Date: Fri, 27 Aug 2021 10:21:02 +0200
Subject: [PATCH 088/953] add missing actions to admin page
---
htdocs/admin/supplier_order.php | 5 ++++-
htdocs/admin/supplier_payment.php | 2 ++
htdocs/fourn/commande/card.php | 3 ++-
3 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/htdocs/admin/supplier_order.php b/htdocs/admin/supplier_order.php
index 7cf64e4800d..98fe1c391ce 100644
--- a/htdocs/admin/supplier_order.php
+++ b/htdocs/admin/supplier_order.php
@@ -132,6 +132,8 @@ if ($action == 'updateMask') {
if ($ret > 0) {
$ret = addDocumentModel($value, $type, $label, $scandir);
}
+} elseif ($action == 'unsetdoc') {
+ dolibarr_del_const($db, "COMMANDE_SUPPLIER_ADDON_PDF", $conf->entity);
} elseif ($action == 'setmod') {
// TODO Verifier si module numerotation choisi peut etre active
// par appel methode canBeActivated
@@ -397,7 +399,8 @@ foreach ($dirmodels as $reldir) {
// Default
print '';
if ($conf->global->COMMANDE_SUPPLIER_ADDON_PDF == "$name") {
- print img_picto($langs->trans("Default"), 'on');
+// print img_picto($langs->trans("Default"), 'on');
+ print 'scandir.'&label='.urlencode($module->name).'&type=order_supplier"" alt="'.$langs->trans("Disable").'">'.img_picto($langs->trans("Enabled"), 'on').' ';
} else {
print 'scandir.'&label='.urlencode($module->name).'&type=order_supplier"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').' ';
}
diff --git a/htdocs/admin/supplier_payment.php b/htdocs/admin/supplier_payment.php
index 3f79b52eff3..4482373a2bd 100644
--- a/htdocs/admin/supplier_payment.php
+++ b/htdocs/admin/supplier_payment.php
@@ -89,6 +89,8 @@ if ($action == 'updateMask') {
if ($ret > 0) {
$ret = addDocumentModel($value, $type, $label, $scandir);
}
+} elseif ($action == 'unsetdoc') {
+ dolibarr_del_const($db, "SUPPLIER_PAYMENT_ADDON_PDF", $conf->entity);
} elseif ($action == 'specimen') {
$modele = GETPOST('module', 'alpha');
diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php
index 6ea356e189e..8afb77a3437 100644
--- a/htdocs/fourn/commande/card.php
+++ b/htdocs/fourn/commande/card.php
@@ -2614,8 +2614,9 @@ if ($action == 'create') {
$urlsource = $_SERVER["PHP_SELF"]."?id=".$object->id;
$genallowed = $usercanread;
$delallowed = $usercancreate;
+ $modelpdf = (!empty($object->model_pdf) ? $object->model_pdf : (empty($conf->global->COMMANDE_SUPPLIER_ADDON_PDF) ? '' : $conf->global->COMMANDE_SUPPLIER_ADDON_PDF));
- print $formfile->showdocuments('commande_fournisseur', $objref, $filedir, $urlsource, $genallowed, $delallowed, $object->model_pdf, 1, 0, 0, 0, 0, '', '', '', $object->thirdparty->default_lang);
+ print $formfile->showdocuments('commande_fournisseur', $objref, $filedir, $urlsource, $genallowed, $delallowed, $modelpdf, 1, 0, 0, 0, 0, '', '', '', $object->thirdparty->default_lang);
$somethingshown = $formfile->numoffiles;
// Show links to link elements
From b48566eed853ab7a573d929c89edcea0184ec4ff Mon Sep 17 00:00:00 2001
From: stickler-ci
Date: Fri, 27 Aug 2021 08:27:04 +0000
Subject: [PATCH 089/953] Fixing style errors.
---
htdocs/admin/supplier_order.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/admin/supplier_order.php b/htdocs/admin/supplier_order.php
index 98fe1c391ce..26f0212f412 100644
--- a/htdocs/admin/supplier_order.php
+++ b/htdocs/admin/supplier_order.php
@@ -399,7 +399,7 @@ foreach ($dirmodels as $reldir) {
// Default
print '';
if ($conf->global->COMMANDE_SUPPLIER_ADDON_PDF == "$name") {
-// print img_picto($langs->trans("Default"), 'on');
+ // print img_picto($langs->trans("Default"), 'on');
print 'scandir.'&label='.urlencode($module->name).'&type=order_supplier"" alt="'.$langs->trans("Disable").'">'.img_picto($langs->trans("Enabled"), 'on').' ';
} else {
print 'scandir.'&label='.urlencode($module->name).'&type=order_supplier"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').' ';
From eb48566798f68bc90e330d6ae34301e09bd3e80e Mon Sep 17 00:00:00 2001
From: lmarcouiller
Date: Fri, 27 Aug 2021 10:40:33 +0200
Subject: [PATCH 090/953] Close #18074 : New /order/{id}/shipment get & post
---
htdocs/commande/class/api_orders.class.php | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index ed0cc3859d5..ca49b426a87 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -987,13 +987,18 @@ class Orders extends DolibarrApi
if (!DolibarrApiAccess::$user->rights->expedition->lire) {
throw new RestException(401);
}
+ $sql = "SELECT e.rowid";
+ $sql .= " FROM ".MAIN_DB_PREFIX."expedition as e";
+ $sql .= " JOIN ".MAIN_DB_PREFIX."expeditiondet as edet";
+ $sql .= " ON e.rowid = edet.fk_expedition";
+ $sql .= " JOIN ".MAIN_DB_PREFIX."commandedet as cdet";
+ $sql .= " ON edet.fk_origin_line = cdet.rowid";
+ $sql .= " JOIN ".MAIN_DB_PREFIX."commande as c";
+ $sql .= " ON cdet.fk_commande = c.rowid";
+ $sql .= " WHERE c.rowid = ".$this->db->escape($id);
+ $sql .= " GROUP BY e.rowid";
+ $sql .= $this->db->order("e.rowid", "ASC");
- $sql = "SELECT t.rowid";
- $sql .= " FROM ".MAIN_DB_PREFIX."expedition as t";
- $sql .= " JOIN ".MAIN_DB_PREFIX."expeditiondet as tdet";
- $sql .= " ON t.rowid = tdet.rowid";
- $sql .= " WHERE tdet.fk_origin_line = ".$id;
- $sql .= $this->db->order("t.rowid", "ASC");
dol_syslog("API Rest request");
$result = $this->db->query($sql);
From b9039eea143f5004fc9145554923b45e5570fa87 Mon Sep 17 00:00:00 2001
From: lmarcouiller
Date: Fri, 27 Aug 2021 10:45:04 +0200
Subject: [PATCH 091/953] FIx warehouse limit testing
---
htdocs/commande/class/api_orders.class.php | 3 +++
1 file changed, 3 insertions(+)
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index ca49b426a87..2510e793018 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -1043,6 +1043,9 @@ class Orders extends DolibarrApi
if (!DolibarrApiAccess::$user->rights->expedition->creer) {
throw new RestException(401);
}
+ if ($warehouse_id <= 0) {
+ throw new RestException(404, 'Warehouse not found');
+ }
$result = $this->commande->fetch($id);
if (!$result) {
throw new RestException(404, 'Order not found');
From ce7a301896320e321a2ba1caaf70fd320c742883 Mon Sep 17 00:00:00 2001
From: lmarcouiller
Date: Fri, 27 Aug 2021 11:48:56 +0200
Subject: [PATCH 092/953] Fix #18519 : Modulebuilder api permission
---
.../modulebuilder/template/class/api_mymodule.class.php | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/htdocs/modulebuilder/template/class/api_mymodule.class.php b/htdocs/modulebuilder/template/class/api_mymodule.class.php
index 2e04e34dcac..8b7718eac67 100644
--- a/htdocs/modulebuilder/template/class/api_mymodule.class.php
+++ b/htdocs/modulebuilder/template/class/api_mymodule.class.php
@@ -69,7 +69,7 @@ class MyModuleApi extends DolibarrApi
*/
public function get($id)
{
- if (!DolibarrApiAccess::$user->rights->mymodule->read) {
+ if (!DolibarrApiAccess::$user->rights->mymodule->myobject->read) {
throw new RestException(401);
}
@@ -194,7 +194,7 @@ class MyModuleApi extends DolibarrApi
*/
public function post($request_data = null)
{
- if (!DolibarrApiAccess::$user->rights->mymodule->write) {
+ if (!DolibarrApiAccess::$user->rights->mymodule->myobject->write) {
throw new RestException(401);
}
// Check mandatory fields
@@ -222,7 +222,7 @@ class MyModuleApi extends DolibarrApi
*/
public function put($id, $request_data = null)
{
- if (!DolibarrApiAccess::$user->rights->mymodule->write) {
+ if (!DolibarrApiAccess::$user->rights->mymodule->myobject->write) {
throw new RestException(401);
}
@@ -260,7 +260,7 @@ class MyModuleApi extends DolibarrApi
*/
public function delete($id)
{
- if (!DolibarrApiAccess::$user->rights->mymodule->delete) {
+ if (!DolibarrApiAccess::$user->rights->mymodule->myobject->delete) {
throw new RestException(401);
}
$result = $this->myobject->fetch($id);
From 4547de8d4a30473fa671dcb7c9a173baa76b5ff4 Mon Sep 17 00:00:00 2001
From: lmarcouiller
Date: Fri, 27 Aug 2021 12:16:59 +0200
Subject: [PATCH 093/953] New : api for knowledgemanagement
---
.../class/api_knowledgemanagement.class.php | 393 ++++++++++++++++++
1 file changed, 393 insertions(+)
create mode 100644 htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
diff --git a/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php b/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
new file mode 100644
index 00000000000..fefc4e8f73c
--- /dev/null
+++ b/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
@@ -0,0 +1,393 @@
+
+ * Copyright (C) 2021 SuperAdmin
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see .
+ */
+
+use Luracast\Restler\RestException;
+
+dol_include_once('/knowledgemanagement/class/knowledgerecord.class.php');
+
+
+
+/**
+ * \file knowledgemanagement/class/api_knowledgemanagement.class.php
+ * \ingroup knowledgemanagement
+ * \brief File for API management of knowledgerecord.
