From b254f9ac5dba644d3bb049346d2e85f4c242a9be Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 21 Jun 2026 15:31:13 +0200 Subject: [PATCH] Fix duplicate escaping --- htdocs/core/class/fields/checkboxfield.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/class/fields/checkboxfield.class.php b/htdocs/core/class/fields/checkboxfield.class.php index ea58047ddad..81894b03da7 100644 --- a/htdocs/core/class/fields/checkboxfield.class.php +++ b/htdocs/core/class/fields/checkboxfield.class.php @@ -248,8 +248,8 @@ class CheckboxField extends CommonSelectField $alias = $fieldInfos->sqlAlias ?? 't.'; $field = $this->db->sanitize($alias . ($fieldInfos->nameInTable ?? $key)); - $tmp = "'" . implode("','", array_map(array($this->db, 'escape'), $value)) . "'"; - return " AND " . $field . " IN (" . $this->db->sanitize($tmp, 1) . ")"; + $sanitizedSqlIn = "'" . implode("','", array_map(array($this->db, 'escape'), $value)) . "'"; + return " AND " . $field . " IN (" . $sanitizedSqlIn . ")"; } return '';