diff --git a/htdocs/core/customreports.php b/htdocs/core/customreports.php
index 85b3f7e3349..ed51beba822 100644
--- a/htdocs/core/customreports.php
+++ b/htdocs/core/customreports.php
@@ -114,6 +114,9 @@ if (!defined('USE_CUSTOM_REPORT_AS_INCLUDE')) {
 	}
 }
 
+// In customreport context, we force the protection to avoid forging of criteria including bind SQL injection
+$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
+
 if (empty($mode)) {
 	$mode = 'graph';
 }