+ */
+
+/**
+ * API class for knowledgemanagement knowledgerecord
+ *
+ * @access protected
+ * @class DolibarrApiAccess {@requires user,external}
+ */
+class KnowledgeManagement extends DolibarrApi
+{
+ /**
+ * @var KnowledgeRecord $knowledgerecord {@type KnowledgeRecord}
+ */
+ public $knowledgerecord;
+
+ /**
+ * Constructor
+ *
+ * @url GET /
+ *
+ */
+ public function __construct()
+ {
+ global $db, $conf;
+ $this->db = $db;
+ $this->knowledgerecord = new KnowledgeRecord($this->db);
+ }
+
+ /**
+ * Get properties of a knowledgerecord object
+ *
+ * Return an array with knowledgerecord informations
+ *
+ * @param int $id ID of knowledgerecord
+ * @return array|mixed data without useless information
+ *
+ * @url GET knowledgerecords/{id}
+ *
+ * @throws RestException 401 Not allowed
+ * @throws RestException 404 Not found
+ */
+ public function get($id)
+ {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->read) {
+ throw new RestException(401);
+ }
+
+ $result = $this->knowledgerecord->fetch($id);
+ if (!$result) {
+ throw new RestException(404, 'KnowledgeRecord not found');
+ }
+
+ if (!DolibarrApi::_checkAccessToResource('knowledgerecord', $this->knowledgerecord->id, 'knowledgemanagement_knowledgerecord')) {
+ throw new RestException(401, 'Access to instance id='.$this->knowledgerecord->id.' of object not allowed for login '.DolibarrApiAccess::$user->login);
+ }
+
+ return $this->_cleanObjectDatas($this->knowledgerecord);
+ }
+
+
+ /**
+ * List knowledgerecords
+ *
+ * Get a list of knowledgerecords
+ *
+ * @param string $sortfield Sort field
+ * @param string $sortorder Sort order
+ * @param int $limit Limit for list
+ * @param int $page Page number
+ * @param string $sqlfilters Other criteria to filter answers separated by a comma. Syntax example "(t.ref:like:'SO-%') and (t.date_creation:<:'20160101')"
+ * @return array Array of order objects
+ *
+ * @throws RestException
+ *
+ * @url GET /knowledgerecords/
+ */
+ public function index($sortfield = "t.rowid", $sortorder = 'ASC', $limit = 100, $page = 0, $sqlfilters = '')
+ {
+ global $db, $conf;
+
+ $obj_ret = array();
+ $tmpobject = new KnowledgeRecord($this->db);
+
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->knowledgerecord->read) {
+ throw new RestException(401);
+ }
+
+ $socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : '';
+
+ $restrictonsocid = 0; // Set to 1 if there is a field socid in table of object
+
+ // If the internal user must only see his customers, force searching by him
+ $search_sale = 0;
+ if ($restrictonsocid && !DolibarrApiAccess::$user->rights->societe->client->voir && !$socid) {
+ $search_sale = DolibarrApiAccess::$user->id;
+ }
+
+ $sql = "SELECT t.rowid";
+ if ($restrictonsocid && (!DolibarrApiAccess::$user->rights->societe->client->voir && !$socid) || $search_sale > 0) {
+ $sql .= ", sc.fk_soc, sc.fk_user"; // We need these fields in order to filter by sale (including the case where the user can only see his prospects)
+ }
+ $sql .= " FROM ".MAIN_DB_PREFIX.$tmpobject->table_element." as t";
+
+ if ($restrictonsocid && (!DolibarrApiAccess::$user->rights->societe->client->voir && !$socid) || $search_sale > 0) {
+ $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc"; // We need this table joined to the select in order to filter by sale
+ }
+ $sql .= " WHERE 1 = 1";
+
+ // Example of use $mode
+ //if ($mode == 1) $sql.= " AND s.client IN (1, 3)";
+ //if ($mode == 2) $sql.= " AND s.client IN (2, 3)";
+
+ if ($tmpobject->ismultientitymanaged) {
+ $sql .= ' AND t.entity IN ('.getEntity($tmpobject->element).')';
+ }
+ if ($restrictonsocid && (!DolibarrApiAccess::$user->rights->societe->client->voir && !$socid) || $search_sale > 0) {
+ $sql .= " AND t.fk_soc = sc.fk_soc";
+ }
+ if ($restrictonsocid && $socid) {
+ $sql .= " AND t.fk_soc = ".((int) $socid);
+ }
+ if ($restrictonsocid && $search_sale > 0) {
+ $sql .= " AND t.rowid = sc.fk_soc"; // Join for the needed table to filter by sale
+ }
+ // Insert sale filter
+ if ($restrictonsocid && $search_sale > 0) {
+ $sql .= " AND sc.fk_user = ".((int) $search_sale);
+ }
+ if ($sqlfilters) {
+ if (!DolibarrApi::_checkFilters($sqlfilters)) {
+ throw new RestException(503, 'Error when validating parameter sqlfilters '.$sqlfilters);
+ }
+ $regexstring = '\(([^:\'\(\)]+:[^:\'\(\)]+:[^\(\)]+)\)';
+ $sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
+ }
+
+ $sql .= $this->db->order($sortfield, $sortorder);
+ if ($limit) {
+ if ($page < 0) {
+ $page = 0;
+ }
+ $offset = $limit * $page;
+
+ $sql .= $this->db->plimit($limit + 1, $offset);
+ }
+
+ $result = $this->db->query($sql);
+ $i = 0;
+ if ($result) {
+ $num = $this->db->num_rows($result);
+ while ($i < $num) {
+ $obj = $this->db->fetch_object($result);
+ $tmp_object = new KnowledgeRecord($this->db);
+ if ($tmp_object->fetch($obj->rowid)) {
+ $obj_ret[] = $this->_cleanObjectDatas($tmp_object);
+ }
+ $i++;
+ }
+ } else {
+ throw new RestException(503, 'Error when retrieving knowledgerecord list: '.$this->db->lasterror());
+ }
+ if (!count($obj_ret)) {
+ throw new RestException(404, 'No knowledgerecord found');
+ }
+ return $obj_ret;
+ }
+
+ /**
+ * Create knowledgerecord object
+ *
+ * @param array $request_data Request datas
+ * @return int ID of knowledgerecord
+ *
+ * @throws RestException
+ *
+ * @url POST knowledgerecords/
+ */
+ public function post($request_data = null)
+ {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->write) {
+ throw new RestException(401);
+ }
+
+ // Check mandatory fields
+ $result = $this->_validate($request_data);
+
+ foreach ($request_data as $field => $value) {
+ $this->knowledgerecord->$field = $this->_checkValForAPI($field, $value, $this->knowledgerecord);
+ }
+
+ // Clean data
+ // $this->knowledgerecord->abc = checkVal($this->knowledgerecord->abc, 'alphanohtml');
+
+ if ($this->knowledgerecord->create(DolibarrApiAccess::$user)<0) {
+ throw new RestException(500, "Error creating KnowledgeRecord", array_merge(array($this->knowledgerecord->error), $this->knowledgerecord->errors));
+ }
+ return $this->knowledgerecord->id;
+ }
+
+ /**
+ * Update knowledgerecord
+ *
+ * @param int $id Id of knowledgerecord to update
+ * @param array $request_data Datas
+ * @return int
+ *
+ * @throws RestException
+ *
+ * @url PUT knowledgerecords/{id}
+ */
+ public function put($id, $request_data = null)
+ {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->write) {
+ throw new RestException(401);
+ }
+
+ $result = $this->knowledgerecord->fetch($id);
+ if (!$result) {
+ throw new RestException(404, 'KnowledgeRecord not found');
+ }
+
+ if (!DolibarrApi::_checkAccessToResource('knowledgerecord', $this->knowledgerecord->id, 'knowledgemanagement_knowledgerecord')) {
+ throw new RestException(401, 'Access to instance id='.$this->knowledgerecord->id.' of object not allowed for login '.DolibarrApiAccess::$user->login);
+ }
+
+ foreach ($request_data as $field => $value) {
+ if ($field == 'id') {
+ continue;
+ }
+ $this->knowledgerecord->$field = $this->_checkValForAPI($field, $value, $this->knowledgerecord);
+ }
+
+ // Clean data
+ // $this->knowledgerecord->abc = checkVal($this->knowledgerecord->abc, 'alphanohtml');
+
+ if ($this->knowledgerecord->update(DolibarrApiAccess::$user, false) > 0) {
+ return $this->get($id);
+ } else {
+ throw new RestException(500, $this->knowledgerecord->error);
+ }
+ }
+
+ /**
+ * Delete knowledgerecord
+ *
+ * @param int $id KnowledgeRecord ID
+ * @return array
+ *
+ * @throws RestException
+ *
+ * @url DELETE knowledgerecords/{id}
+ */
+ public function delete($id)
+ {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->delete) {
+ throw new RestException(401);
+ }
+ $result = $this->knowledgerecord->fetch($id);
+ if (!$result) {
+ throw new RestException(404, 'KnowledgeRecord not found');
+ }
+
+ if (!DolibarrApi::_checkAccessToResource('knowledgerecord', $this->knowledgerecord->id, 'knowledgemanagement_knowledgerecord')) {
+ throw new RestException(401, 'Access to instance id='.$this->knowledgerecord->id.' of object not allowed for login '.DolibarrApiAccess::$user->login);
+ }
+
+ if (!$this->knowledgerecord->delete(DolibarrApiAccess::$user)) {
+ throw new RestException(500, 'Error when deleting KnowledgeRecord : '.$this->knowledgerecord->error);
+ }
+
+ return array(
+ 'success' => array(
+ 'code' => 200,
+ 'message' => 'KnowledgeRecord deleted'
+ )
+ );
+ }
+
+
+ // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
+ /**
+ * Clean sensible object datas
+ *
+ * @param Object $object Object to clean
+ * @return Object Object with cleaned properties
+ */
+ protected function _cleanObjectDatas($object)
+ {
+ // phpcs:enable
+ $object = parent::_cleanObjectDatas($object);
+
+ unset($object->rowid);
+ unset($object->canvas);
+
+ /*unset($object->name);
+ unset($object->lastname);
+ unset($object->firstname);
+ unset($object->civility_id);
