound++;
}
@ -492,7 +492,7 @@ class EcmFiles extends CommonObject
} else {
$sql .= " AND t.share IS NOT NULL AND t.share <> ''";
}
//$sql .= " AND t.entity = ".$conf->entity; // hashforshare already unique
//$sql .= " AND t.entity = ".((int) $conf->entity); // hashforshare already unique
$filterfound++;
}
if ($src_object_type && $src_object_id) {
@ -500,7 +500,7 @@ class EcmFiles extends CommonObject
if (isset($entity)) {
$sql .= " AND t.entity = " . (int) $entity;
} else {
$sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index
$sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index
}
$filterfound++;
}
@ -769,7 +769,7 @@ class EcmFiles extends CommonObject
$sql .= " ref = '".$this->db->escape(dol_hash($this->filepath."/".$this->filename, '3'))."',";
$sql .= ' label = '.(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null").',';
$sql .= ' share = '.(!empty($this->share) ? "'".$this->db->escape($this->share)."'" : "null").',';
$sql .= ' entity = '.(isset($this->entity) ? $this->entity : $conf->entity).',';
$sql .= ' entity = '.(isset($this->entity) ? ((int) $this->entity) : ((int) $conf->entity)).',';
$sql .= ' filename = '.(isset($this->filename) ? "'".$this->db->escape($this->filename)."'" : "null").',';
$sql .= ' filepath = '.(isset($this->filepath) ? "'".$this->db->escape($this->filepath)."'" : "null").',';
$sql .= ' fullpath_orig = '.(isset($this->fullpath_orig) ? "'".$this->db->escape($this->fullpath_orig)."'" : "null").',';

4
htdocs/expensereport/class/expensereport.class.php
View file

@ -921,7 +921,7 @@ class ExpenseReport extends CommonObject
$sql .= " f.fk_user_approve";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport as f";
$sql .= " WHERE f.rowid = ".((int) $id);
$sql .= " AND f.entity = ".$conf->entity;
$sql .= " AND f.entity = ".((int) $conf->entity);
@ -1405,7 +1405,7 @@ class ExpenseReport extends CommonObject
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'expensereport/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'expensereport/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'expensereport/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;

6
htdocs/fourn/class/fournisseur.facture-rec.class.php
View file

@ -913,10 +913,10 @@ class FactureFournisseurRec extends CommonInvoice
$error = 0;
$this->db->begin();
$main = MAIN_DB_PREFIX.'facture_fourn_det_rec';
$ef = $main."_extrafields";
$sql_main_table = MAIN_DB_PREFIX.'facture_fourn_det_rec';
$sql_ef_table = $sql_main_table."_extrafields";
$sqlef = "DELETE FROM ".$ef." WHERE fk_object IN (SELECT rowid FROM ".$main." WHERE fk_facture_fourn = ". (int) $rowid .")";
$sqlef = "DELETE FROM ".$sql_ef_table." WHERE fk_object IN (SELECT rowid FROM ".$sql_main_table." WHERE fk_facture_fourn = ". (int) $rowid .")";
$sql = "DELETE FROM ".MAIN_DB_PREFIX."facture_fourn_det_rec WHERE fk_facture_fourn = ". (int) $rowid;
if ($this->db->query($sqlef) && $this->db->query($sql)) {

