diff --git a/htdocs/core/ajax/ajaxextrafield.php b/htdocs/core/ajax/ajaxextrafield.php
index f6a8a886ab4..20bd8b5ff73 100644
--- a/htdocs/core/ajax/ajaxextrafield.php
+++ b/htdocs/core/ajax/ajaxextrafield.php
@@ -40,13 +40,13 @@ if (!defined('NOHEADERNOFOOTER')) {
 }
 
 include '../../main.inc.php';
-include_once DOL_DOCUMENT_ROOT . '/core/class/html.form.class.php';
 /**
  * @var Conf $conf
  * @var DoliDB $db
  * @var Translate $langs
  * @var User $user
  */
+include_once DOL_DOCUMENT_ROOT . '/core/class/html.form.class.php';
 
 // object id
 $objectid = GETPOST('objectid', 'aZ09');
@@ -166,9 +166,9 @@ if ($object instanceof CommonObject) {
 		}
 		if (count($InfoFieldList) > 4 && !empty($InfoFieldList[4])) {
 			if (strpos($InfoFieldList[4], 'extra.') !== false) {
-				$keyList = 'main.' . $InfoFieldList[2] . ' as rowid';
+				$keyList = 'main.' . $db->sanitize($InfoFieldList[2]) . ' as rowid';
 			} else {
-				$keyList = $InfoFieldList[2] . ' as rowid';
+				$keyList = $db->sanitize($InfoFieldList[2]) . ' as rowid';
 			}
 		}
 
@@ -187,8 +187,8 @@ if ($object instanceof CommonObject) {
 			}
 
 			$sqlwhere = '';
-			$sql = "SELECT " . $keyList;
-			$sql .= ' FROM ' . $db->prefix() . $InfoFieldList[0];
+			$sql = "SELECT " . $db->sanitize($keyList, 0, 0, 1);
+			$sql .= ' FROM ' . $db->prefix() . $db->sanitize($InfoFieldList[0]);
 
 			// Add filter from 4th field
 			if (!empty($InfoFieldList[4])) {
diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index 9fadeea3778..970e71a6512 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -533,7 +533,7 @@ class ExtraFields
 			$sql .= " '".$this->db->escape($type)."',";
 			$sql .= " ".((int) $pos).",";
 			$sql .= " '".$this->db->escape($size)."',";
-			$sql .= " ".($entity === '' ? $conf->entity : $entity).",";
+			$sql .= " ".((int) ($entity === '' ? $conf->entity : $entity)).",";
 			$sql .= " '".$this->db->escape($elementtype)."',";
 			$sql .= " ".((int) $unique).",";
 			$sql .= " ".((int) $required).",";
@@ -1563,9 +1563,9 @@ class ExtraFields
 					}
 					if (count($InfoFieldList) > 4 && !empty($InfoFieldList[4])) {
 						if (strpos($InfoFieldList[4], 'extra.') !== false) {
-							$keyList = 'main.'.$InfoFieldList[2].' as rowid';
+							$keyList = 'main.'.$this->db->sanitize($InfoFieldList[2]).' as rowid';
 						} else {
-							$keyList = $InfoFieldList[2].' as rowid';
+							$keyList = $this->db->sanitize($InfoFieldList[2]).' as rowid';
 						}
 					}
 
@@ -1586,8 +1586,8 @@ class ExtraFields
 						// WARNING!! This code is duplicated into core/ajax/ajaxextrafield.php
 
 						$sqlwhere = '';
-						$sql = "SELECT ".$keyList;
-						$sql .= ' FROM '.$this->db->prefix().$InfoFieldList[0];
+						$sql = "SELECT ".$this->db->sanitize($keyList, 0, 0, 1);
+						$sql .= ' FROM '.$this->db->prefix().$this->db->sanitize($InfoFieldList[0]);
 
 						// Add filter from 4th field
 						if (!empty($InfoFieldList[4])) {