+ unset($object->statut);
+ unset($object->state);
+ unset($object->state_id);
+ unset($object->state_code);
+ unset($object->region);
+ unset($object->region_code);
+ unset($object->country);
+ unset($object->country_id);
+ unset($object->country_code);
+ unset($object->barcode_type);
+ unset($object->barcode_type_code);
+ unset($object->barcode_type_label);
+ unset($object->barcode_type_coder);
+ unset($object->total_ht);
+ unset($object->total_tva);
+ unset($object->total_localtax1);
+ unset($object->total_localtax2);
+ unset($object->total_ttc);
+ unset($object->fk_account);
+ unset($object->comments);
+ unset($object->note);
+ unset($object->mode_reglement_id);
+ unset($object->cond_reglement_id);
+ unset($object->cond_reglement);
+ unset($object->shipping_method_id);
+ unset($object->fk_incoterms);
+ unset($object->label_incoterms);
+ unset($object->location_incoterms);
+ */
+
+ // If object has lines, remove $db property
+ if (isset($object->lines) && is_array($object->lines) && count($object->lines) > 0) {
+ $nboflines = count($object->lines);
+ for ($i = 0; $i < $nboflines; $i++) {
+ $this->_cleanObjectDatas($object->lines[$i]);
+
+ unset($object->lines[$i]->lines);
+ unset($object->lines[$i]->note);
+ }
+ }
+
+ return $object;
+ }
+
+ /**
+ * Validate fields before create or update object
+ *
+ * @param array $data Array of data to validate
+ * @return array
+ *
+ * @throws RestException
+ */
+ private function _validate($data)
+ {
+ $knowledgerecord = array();
+ foreach ($this->knowledgerecord->fields as $field => $propfield) {
+ if (in_array($field, array('rowid', 'entity', 'date_creation', 'tms', 'fk_user_creat')) || $propfield['notnull'] != 1) {
+ continue; // Not a mandatory field
+ }
+ if (!isset($data[$field])) {
+ throw new RestException(400, "$field field missing");
+ }
+ $knowledgerecord[$field] = $data[$field];
+ }
+ return $knowledgerecord;
+ }
+}
From 1bdfad9c299203354478239b64b3b870b12cde72 Mon Sep 17 00:00:00 2001
From: lmarcouiller
Date: Fri, 27 Aug 2021 12:19:28 +0200
Subject: [PATCH 094/953] fix permissions api for knowledgemanagement
---
.../class/api_knowledgemanagement.class.php | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php b/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
index fefc4e8f73c..16429060a17 100644
--- a/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
+++ b/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
@@ -69,7 +69,7 @@ class KnowledgeManagement extends DolibarrApi
*/
public function get($id)
{
- if (!DolibarrApiAccess::$user->rights->knowledgemanagement->read) {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->knowledgerecord->read) {
throw new RestException(401);
}
@@ -205,7 +205,7 @@ class KnowledgeManagement extends DolibarrApi
*/
public function post($request_data = null)
{
- if (!DolibarrApiAccess::$user->rights->knowledgemanagement->write) {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->knowledgerecord->write) {
throw new RestException(401);
}
@@ -238,7 +238,7 @@ class KnowledgeManagement extends DolibarrApi
*/
public function put($id, $request_data = null)
{
- if (!DolibarrApiAccess::$user->rights->knowledgemanagement->write) {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->knowledgerecord->write) {
throw new RestException(401);
}
@@ -280,7 +280,7 @@ class KnowledgeManagement extends DolibarrApi
*/
public function delete($id)
{
- if (!DolibarrApiAccess::$user->rights->knowledgemanagement->delete) {
+ if (!DolibarrApiAccess::$user->rights->knowledgemanagement->knowledgerecord->delete) {
throw new RestException(401);
}
$result = $this->knowledgerecord->fetch($id);
From 9752501ef606326fc605fd02dec1726544729ff2 Mon Sep 17 00:00:00 2001
From: Christian Foellmann
Date: Fri, 27 Aug 2021 15:32:53 +0200
Subject: [PATCH 095/953] change links for thirdparty to target the type
customer|supplier tab
---
htdocs/commande/card.php | 4 ++--
htdocs/contrat/card.php | 4 ++--
htdocs/fourn/commande/card.php | 6 +++---
htdocs/fourn/facture/card.php | 4 ++--
htdocs/supplier_proposal/card.php | 4 ++--
5 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php
index 004b5a3c205..58a8edb67e7 100644
--- a/htdocs/commande/card.php
+++ b/htdocs/commande/card.php
@@ -1568,7 +1568,7 @@ if ($action == 'create' && $usercancreate) {
print ''.$langs->trans('Customer').' ';
if ($socid > 0) {
print '';
- print $soc->getNomUrl(1);
+ print $soc->getNomUrl(1, 'customer');
print ' ';
print ' ';
} else {
@@ -2014,7 +2014,7 @@ if ($action == 'create' && $usercancreate) {
$morehtmlref .= $form->editfieldkey("RefCustomer", 'ref_client', $object->ref_client, $object, $usercancreate, 'string', '', 0, 1);
$morehtmlref .= $form->editfieldval("RefCustomer", 'ref_client', $object->ref_client, $object, $usercancreate, 'string', '', null, null, '', 1);
// Thirdparty
- $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$soc->getNomUrl(1);
+ $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$soc->getNomUrl(1, 'customer');
if (empty($conf->global->MAIN_DISABLE_OTHER_LINK) && $object->thirdparty->id > 0) {
$morehtmlref .= ' ('.$langs->trans("OtherOrders").' )';
}
diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php
index 470895a2c22..d07176d1670 100644
--- a/htdocs/contrat/card.php
+++ b/htdocs/contrat/card.php
@@ -1089,7 +1089,7 @@ if ($action == 'create') {
print ''.$langs->trans('ThirdParty').' ';
if ($socid > 0) {
print '';
- print $soc->getNomUrl(1);
+ print $soc->getNomUrl(1, 'customer');
print ' ';
print ' ';
} else {
@@ -1296,7 +1296,7 @@ if ($action == 'create') {
$morehtmlref .= $form->editfieldkey("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $user->rights->contrat->creer, 'string', '', 0, 1);
$morehtmlref .= $form->editfieldval("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $user->rights->contrat->creer, 'string', '', null, null, '', 1, 'getFormatedSupplierRef');
// Thirdparty
- $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1);
+ $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1, 'customer');
if (empty($conf->global->MAIN_DISABLE_OTHER_LINK) && $object->thirdparty->id > 0) {
$morehtmlref .= ' ('.$langs->trans("OtherContracts").' )';
}
diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php
index 6ea356e189e..71268635ffb 100644
--- a/htdocs/fourn/commande/card.php
+++ b/htdocs/fourn/commande/card.php
@@ -1617,7 +1617,7 @@ if ($action == 'create') {
print '';
if ($societe->id > 0) {
- print $societe->getNomUrl(1);
+ print $societe->getNomUrl(1, 'supplier');
print ' ';
} else {
print img_picto('', 'company').$form->select_company((empty($socid) ? '' : $socid), 'socid', 's.fournisseur=1', 'SelectThirdParty', 0, 0, null, 0, 'minwidth300');
@@ -1743,7 +1743,7 @@ if ($action == 'create') {
print ' ';
$newclassname = $classname;
- print ' '.$langs->trans($newclassname).' '.$objectsrc->getNomUrl(1).' ';
+ print ''.$langs->trans($newclassname).' '.$objectsrc->getNomUrl(1, 'supplier').' ';
print ''.$langs->trans('AmountHT').' '.price($objectsrc->total_ht).' ';
print ''.$langs->trans('AmountVAT').' '.price($objectsrc->total_tva)." ";
if ($mysoc->localtax1_assuj == "1" || $objectsrc->total_localtax1 != 0) { // Localtax1 RE
@@ -1966,7 +1966,7 @@ if ($action == 'create') {
if (!empty($conf->global->MAIN_CAN_EDIT_SUPPLIER_ON_SUPPLIER_ORDER) && $object->statut == CommandeFournisseur::STATUS_DRAFT) {
$morehtmlref .= ''.img_edit($langs->transnoentitiesnoconv('SetThirdParty')).' ';
}
- $morehtmlref .= ' : '.$object->thirdparty->getNomUrl(1);
+ $morehtmlref .= ' : '.$object->thirdparty->getNomUrl(1, 'supplier');
if (empty($conf->global->MAIN_DISABLE_OTHER_LINK) && $object->thirdparty->id > 0) {
$morehtmlref .= ' ('.$langs->trans("OtherOrders").' )';
}
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index ae0d306b2cd..7f24223f912 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -1927,7 +1927,7 @@ if ($action == 'create') {
if ($societe->id > 0) {
$absolute_discount = $societe->getAvailableDiscounts('', '', 0, 1);
- print $societe->getNomUrl(1);
+ print $societe->getNomUrl(1, 'supplier');
print ' ';
} else {
print img_picto('', 'company').$form->select_company($societe->id, 'socid', 's.fournisseur=1', 'SelectThirdParty', 0, 0, null, 0, 'minwidth300 widthcentpercentminusxx');
@@ -2629,7 +2629,7 @@ if ($action == 'create') {
$morehtmlref .= $form->editfieldkey("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $usercancreate, 'string', '', 0, 1);
$morehtmlref .= $form->editfieldval("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $usercancreate, 'string', '', null, null, '', 1);
// Thirdparty
- $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1);
+ $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1, 'supplier');
if (empty($conf->global->MAIN_DISABLE_OTHER_LINK) && $object->thirdparty->id > 0) {
$morehtmlref .= ' ('.$langs->trans("OtherBills").' )';
}
