diff --git a/htdocs/comm/mailing/advtargetemailing.php b/htdocs/comm/mailing/advtargetemailing.php index cd803c36e5d..7187c97a6a1 100644 --- a/htdocs/comm/mailing/advtargetemailing.php +++ b/htdocs/comm/mailing/advtargetemailing.php @@ -203,7 +203,7 @@ if ($action == 'add' && $permissiontoadd) { // Add recipients } if (preg_match("/^contact_/", $key)) { - $array_query[$key] = GETPOST($key); + $array_query[$key] = GETPOSTISARRAY($key) ? GETPOST($key, 'array:int') : GETPOST($key); $specials_date_key = array( 'contact_update_st_dt', @@ -232,7 +232,7 @@ if ($action == 'add' && $permissiontoadd) { // Add recipients } if (preg_match("/^type_of_target/", $key)) { - $array_query[$key] = GETPOST($key); + $array_query[$key] = GETPOSTINT($key); } } diff --git a/htdocs/comm/mailing/class/advtargetemailing.class.php b/htdocs/comm/mailing/class/advtargetemailing.class.php index 7cd80025f44..4e8e5e3affa 100644 --- a/htdocs/comm/mailing/class/advtargetemailing.class.php +++ b/htdocs/comm/mailing/class/advtargetemailing.class.php @@ -764,7 +764,7 @@ class AdvanceTargetingMailing extends CommonObject $sqlwhere[] = " (t.datec >= '".$this->db->idate($arrayquery['contact_create_st_dt'])."' AND t.datec <= '".$this->db->idate($arrayquery['contact_create_end_dt'])."')"; } if (!empty($arrayquery['contact_categ']) && count($arrayquery['contact_categ']) > 0) { - $sqlwhere[] = " (contactcateg.fk_categorie IN (".$this->db->escape(implode(",", $arrayquery['contact_categ']))."))"; + $sqlwhere[] = " (contactcateg.fk_categorie IN (".$this->db->sanitize(implode(",", $arrayquery['contact_categ']), 0, 0, 0, 0)."))"; } //Standard Extrafield feature diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index e1ea875756f..799989c9a4c 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -1302,7 +1302,7 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null } // Check type of variable and make sanitization according to this - if (preg_match('/^array/', $check)) { // If 'array' or 'array:restricthtml' or 'array:aZ09' or 'array:intcomma' + if (preg_match('/^array/', $check)) { // If 'array' or 'array:restricthtml' or 'array:aZ09' or 'array:int' $tmpcheck = 'alphanohtml'; if ($out === null || $out === '') { $out = array();