8
htdocs/hrm/index.php
View file

@ -5,7 +5,7 @@
* Copyright (C) 2015-2016 Alexandre Spangaro <aspangaro@open-dsi.fr>
* Copyright (C) 2019 Nicolas ZABOURI <info@inovea-conseil.com>
* Copyright (C) 2021-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -204,7 +204,7 @@ if (isModEnabled('holiday') && $user->hasRight('holiday', 'read')) {
$sql .= " x.rowid, x.ref, x.fk_type, x.date_debut as date_start, x.date_fin as date_end, x.halfday, x.tms as dm, x.statut as status";
$sql .= " FROM ".MAIN_DB_PREFIX."holiday as x, ".MAIN_DB_PREFIX."user as u";
$sql .= " WHERE u.rowid = x.fk_user";
$sql .= " AND x.entity = ".$conf->entity;
$sql .= " AND x.entity = ".((int) $conf->entity);
if (!$user->hasRight('holiday', 'readall')) {
$sql .= ' AND x.fk_user IN ('.$db->sanitize(implode(',', $childids)).')';
}
@ -310,7 +310,7 @@ if (isModEnabled('expensereport') && $user->hasRight('expensereport', 'read')) {
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport as x, ".MAIN_DB_PREFIX."user as u";
//if (empty($user->rights->societe->client->voir) && !$user->socid) $sql.= ", ".MAIN_DB_PREFIX."societe as s, ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql .= " WHERE u.rowid = x.fk_user_author";
$sql .= " AND x.entity = ".$conf->entity;
$sql .= " AND x.entity = ".((int) $conf->entity);
if (!$user->hasRight('expensereport', 'readall') && !$user->hasRight('expensereport', 'lire_tous')) {
$sql .= ' AND x.fk_user_author IN ('.$db->sanitize(implode(',', $childids)).')';
}
@ -400,7 +400,7 @@ if (isModEnabled('recruitment') && $user->hasRight('recruitment', 'recruitmentjo
$sql .= " AND rp.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
}
if ($socid) {
$sql .= " AND rp.fk_soc = $socid";
$sql .= " AND rp.fk_soc = ".((int) $socid);
}
$sql .= $db->order("rc.tms", "DESC");
$sql .= $db->plimit($max, 0);

8
htdocs/partnership/class/partnership.class.php
View file

@ -710,14 +710,14 @@ class Partnership extends CommonObject
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'partnership/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'partnership/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
@ -836,14 +836,14 @@ class Partnership extends CommonObject
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'partnership/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'partnership/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;

6
htdocs/recruitment/class/recruitmentjobposition.class.php
View file

@ -596,14 +596,14 @@ class RecruitmentJobPosition extends CommonObject
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'recruitmentjobposition/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'recruitmentjobposition/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
@ -720,7 +720,7 @@ class RecruitmentJobPosition extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET status = ".((int) $status).", note_private = '".$this->db->escape($newprivatenote)."'";
//$sql .= ", date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id;
//$sql .= ", date_cloture='".$this->db->idate($now)."', fk_user_cloture=".((int) $user->id);
$sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);

2
htdocs/salaries/class/api_salaries.class.php
View file

@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2023 Marc Chenebaux <marc.chenebaux@maj44.com>
* Copyright (C) 2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify

6
htdocs/salaries/class/paymentsalary.class.php
View file

@ -432,12 +432,12 @@ class PaymentSalary extends CommonObject
// Update request
$sql = "UPDATE ".MAIN_DB_PREFIX."payment_salary SET";
$sql .= " fk_salary=".(isset($this->fk_salary) ? $this->fk_salary : "null").",";
$sql .= " fk_salary=".(isset($this->fk_salary) ? ((int) $this->fk_salary) : "null").",";
$sql .= " datec=".(dol_strlen($this->datec) != 0 ? "'".$this->db->idate($this->datec)."'" : 'null').",";
$sql .= " tms=".(dol_strlen((string) $this->tms) != 0 ? "'".$this->db->idate($this->tms)."'" : 'null').",";
$sql .= " datep=".(dol_strlen($this->datepaye) != 0 ? "'".$this->db->idate($this->datepaye)."'" : 'null').",";
$sql .= " amount=".(isset($this->amount) ? $this->amount : "null").",";
$sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? $this->fk_typepayment : "null").",";
$sql .= " amount=".(isset($this->amount) ? ((float) $this->amount) : "null").",";
$sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? ((int) $this->fk_typepayment) : "null").",";
$sql .= " num_payment=".(isset($this->num_payment) ? "'".$this->db->escape($this->num_payment)."'" : "null").",";
$sql .= " note=".(isset($this->note) ? "'".$this->db->escape($this->note)."'" : "null").",";
$sql .= " fk_bank=".(isset($this->fk_bank) ? ((int) $this->fk_bank) : "null").",";

2
htdocs/societe/class/companybankaccount.class.php
View file

@ -693,7 +693,7 @@ class CompanyBankAccount extends Account
public function setAsDefault($rib = 0, $resetolddefaultfor = 'ban')
{
$sql1 = "SELECT rowid as id, fk_soc as socid FROM ".MAIN_DB_PREFIX."societe_rib";
$sql1 .= " WHERE rowid = ".((int) ($rib ? $rib : $this->id));
$sql1 .= " WHERE rowid = ".((int) ($rib ? $rib : ((int) $this->id)));
dol_syslog(get_class($this).'::setAsDefault', LOG_DEBUG);
$result1 = $this->db->query($sql1);