diff --git a/htdocs/supplier_proposal/card.php b/htdocs/supplier_proposal/card.php
index cc553555b5b..75cd0e9ccc0 100644
--- a/htdocs/supplier_proposal/card.php
+++ b/htdocs/supplier_proposal/card.php
@@ -1126,7 +1126,7 @@ if ($action == 'create') {
print ''.$langs->trans('Supplier').' ';
if ($socid > 0) {
print '';
- print $soc->getNomUrl(1);
+ print $soc->getNomUrl(1, 'supplier');
print ' ';
print ' ';
} else {
@@ -1437,7 +1437,7 @@ if ($action == 'create') {
//$morehtmlref.=$form->editfieldkey("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $usercancreateorder, 'string', '', 0, 1);
//$morehtmlref.=$form->editfieldval("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $usercancreateorder, 'string', '', null, null, '', 1);
// Thirdparty
- $morehtmlref .= $langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1);
+ $morehtmlref .= $langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1, 'supplier');
if (empty($conf->global->MAIN_DISABLE_OTHER_LINK) && $object->thirdparty->id > 0) {
$morehtmlref .= ' ('.$langs->trans("OtherProposals").' )';
}
From 53b230a96863dccf4240f269d987ba2de8054d8d Mon Sep 17 00:00:00 2001
From: Ilias Patsiaouras
Date: Fri, 27 Aug 2021 15:38:15 +0200
Subject: [PATCH 096/953] wip
---
.../class/emailcollector.class.php | 65 ++++++++++++++++++-
1 file changed, 62 insertions(+), 3 deletions(-)
diff --git a/htdocs/emailcollector/class/emailcollector.class.php b/htdocs/emailcollector/class/emailcollector.class.php
index 16df7774470..df91076be4e 100644
--- a/htdocs/emailcollector/class/emailcollector.class.php
+++ b/htdocs/emailcollector/class/emailcollector.class.php
@@ -30,6 +30,38 @@ require_once DOL_DOCUMENT_ROOT.'/compta/facture/class/facture.class.php';
require_once DOL_DOCUMENT_ROOT.'/ticket/class/ticket.class.php';
require_once DOL_DOCUMENT_ROOT.'/recruitment/class/recruitmentcandidature.class.php';
+require_once DOL_DOCUMENT_ROOT.'/comm/propal/class/propal.class.php'; // customer proposal
+require_once DOL_DOCUMENT_ROOT.'/commande/class/commande.class.php'; // customer order
+require_once DOL_DOCUMENT_ROOT.'/expedition/class/expedition.class.php'; // Shipment
+require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.facture.class.php'; // supplier invoice
+require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.commande.class.php'; // supplier order
+include_once DOL_DOCUMENT_ROOT.'/supplier_proposal/class/supplier_proposal.class.php'; // supplier proposal
+require_once DOL_DOCUMENT_ROOT."/reception/class/reception.class.php"; // reception
+//require_once DOL_DOCUMENT_ROOT.'/holiday/class/holiday.class.php'; // Holidays (leave request)
+//require_once DOL_DOCUMENT_ROOT.'/expensereport/class/expensereport.class.php'; // expernse report
+/*
+if (!empty($conf->propal->enabled)) {
+}
+if (!empty($conf->commande->enabled)) {
+}
+if (!empty($conf->expedition->enabled)) {
+}
+if (!empty($conf->facture->enabled)) {
+ require_once DOL_DOCUMENT_ROOT.'/compta/facture/class/facture.class.php';
+}
+if (!empty($conf->facture->enabled)) {
+ require_once DOL_DOCUMENT_ROOT.'/compta/facture/class/facture-rec.class.php';
+}
+if (!empty($conf->contrat->enabled)) {
+ require_once DOL_DOCUMENT_ROOT.'/contrat/class/contrat.class.php';
+}
+if (!empty($conf->adherent->enabled)) {
+ require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php';
+}
+if (!empty($conf->ficheinter->enabled)) { //files
+ require_once DOL_DOCUMENT_ROOT.'/fichinter/class/fichinter.class.php';
+}*/
+
/**
* Class for EmailCollector
@@ -1415,8 +1447,8 @@ class EmailCollector extends CommonObject
$reg = array();
if (!empty($headers['References'])) {
$arrayofreferences = preg_split('/(,|\s+)/', $headers['References']);
- //var_dump($headers['References']);
- //var_dump($arrayofreferences);
+ // var_dump($headers['References']);
+ // var_dump($arrayofreferences);
foreach ($arrayofreferences as $reference) {
//print "Process mail ".$iforemailloop." email_msgid ".$msgid.", date ".dol_print_date($date, 'dayhour').", subject ".$subject.", reference ".dol_escape_htmltag($reference)." \n";
@@ -1432,8 +1464,29 @@ class EmailCollector extends CommonObject
if ($reg[1] == 'ctc') {
$objectemail = new Contact($this->db);
}
- if ($reg[1] == 'inv') {
+ if ($reg[1] == 'inv') { // customer invoices
$objectemail = new Facture($this->db);
+ }
+ if ($reg[1] == 'sinv') { // supplier invoices
+ $objectemail = new FactureFournisseur($this->db);
+ }
+ if ($reg[1] == 'pro') { // customer proposals
+ $objectemail = new Propal($this->db);
+ }
+ if ($reg[1] == 'ord') { // customer orders
+ $objectemail = new Commande($this->db);
+ }
+ if ($reg[1] == 'shi') { // shipments
+ $objectemail = new Expedition($this->db);
+ }
+ if ($reg[1] == 'spro') { // supplier proposal
+ $objectemail = new SupplierProposal($this->db);
+ }
+ if ($reg[1] == 'sord') { // supplier order
+ $objectemail = new CommandeFournisseur($this->db);
+ }
+ if ($reg[1] == 'rec') { // Reception
+ $objectemail = new Reception($this->db);
}
if ($reg[1] == 'proj') {
$objectemail = new Project($this->db);
@@ -1456,6 +1509,12 @@ class EmailCollector extends CommonObject
if ($reg[1] == 'mem') {
$objectemail = new Adherent($this->db);
}
+ /*if ($reg[1] == 'leav') {
+ $objectemail = new Holiday($db);
+ }
+ if ($reg[1] == 'exp') {
+ $objectemail = new ExpenseReport($db);
+ }*/
} elseif (preg_match('/<(.*@.*)>/', $reference, $reg)) {
// This is an external reference, we check if we have it in our database
if (!is_object($objectemail)) {
From 2263c66754d3bfb00c99f16d0a95131a625c13ef Mon Sep 17 00:00:00 2001
From: stickler-ci
Date: Fri, 27 Aug 2021 13:43:06 +0000
Subject: [PATCH 097/953] Fixing style errors.
---
htdocs/emailcollector/class/emailcollector.class.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/emailcollector/class/emailcollector.class.php b/htdocs/emailcollector/class/emailcollector.class.php
index df91076be4e..88cb4bcc1d2 100644
--- a/htdocs/emailcollector/class/emailcollector.class.php
+++ b/htdocs/emailcollector/class/emailcollector.class.php
@@ -1466,7 +1466,7 @@ class EmailCollector extends CommonObject
}
if ($reg[1] == 'inv') { // customer invoices
$objectemail = new Facture($this->db);
- }
+ }
if ($reg[1] == 'sinv') { // supplier invoices
$objectemail = new FactureFournisseur($this->db);
}
From 2f225ee7e5f387439d1e42e21f0e162e2246991c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Fri, 27 Aug 2021 16:33:03 +0200
Subject: [PATCH 098/953] Clean code by adding cast int.
---
.../class/accountingaccount.class.php | 4 +-
.../accountancy/class/bookkeeping.class.php | 8 ++--
htdocs/accountancy/journal/bankjournal.php | 6 +--
htdocs/adherents/class/adherent.class.php | 22 ++++-----
.../adherents/class/adherent_type.class.php | 24 +++++-----
htdocs/adherents/class/subscription.class.php | 2 +-
htdocs/admin/paymentbybanktransfer.php | 4 +-
htdocs/admin/prelevement.php | 4 +-
htdocs/categories/class/categorie.class.php | 8 ++--
htdocs/comm/action/card.php | 8 ++--
htdocs/comm/action/class/actioncomm.class.php | 6 +--
htdocs/comm/mailing/card.php | 4 +-
htdocs/comm/mailing/cibles.php | 4 +-
htdocs/comm/mailing/class/mailing.class.php | 10 ++--
htdocs/comm/multiprix.php | 2 +-
htdocs/comm/remise.php | 4 +-
htdocs/comm/remx.php | 24 +++++-----
htdocs/compta/bank/class/account.class.php | 10 ++--
htdocs/compta/bank/class/bankcateg.class.php | 4 +-
.../deplacement/class/deplacement.class.php | 2 +-
htdocs/compta/facture/card.php | 4 +-
.../facture/class/paymentterm.class.php | 4 +-
htdocs/compta/facture/prelevement.php | 16 +++----
.../cheque/class/remisecheque.class.php | 4 +-
.../compta/paiement/class/paiement.class.php | 4 +-
.../class/bonprelevement.class.php | 46 ++++++++++---------
.../sociales/class/chargesociales.class.php | 4 +-
htdocs/compta/tva/class/tva.class.php | 4 +-
htdocs/contrat/class/contrat.class.php | 2 +-
htdocs/core/class/commonincoterm.class.php | 2 +-
htdocs/core/class/commonobject.class.php | 6 +--
htdocs/core/class/discount.class.php | 4 +-
htdocs/core/class/link.class.php | 4 +-
htdocs/delivery/class/delivery.class.php | 8 ++--
htdocs/ecm/class/ecmdirectory.class.php | 4 +-
.../class/conferenceorboothattendee.class.php | 2 +-
htdocs/expedition/class/expedition.class.php | 12 ++---
.../class/expensereport.class.php | 8 ++--
htdocs/fichinter/class/fichinter.class.php | 8 ++--
htdocs/fichinter/class/fichinterrec.class.php | 2 +-
.../fourn/class/fournisseur.facture.class.php | 4 +-
htdocs/hrm/class/establishment.class.php | 2 +-
htdocs/loan/class/loan.class.php | 6 +--
htdocs/mrp/class/mo.class.php | 2 +-
.../partnership/class/partnership.class.php | 4 +-
htdocs/product/class/product.class.php | 2 +-
.../class/price_expression.class.php | 2 +-
.../class/price_global_variable.class.php | 2 +-
.../price_global_variable_updater.class.php | 6 +--
htdocs/product/stock/class/entrepot.class.php | 2 +-
htdocs/projet/class/project.class.php | 2 +-
htdocs/projet/class/task.class.php | 2 +-
htdocs/reception/class/reception.class.php | 10 ++--
.../class/recruitmentcandidature.class.php | 2 +-
.../class/recruitmentjobposition.class.php | 4 +-
htdocs/salaries/class/salary.class.php | 4 +-
.../class/companybankaccount.class.php | 2 +-
htdocs/societe/class/societe.class.php | 8 ++--
htdocs/ticket/class/ticket.class.php | 8 ++--
htdocs/user/class/userbankaccount.class.php | 2 +-
.../workstation/class/workstation.class.php | 2 +-
test/phpunit/CodingPhpTest.php | 6 +--
62 files changed, 198 insertions(+), 194 deletions(-)
diff --git a/htdocs/accountancy/class/accountingaccount.class.php b/htdocs/accountancy/class/accountingaccount.class.php
index 99a0dc0dc48..3c95af8afee 100644
--- a/htdocs/accountancy/class/accountingaccount.class.php
+++ b/htdocs/accountancy/class/accountingaccount.class.php
@@ -374,10 +374,10 @@ class AccountingAccount extends CommonObject
global $langs;
$sql = "(SELECT fk_code_ventilation FROM ".MAIN_DB_PREFIX."facturedet";
- $sql .= " WHERE fk_code_ventilation=".$this->id.")";
+ $sql .= " WHERE fk_code_ventilation=".((int) $this->id).")";
$sql .= "UNION";
$sql .= " (SELECT fk_code_ventilation FROM ".MAIN_DB_PREFIX."facture_fourn_det";
- $sql .= " WHERE fk_code_ventilation=".$this->id.")";
+ $sql .= " WHERE fk_code_ventilation=".((int) $this->id).")";
dol_syslog(get_class($this)."::checkUsage sql=".$sql, LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php
index 2c715aa9fd6..0ea00c9c98c 100644
--- a/htdocs/accountancy/class/bookkeeping.class.php
+++ b/htdocs/accountancy/class/bookkeeping.class.php
@@ -390,7 +390,7 @@ class BookKeeping extends CommonObject
$sql .= ", '".$this->db->idate($now)."'";
$sql .= ", '".$this->db->escape($this->code_journal)."'";
$sql .= ", ".(!empty($this->journal_label) ? ("'".$this->db->escape($this->journal_label)."'") : "NULL");
- $sql .= ", ".$this->db->escape($this->piece_num);
+ $sql .= ", ".((int) $this->piece_num);
$sql .= ", ".(!isset($this->entity) ? $conf->entity : $this->entity);
$sql .= ")";
@@ -1348,7 +1348,7 @@ class BookKeeping extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element.$mode;
$sql .= ' SET '.$field.'='.(is_numeric($value) ? $value : "'".$this->db->escape($value)."'");
- $sql .= " WHERE piece_num = '".$this->db->escape($piece_num)."'";
+ $sql .= " WHERE piece_num = ".((int) $piece_num);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -1637,7 +1637,7 @@ class BookKeeping extends CommonObject
$sql .= ", date_export";
}
$sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element.$mode;
- $sql .= " WHERE piece_num = ".$piecenum;
+ $sql .= " WHERE piece_num = ".((int) $piecenum);
$sql .= " AND entity IN (".getEntity('accountancy').")";
dol_syslog(__METHOD__, LOG_DEBUG);
@@ -1718,7 +1718,7 @@ class BookKeeping extends CommonObject
$sql .= ", date_export";
}
$sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element.$mode;
- $sql .= " WHERE piece_num = ".$piecenum;
+ $sql .= " WHERE piece_num = ".((int) $piecenum);
$sql .= " AND entity IN (".getEntity('accountancy').")";
dol_syslog(__METHOD__, LOG_DEBUG);
diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php
index bdda4583d54..d05135e7a67 100644
--- a/htdocs/accountancy/journal/bankjournal.php
+++ b/htdocs/accountancy/journal/bankjournal.php
@@ -364,10 +364,10 @@ if ($result) {
// Note: We have the social contribution id, it can be faster to get accounting code from social contribution id.
$sqlmid = 'SELECT cchgsoc.accountancy_code';
$sqlmid .= " FROM ".MAIN_DB_PREFIX."c_chargesociales cchgsoc";
- $sqlmid .= " INNER JOIN ".MAIN_DB_PREFIX."chargesociales as chgsoc ON chgsoc.fk_type=cchgsoc.id";
- $sqlmid .= " INNER JOIN ".MAIN_DB_PREFIX."paiementcharge as paycharg ON paycharg.fk_charge=chgsoc.rowid";
+ $sqlmid .= " INNER JOIN ".MAIN_DB_PREFIX."chargesociales as chgsoc ON chgsoc.fk_type = cchgsoc.id";
+ $sqlmid .= " INNER JOIN ".MAIN_DB_PREFIX."paiementcharge as paycharg ON paycharg.fk_charge = chgsoc.rowid";
$sqlmid .= " INNER JOIN ".MAIN_DB_PREFIX."bank_url as bkurl ON bkurl.url_id=paycharg.rowid AND bkurl.type = 'payment_sc'";
- $sqlmid .= " WHERE bkurl.fk_bank=".$obj->rowid;
+ $sqlmid .= " WHERE bkurl.fk_bank = ".((int) $obj->rowid);
dol_syslog("accountancy/journal/bankjournal.php:: sqlmid=".$sqlmid, LOG_DEBUG);
$resultmid = $db->query($sqlmid);
diff --git a/htdocs/adherents/class/adherent.class.php b/htdocs/adherents/class/adherent.class.php
index 2d5eae90938..75470b32173 100644
--- a/htdocs/adherents/class/adherent.class.php
+++ b/htdocs/adherents/class/adherent.class.php
@@ -774,7 +774,7 @@ class Adherent extends CommonObject
// Remove links to user and replace with new one
if (!$error) {
dol_syslog(get_class($this)."::update update link to user");
- $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member = NULL WHERE fk_member = ".$this->id;
+ $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member = NULL WHERE fk_member = ".((int) $this->id);
dol_syslog(get_class($this)."::update", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -784,7 +784,7 @@ class Adherent extends CommonObject
}
// If there is a user linked to this member
if ($this->user_id > 0) {
- $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member = ".$this->id." WHERE rowid = ".$this->user_id;
+ $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member = ".((int) $this->id)." WHERE rowid = ".((int) $this->user_id);
dol_syslog(get_class($this)."::update", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -926,7 +926,7 @@ class Adherent extends CommonObject
// Search for last subscription id and end date
$sql = "SELECT rowid, datec as dateop, dateadh as datedeb, datef as datefin";
$sql .= " FROM ".MAIN_DB_PREFIX."subscription";
- $sql .= " WHERE fk_adherent=".$this->id;
+ $sql .= " WHERE fk_adherent = ".((int) $this->id);
$sql .= " ORDER by dateadh DESC"; // Sort by start subscription date
dol_syslog(get_class($this)."::update_end_date", LOG_DEBUG);
@@ -939,7 +939,7 @@ class Adherent extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."adherent SET";
$sql .= " datefin=".($datefin != '' ? "'".$this->db->idate($datefin)."'" : "null");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update_end_date", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1100,7 +1100,7 @@ class Adherent extends CommonObject
} else {
$sql .= ", pass = '".$this->db->escape($password_indatabase)."'";
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
//dol_syslog("Adherent::Password sql=hidden");
dol_syslog(get_class($this)."::setPassword", LOG_DEBUG);
@@ -1223,7 +1223,7 @@ class Adherent extends CommonObject
// Add link to third party for current member
$sql = "UPDATE ".MAIN_DB_PREFIX."adherent SET fk_soc = ".($thirdpartyid > 0 ? $thirdpartyid : 'null');
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setThirdPartyId", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1465,7 +1465,7 @@ class Adherent extends CommonObject
$sql .= " c.dateadh as dateh,";
$sql .= " c.datef as datef";
$sql .= " FROM ".MAIN_DB_PREFIX."subscription as c";
- $sql .= " WHERE c.fk_adherent = ".$this->id;
+ $sql .= " WHERE c.fk_adherent = ".((int) $this->id);
$sql .= " ORDER BY c.dateadh";
dol_syslog(get_class($this)."::fetch_subscriptions", LOG_DEBUG);
@@ -1900,8 +1900,8 @@ class Adherent extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."adherent SET";
$sql .= " statut = ".self::STATUS_VALIDATED;
$sql .= ", datevalid = '".$this->db->idate($now)."'";
- $sql .= ", fk_user_valid=".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= ", fk_user_valid = ".((int) $user->id);
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate", LOG_DEBUG);
$result = $this->db->query($sql);
@@ -1952,7 +1952,7 @@ class Adherent extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."adherent SET";
$sql .= " statut = ".self::STATUS_RESILIATED;
$sql .= ", fk_user_valid=".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
@@ -2002,7 +2002,7 @@ class Adherent extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."adherent SET";
$sql .= " statut = ".self::STATUS_EXCLUDED;
$sql .= ", fk_user_valid=".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
diff --git a/htdocs/adherents/class/adherent_type.class.php b/htdocs/adherents/class/adherent_type.class.php
index ad24b9f1c05..1a00a03e932 100644
--- a/htdocs/adherents/class/adherent_type.class.php
+++ b/htdocs/adherents/class/adherent_type.class.php
@@ -142,7 +142,7 @@ class AdherentType extends CommonObject
$sql = "SELECT lang, label, description, email";
$sql .= " FROM ".MAIN_DB_PREFIX."adherent_type_lang";
- $sql .= " WHERE fk_type=".$this->id;
+ $sql .= " WHERE fk_type = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
@@ -181,21 +181,21 @@ class AdherentType extends CommonObject
if ($key == $current_lang) {
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."adherent_type_lang";
- $sql .= " WHERE fk_type=".$this->id;
+ $sql .= " WHERE fk_type = ".((int) $this->id);
$sql .= " AND lang = '".$this->db->escape($key)."'";
$result = $this->db->query($sql);
if ($this->db->num_rows($result)) { // if there is already a description line for this language
$sql2 = "UPDATE ".MAIN_DB_PREFIX."adherent_type_lang";
- $sql2 .= " SET ";
- $sql2 .= " label='".$this->db->escape($this->label)."',";
- $sql2 .= " description='".$this->db->escape($this->description)."'";
- $sql2 .= " WHERE fk_type=".$this->id." AND lang='".$this->db->escape($key)."'";
+ $sql2 .= " SET";
+ $sql2 .= " label = '".$this->db->escape($this->label)."',";
+ $sql2 .= " description = '".$this->db->escape($this->description)."'";
+ $sql2 .= " WHERE fk_type = ".((int) $this->id)." AND lang='".$this->db->escape($key)."'";
} else {
$sql2 = "INSERT INTO ".MAIN_DB_PREFIX."adherent_type_lang (fk_type, lang, label, description";
$sql2 .= ")";
- $sql2 .= " VALUES(".$this->id.",'".$this->db->escape($key)."','".$this->db->escape($this->label)."',";
+ $sql2 .= " VALUES(".((int) $this->id).",'".$this->db->escape($key)."','".$this->db->escape($this->label)."',";
$sql2 .= " '".$this->db->escape($this->description)."'";
$sql2 .= ")";
}
@@ -207,7 +207,7 @@ class AdherentType extends CommonObject
} elseif (isset($this->multilangs[$key])) {
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."adherent_type_lang";
- $sql .= " WHERE fk_type=".$this->id;
+ $sql .= " WHERE fk_type = ".((int) $this->id);
$sql .= " AND lang = '".$this->db->escape($key)."'";
$result = $this->db->query($sql);
@@ -215,9 +215,9 @@ class AdherentType extends CommonObject
if ($this->db->num_rows($result)) { // if there is already a description line for this language
$sql2 = "UPDATE ".MAIN_DB_PREFIX."adherent_type_lang";
$sql2 .= " SET ";
- $sql2 .= " label='".$this->db->escape($this->multilangs["$key"]["label"])."',";
- $sql2 .= " description='".$this->db->escape($this->multilangs["$key"]["description"])."'";
- $sql2 .= " WHERE fk_type=".$this->id." AND lang='".$this->db->escape($key)."'";
+ $sql2 .= " label = '".$this->db->escape($this->multilangs["$key"]["label"])."',";
+ $sql2 .= " description = '".$this->db->escape($this->multilangs["$key"]["description"])."'";
+ $sql2 .= " WHERE fk_type = ".((int) $this->id)." AND lang='".$this->db->escape($key)."'";
} else {
$sql2 = "INSERT INTO ".MAIN_DB_PREFIX."adherent_type_lang (fk_type, lang, label, description";
$sql2 .= ")";
@@ -259,7 +259,7 @@ class AdherentType extends CommonObject
public function delMultiLangs($langtodelete, $user)
{
$sql = "DELETE FROM ".MAIN_DB_PREFIX."adherent_type_lang";
- $sql .= " WHERE fk_type=".$this->id." AND lang='".$this->db->escape($langtodelete)."'";
+ $sql .= " WHERE fk_type = ".((int) $this->id)." AND lang = '".$this->db->escape($langtodelete)."'";
dol_syslog(get_class($this).'::delMultiLangs', LOG_DEBUG);
$result = $this->db->query($sql);
diff --git a/htdocs/adherents/class/subscription.class.php b/htdocs/adherents/class/subscription.class.php
index fff9d925cd9..cae5dd07beb 100644
--- a/htdocs/adherents/class/subscription.class.php
+++ b/htdocs/adherents/class/subscription.class.php
@@ -275,7 +275,7 @@ class Subscription extends CommonObject
$sql .= " datef='".$this->db->idate($this->datef)."',";
$sql .= " datec='".$this->db->idate($this->datec)."',";
$sql .= " fk_bank = ".($this->fk_bank ? ((int) $this->fk_bank) : 'null');
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/admin/paymentbybanktransfer.php b/htdocs/admin/paymentbybanktransfer.php
index e130f0479c4..251d5194b27 100644
--- a/htdocs/admin/paymentbybanktransfer.php
+++ b/htdocs/admin/paymentbybanktransfer.php
@@ -114,7 +114,7 @@ if ($action == "set") {
if ($action == "addnotif") {
$bon = new BonPrelevement($db);
- $bon->AddNotification($db, GETPOST('user', 'int'), $action);
+ $bon->addNotification($db, GETPOST('user', 'int'), $action);
header("Location: ".$_SERVER["PHP_SELF"]);
exit;
@@ -122,7 +122,7 @@ if ($action == "addnotif") {
if ($action == "deletenotif") {
$bon = new BonPrelevement($db);
- $bon->DeleteNotificationById(GETPOST('notif', 'int'));
+ $bon->deleteNotificationById(GETPOST('notif', 'int'));
header("Location: ".$_SERVER["PHP_SELF"]);
exit;
diff --git a/htdocs/admin/prelevement.php b/htdocs/admin/prelevement.php
index 739709410ce..db48ab19849 100644
--- a/htdocs/admin/prelevement.php
+++ b/htdocs/admin/prelevement.php
@@ -117,7 +117,7 @@ if ($action == "set") {
if ($action == "addnotif") {
$bon = new BonPrelevement($db);
- $bon->AddNotification($db, GETPOST('user', 'int'), $action);
+ $bon->addNotification($db, GETPOST('user', 'int'), $action);
header("Location: ".$_SERVER["PHP_SELF"]);
exit;
@@ -125,7 +125,7 @@ if ($action == "addnotif") {
if ($action == "deletenotif") {
$bon = new BonPrelevement($db);
- $bon->DeleteNotificationById(GETPOST('notif', 'int'));
+ $bon->deleteNotificationById(GETPOST('notif', 'int'));
header("Location: ".$_SERVER["PHP_SELF"]);
exit;
diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php
index 5a506558187..689014ad14e 100644
--- a/htdocs/categories/class/categorie.class.php
+++ b/htdocs/categories/class/categorie.class.php
@@ -613,7 +613,7 @@ class Categorie extends CommonObject
if (!$error) {
$sql = "UPDATE ".MAIN_DB_PREFIX."categorie";
$sql .= " SET fk_parent = ".((int) $this->fk_parent);
- $sql .= " WHERE fk_parent = ".$this->id;
+ $sql .= " WHERE fk_parent = ".((int) $this->id);
if (!$this->db->query($sql)) {
$this->error = $this->db->lasterror();
@@ -634,7 +634,7 @@ class Categorie extends CommonObject
);
foreach ($arraydelete as $key => $value) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX.$key;
- $sql .= " WHERE ".$value." = ".$this->id;
+ $sql .= " WHERE ".$value." = ".((int) $this->id);
if (!$this->db->query($sql)) {
$this->errors[] = $this->db->lasterror();
dol_syslog("Error sql=".$sql." ".$this->error, LOG_ERR);
@@ -1002,7 +1002,7 @@ class Categorie extends CommonObject
{
// phpcs:enable
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."categorie";
- $sql .= " WHERE fk_parent = ".$this->id;
+ $sql .= " WHERE fk_parent = ".((int) $this->id);
$sql .= " AND entity IN (".getEntity('category').")";
$res = $this->db->query($sql);
@@ -1408,7 +1408,7 @@ class Categorie extends CommonObject
$parents = array();
$sql = "SELECT fk_parent FROM ".MAIN_DB_PREFIX."categorie";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$res = $this->db->query($sql);
diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index a403a1cdf40..e5bbc5d676f 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -591,10 +591,10 @@ if (empty($reshook) && $action == 'update') {
$sql .= " FROM ".MAIN_DB_PREFIX."element_resources as er";
$sql .= " INNER JOIN ".MAIN_DB_PREFIX."resource as r ON r.rowid = er.resource_id AND er.resource_type = 'dolresource'";
$sql .= " INNER JOIN ".MAIN_DB_PREFIX."actioncomm as ac ON ac.id = er.element_id AND er.element_type = '".$db->escape($object->element)."'";
- $sql .= " WHERE ac.id != ".$object->id;
+ $sql .= " WHERE ac.id <> ".((int) $object->id);
$sql .= " AND er.resource_id IN (";
$sql .= " SELECT resource_id FROM ".MAIN_DB_PREFIX."element_resources";
- $sql .= " WHERE element_id = ".$object->id;
+ $sql .= " WHERE element_id = ".((int) $object->id);
$sql .= " AND element_type = '".$db->escape($object->element)."'";
$sql .= " AND busy = 1";
$sql .= ")";
@@ -770,10 +770,10 @@ if (empty($reshook) && GETPOST('actionmove', 'alpha') == 'mupdate') {
$sql .= " FROM ".MAIN_DB_PREFIX."element_resources as er";
$sql .= " INNER JOIN ".MAIN_DB_PREFIX."resource as r ON r.rowid = er.resource_id AND er.resource_type = 'dolresource'";
$sql .= " INNER JOIN ".MAIN_DB_PREFIX."actioncomm as ac ON ac.id = er.element_id AND er.element_type = '".$db->escape($object->element)."'";
- $sql .= " WHERE ac.id != ".$object->id;
+ $sql .= " WHERE ac.id <> ".((int) $object->id);
$sql .= " AND er.resource_id IN (";
$sql .= " SELECT resource_id FROM ".MAIN_DB_PREFIX."element_resources";
- $sql .= " WHERE element_id = ".$object->id;
+ $sql .= " WHERE element_id = ".((int) $object->id);
$sql .= " AND element_type = '".$db->escape($object->element)."'";
$sql .= " AND busy = 1";
$sql .= ")";
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index ce8f3f89d92..1e8de65cb43 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -973,7 +973,7 @@ class ActionComm extends CommonObject
// remove categorie association
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."categorie_actioncomm";
- $sql .= " WHERE fk_actioncomm=".$this->id;
+ $sql .= " WHERE fk_actioncomm=".((int) $this->id);
$res = $this->db->query($sql);
if (!$res) {
@@ -985,7 +985,7 @@ class ActionComm extends CommonObject
// remove actioncomm_resources
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."actioncomm_resources";
- $sql .= " WHERE fk_actioncomm=".$this->id;
+ $sql .= " WHERE fk_actioncomm=".((int) $this->id);
$res = $this->db->query($sql);
if (!$res) {
@@ -1017,7 +1017,7 @@ class ActionComm extends CommonObject
// remove actioncomm
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."actioncomm";
- $sql .= " WHERE id=".$this->id;
+ $sql .= " WHERE id=".((int) $this->id);
$res = $this->db->query($sql);
if (!$res) {
diff --git a/htdocs/comm/mailing/card.php b/htdocs/comm/mailing/card.php
index e03d13c29e8..8b97f23737e 100644
--- a/htdocs/comm/mailing/card.php
+++ b/htdocs/comm/mailing/card.php
@@ -165,7 +165,7 @@ if (empty($reshook)) {
$now = dol_now();
// Positioning date of start sending
- $sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET date_envoi='".$db->idate($now)."' WHERE rowid=".$object->id;
+ $sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET date_envoi='".$db->idate($now)."' WHERE rowid=".((int) $object->id);
$resql2 = $db->query($sql);
if (!$resql2) {
dol_print_error($db);
@@ -368,7 +368,7 @@ if (empty($reshook)) {
dol_syslog("comm/mailing/card.php: error for #".$i.($mail->error ? ' - '.$mail->error : ''), LOG_WARNING);
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles";
- $sql .= " SET statut=-1, error_text='".$db->escape($mail->error)."', date_envoi='".$db->idate($now)."' WHERE rowid=".$obj->rowid;
+ $sql .= " SET statut=-1, error_text='".$db->escape($mail->error)."', date_envoi='".$db->idate($now)."' WHERE rowid=".((int) $obj->rowid);
$resql2 = $db->query($sql);
if (!$resql2) {
dol_print_error($db);
diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php
index 08ab8b6c8d7..4411b8a326a 100644
--- a/htdocs/comm/mailing/cibles.php
+++ b/htdocs/comm/mailing/cibles.php
@@ -135,7 +135,7 @@ if (GETPOST('exportcsv', 'int')) {
$sql = "SELECT mc.rowid, mc.lastname, mc.firstname, mc.email, mc.other, mc.statut as status, mc.date_envoi, mc.tms,";
$sql .= " mc.source_id, mc.source_type, mc.error_text";
$sql .= " FROM ".MAIN_DB_PREFIX."mailing_cibles as mc";
- $sql .= " WHERE mc.fk_mailing=".$object->id;
+ $sql .= " WHERE mc.fk_mailing=".((int) $object->id);
$sql .= $db->order($sortfield, $sortorder);
$resql = $db->query($sql);
@@ -454,7 +454,7 @@ if ($object->fetch($id) >= 0) {
$sql = "SELECT mc.rowid, mc.lastname, mc.firstname, mc.email, mc.other, mc.statut, mc.date_envoi, mc.tms,";
$sql .= " mc.source_url, mc.source_id, mc.source_type, mc.error_text";
$sql .= " FROM ".MAIN_DB_PREFIX."mailing_cibles as mc";
- $sql .= " WHERE mc.fk_mailing=".$object->id;
+ $sql .= " WHERE mc.fk_mailing=".((int) $object->id);
$asearchcriteriahasbeenset = 0;
if ($search_lastname) {
$sql .= natural_search("mc.lastname", $search_lastname);
diff --git a/htdocs/comm/mailing/class/mailing.class.php b/htdocs/comm/mailing/class/mailing.class.php
index d281fcb1a3a..2d33d4219d8 100644
--- a/htdocs/comm/mailing/class/mailing.class.php
+++ b/htdocs/comm/mailing/class/mailing.class.php
@@ -490,7 +490,7 @@ class Mailing extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing ";
$sql .= " SET statut = 1, date_valid = '".$this->db->idate($now)."', fk_user_valid=".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog("Mailing::valid", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -555,7 +555,7 @@ class Mailing extends CommonObject
{
// phpcs:enable
$sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles";
- $sql .= " WHERE fk_mailing = ".$this->id;
+ $sql .= " WHERE fk_mailing = ".((int) $this->id);
dol_syslog("Mailing::delete_targets", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -582,7 +582,7 @@ class Mailing extends CommonObject
// phpcs:enable
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles";
$sql .= " SET statut = 0";
- $sql .= " WHERE fk_mailing = ".$this->id;
+ $sql .= " WHERE fk_mailing = ".((int) $this->id);
dol_syslog("Mailing::reset_targets_status", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -604,7 +604,7 @@ class Mailing extends CommonObject
public function countNbOfTargets($mode)
{
$sql = "SELECT COUNT(rowid) as nb FROM ".MAIN_DB_PREFIX."mailing_cibles";
- $sql .= " WHERE fk_mailing = ".$this->id;
+ $sql .= " WHERE fk_mailing = ".((int) $this->id);
if ($mode == 'alreadysent') {
$sql .= " AND statut <> 0";
} elseif ($mode == 'alreadysentok') {
@@ -638,7 +638,7 @@ class Mailing extends CommonObject
public function refreshNbOfTargets()
{
$sql = "SELECT COUNT(rowid) as nb FROM ".MAIN_DB_PREFIX."mailing_cibles";
- $sql .= " WHERE fk_mailing = ".$this->id;
+ $sql .= " WHERE fk_mailing = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/comm/multiprix.php b/htdocs/comm/multiprix.php
index 25ef23dd7de..8da9a17ebb2 100644
--- a/htdocs/comm/multiprix.php
+++ b/htdocs/comm/multiprix.php
@@ -134,7 +134,7 @@ if ($_socid > 0) {
*/
$sql = "SELECT rc.rowid,rc.price_level, rc.datec as dc, u.rowid as uid, u.login";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_prices as rc, ".MAIN_DB_PREFIX."user as u";
- $sql .= " WHERE rc.fk_soc =".$objsoc->id;
+ $sql .= " WHERE rc.fk_soc = ".((int) $objsoc->id);
$sql .= " AND u.rowid = rc.fk_user_author";
$sql .= " ORDER BY rc.datec DESC";
diff --git a/htdocs/comm/remise.php b/htdocs/comm/remise.php
index bdf9b75998b..a31389340e8 100644
--- a/htdocs/comm/remise.php
+++ b/htdocs/comm/remise.php
@@ -214,7 +214,7 @@ if ($socid > 0) {
$sql = "SELECT rc.rowid, rc.remise_client as remise_percent, rc.note, rc.datec as dc,";
$sql .= " u.login, u.rowid as user_id";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise as rc, ".MAIN_DB_PREFIX."user as u";
- $sql .= " WHERE rc.fk_soc = ".$object->id;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
$sql .= " AND rc.entity IN (".getEntity('discount').")";
$sql .= " AND u.rowid = rc.fk_user_author";
$sql .= " ORDER BY rc.datec DESC";
@@ -266,7 +266,7 @@ if ($socid > 0) {
$sql = "SELECT rc.rowid, rc.remise_supplier as remise_percent, rc.note, rc.datec as dc,";
$sql .= " u.login, u.rowid as user_id";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_supplier as rc, ".MAIN_DB_PREFIX."user as u";
- $sql .= " WHERE rc.fk_soc = ".$object->id;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
$sql .= " AND rc.entity IN (".getEntity('discount').")";
$sql .= " AND u.rowid = rc.fk_user_author";
$sql .= " ORDER BY rc.datec DESC";
diff --git a/htdocs/comm/remx.php b/htdocs/comm/remx.php
index 8f26d897389..42a5ee42e16 100644
--- a/htdocs/comm/remx.php
+++ b/htdocs/comm/remx.php
@@ -267,8 +267,8 @@ if ($socid > 0) {
$remise_all = $remise_user = 0;
$sql = "SELECT SUM(rc.amount_ht) as amount, rc.fk_user";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as rc";
- $sql .= " WHERE rc.fk_soc = ".$object->id;
- $sql .= " AND rc.entity = ".$conf->entity;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
+ $sql .= " AND rc.entity = ".((int) $conf->entity);
$sql .= " AND discount_type = 0"; // Exclude supplier discounts
$sql .= " AND (fk_facture_line IS NULL AND fk_facture IS NULL)";
$sql .= " GROUP BY rc.fk_user";
@@ -297,8 +297,8 @@ if ($socid > 0) {
$remise_all = $remise_user = 0;
$sql = "SELECT SUM(rc.amount_ht) as amount, rc.fk_user";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as rc";
- $sql .= " WHERE rc.fk_soc = ".$object->id;
- $sql .= " AND rc.entity = ".$conf->entity;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
+ $sql .= " AND rc.entity = ".((int) $conf->entity);
$sql .= " AND discount_type = 1"; // Exclude customer discounts
$sql .= " AND (fk_invoice_supplier_line IS NULL AND fk_invoice_supplier IS NULL)";
$sql .= " GROUP BY rc.fk_user";
@@ -408,8 +408,8 @@ if ($socid > 0) {
$sql .= " fa.ref as ref, fa.type as type";
$sql .= " FROM ".MAIN_DB_PREFIX."user as u, ".MAIN_DB_PREFIX."societe_remise_except as rc";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."facture as fa ON rc.fk_facture_source = fa.rowid";
- $sql .= " WHERE rc.fk_soc = ".$object->id;
- $sql .= " AND rc.entity = ".$conf->entity;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
+ $sql .= " AND rc.entity = ".((int) $conf->entity);
$sql .= " AND u.rowid = rc.fk_user";
$sql .= " AND rc.discount_type = 0"; // Eliminate supplier discounts
$sql .= " AND (rc.fk_facture_line IS NULL AND rc.fk_facture IS NULL)";
@@ -547,8 +547,8 @@ if ($socid > 0) {
$sql .= " fa.ref, fa.type as type";
$sql .= " FROM ".MAIN_DB_PREFIX."user as u, ".MAIN_DB_PREFIX."societe_remise_except as rc";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."facture_fourn as fa ON rc.fk_invoice_supplier_source = fa.rowid";
- $sql .= " WHERE rc.fk_soc = ".$object->id;
- $sql .= " AND rc.entity = ".$conf->entity;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
+ $sql .= " AND rc.entity = ".((int) $conf->entity);
$sql .= " AND u.rowid = rc.fk_user";
$sql .= " AND rc.discount_type = 1"; // Eliminate customer discounts
$sql .= " AND (rc.fk_invoice_supplier IS NULL AND rc.fk_invoice_supplier_line IS NULL)";
@@ -700,7 +700,7 @@ if ($socid > 0) {
$sql .= " , ".MAIN_DB_PREFIX."facturedet as fc";
$sql .= " , ".MAIN_DB_PREFIX."societe_remise_except as rc";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."facture as fa ON rc.fk_facture_source = fa.rowid";
- $sql .= " WHERE rc.fk_soc =".$object->id;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
$sql .= " AND rc.fk_facture_line = fc.rowid";
$sql .= " AND fc.fk_facture = f.rowid";
$sql .= " AND rc.fk_user = u.rowid";
@@ -718,7 +718,7 @@ if ($socid > 0) {
$sql2 .= " , ".MAIN_DB_PREFIX."user as u";
$sql2 .= " , ".MAIN_DB_PREFIX."societe_remise_except as rc";
$sql2 .= " LEFT JOIN ".MAIN_DB_PREFIX."facture as fa ON rc.fk_facture_source = fa.rowid";
- $sql2 .= " WHERE rc.fk_soc =".$object->id;
+ $sql2 .= " WHERE rc.fk_soc = ".((int) $object->id);
$sql2 .= " AND rc.fk_facture = f.rowid";
$sql2 .= " AND rc.fk_user = u.rowid";
$sql2 .= " AND rc.discount_type = 0"; // Eliminate supplier discounts
@@ -860,7 +860,7 @@ if ($socid > 0) {
$sql .= " , ".MAIN_DB_PREFIX."facture_fourn_det as fc";
$sql .= " , ".MAIN_DB_PREFIX."societe_remise_except as rc";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."facture_fourn as fa ON rc.fk_invoice_supplier_source = fa.rowid";
- $sql .= " WHERE rc.fk_soc =".$object->id;
+ $sql .= " WHERE rc.fk_soc = ".((int) $object->id);
$sql .= " AND rc.fk_invoice_supplier_line = fc.rowid";
$sql .= " AND fc.fk_facture_fourn = f.rowid";
$sql .= " AND rc.fk_user = u.rowid";
@@ -878,7 +878,7 @@ if ($socid > 0) {
$sql2 .= " , ".MAIN_DB_PREFIX."user as u";
$sql2 .= " , ".MAIN_DB_PREFIX."societe_remise_except as rc";
$sql2 .= " LEFT JOIN ".MAIN_DB_PREFIX."facture_fourn as fa ON rc.fk_invoice_supplier_source = fa.rowid";
- $sql2 .= " WHERE rc.fk_soc =".$object->id;
+ $sql2 .= " WHERE rc.fk_soc = ".((int) $object->id);
$sql2 .= " AND rc.fk_invoice_supplier = f.rowid";
$sql2 .= " AND rc.fk_user = u.rowid";
$sql2 .= " AND rc.discount_type = 1"; // Eliminate customer discounts
diff --git a/htdocs/compta/bank/class/account.class.php b/htdocs/compta/bank/class/account.class.php
index d2a9554abab..804cfa09281 100644
--- a/htdocs/compta/bank/class/account.class.php
+++ b/htdocs/compta/bank/class/account.class.php
@@ -907,8 +907,8 @@ class Account extends CommonObject
$sql .= ",owner_address = '".$this->db->escape($this->owner_address)."'";
$sql .= ",state_id = ".($this->state_id > 0 ? $this->state_id : "null");
$sql .= ",fk_pays = ".($this->country_id > 0 ? $this->country_id : "null");
- $sql .= " WHERE rowid = ".$this->id;
- $sql .= " AND entity = ".$conf->entity;
+ $sql .= " WHERE rowid = ".((int) $this->id);
+ $sql .= " AND entity = ".((int) $conf->entity);
dol_syslog(get_class($this)."::update_bban", LOG_DEBUG);
@@ -1059,7 +1059,7 @@ class Account extends CommonObject
// Delete link between tag and bank account
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."categorie_account";
- $sql .= " WHERE fk_account = ".$this->id;
+ $sql .= " WHERE fk_account = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -1151,7 +1151,7 @@ class Account extends CommonObject
$sql = "SELECT COUNT(rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."bank";
- $sql .= " WHERE fk_account=".$this->id;
+ $sql .= " WHERE fk_account = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -1188,7 +1188,7 @@ class Account extends CommonObject
$sql = "SELECT sum(amount) as amount";
$sql .= " FROM ".MAIN_DB_PREFIX."bank";
- $sql .= " WHERE fk_account = ".$this->id;
+ $sql .= " WHERE fk_account = ".((int) $this->id);
if ($option == 1) {
$sql .= " AND dateo <= '".$this->db->idate(dol_now())."'";
}
diff --git a/htdocs/compta/bank/class/bankcateg.class.php b/htdocs/compta/bank/class/bankcateg.class.php
index ccf5828d40a..ab58cb8287c 100644
--- a/htdocs/compta/bank/class/bankcateg.class.php
+++ b/htdocs/compta/bank/class/bankcateg.class.php
@@ -213,7 +213,7 @@ class BankCateg // extends CommonObject
// Delete link between tag and bank account
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."categorie_account";
- $sql .= " WHERE fk_categorie = ".$this->id;
+ $sql .= " WHERE fk_categorie = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -225,7 +225,7 @@ class BankCateg // extends CommonObject
// Delete link between tag and bank lines
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."bank_class";
- $sql .= " WHERE fk_categ = ".$this->id;
+ $sql .= " WHERE fk_categ = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/compta/deplacement/class/deplacement.class.php b/htdocs/compta/deplacement/class/deplacement.class.php
index 1972e3f686e..81022e9bc71 100644
--- a/htdocs/compta/deplacement/class/deplacement.class.php
+++ b/htdocs/compta/deplacement/class/deplacement.class.php
@@ -249,7 +249,7 @@ class Deplacement extends CommonObject
$sql .= " , note_private = ".($this->note_private ? "'".$this->db->escape($this->note_private)."'" : "null");
$sql .= " , note_public = ".($this->note_public ? "'".$this->db->escape($this->note_public)."'" : "null");
$sql .= " , fk_projet = ".($this->fk_project > 0 ? $this->fk_project : 0);
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update", LOG_DEBUG);
$result = $this->db->query($sql);
diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
index 31de2bbd4ff..374de5cca4d 100644
--- a/htdocs/compta/facture/card.php
+++ b/htdocs/compta/facture/card.php
@@ -889,7 +889,7 @@ if (empty($reshook)) {
$sql = "SELECT re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc,";
$sql .= " re.description, re.fk_facture_source";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re";
- $sql .= " WHERE fk_facture = ".$object->id;
+ $sql .= " WHERE fk_facture = ".((int) $object->id);
$resql = $db->query($sql);
if (!empty($resql)) {
while ($obj = $db->fetch_object($resql)) {
@@ -4975,7 +4975,7 @@ if ($action == 'create') {
$sql = "SELECT re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc,";
$sql .= " re.description, re.fk_facture_source";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re";
- $sql .= " WHERE fk_facture = ".$object->id;
+ $sql .= " WHERE fk_facture = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
diff --git a/htdocs/compta/facture/class/paymentterm.class.php b/htdocs/compta/facture/class/paymentterm.class.php
index 87cd50d27c6..f94ad573a81 100644
--- a/htdocs/compta/facture/class/paymentterm.class.php
+++ b/htdocs/compta/facture/class/paymentterm.class.php
@@ -311,7 +311,7 @@ class PaymentTerm // extends CommonObject
$sql .= " type_cdr=".(isset($this->type_cdr) ? $this->type_cdr : "null").",";
$sql .= " nbjour=".(isset($this->nbjour) ? $this->nbjour : "null").",";
$sql .= " decalage=".(isset($this->decalage) ? $this->decalage : "null")."";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
@@ -350,7 +350,7 @@ class PaymentTerm // extends CommonObject
$error = 0;
$sql = "DELETE FROM ".MAIN_DB_PREFIX."c_payment_term";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
diff --git a/htdocs/compta/facture/prelevement.php b/htdocs/compta/facture/prelevement.php
index 6fdc74a7539..0d2c3070261 100644
--- a/htdocs/compta/facture/prelevement.php
+++ b/htdocs/compta/facture/prelevement.php
@@ -577,9 +577,9 @@ if ($object->id > 0) {
$sql .= " , pfd.amount";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_facture_demande as pfd";
if ($type == 'bank-transfer') {
- $sql .= " WHERE fk_facture_fourn = ".$object->id;
+ $sql .= " WHERE fk_facture_fourn = ".((int) $object->id);
} else {
- $sql .= " WHERE fk_facture = ".$object->id;
+ $sql .= " WHERE fk_facture = ".((int) $object->id);
}
$sql .= " AND pfd.traite = 0";
$sql .= " AND pfd.ext_payment_id IS NULL";
@@ -598,9 +598,9 @@ if ($object->id > 0) {
$sql = "SELECT SUM(pfd.amount) as amount";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_facture_demande as pfd";
if ($type == 'bank-transfer') {
- $sql .= " WHERE fk_facture_fourn = ".$object->id;
+ $sql .= " WHERE fk_facture_fourn = ".((int) $object->id);
} else {
- $sql .= " WHERE fk_facture = ".$object->id;
+ $sql .= " WHERE fk_facture = ".((int) $object->id);
}
$sql .= " AND pfd.traite = 0";
$sql .= " AND pfd.ext_payment_id IS NULL";
@@ -699,9 +699,9 @@ if ($object->id > 0) {
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on pfd.fk_user_demande = u.rowid";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."prelevement_bons as pb ON pb.rowid = pfd.fk_prelevement_bons";
if ($type == 'bank-transfer') {
- $sql .= " WHERE fk_facture_fourn = ".$object->id;
+ $sql .= " WHERE fk_facture_fourn = ".((int) $object->id);
} else {
- $sql .= " WHERE fk_facture = ".$object->id;
+ $sql .= " WHERE fk_facture = ".((int) $object->id);
}
$sql .= " AND pfd.traite = 0";
$sql .= " AND pfd.ext_payment_id IS NULL";
@@ -765,9 +765,9 @@ if ($object->id > 0) {
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on pfd.fk_user_demande = u.rowid";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."prelevement_bons as pb ON pb.rowid = pfd.fk_prelevement_bons";
if ($type == 'bank-transfer') {
- $sql .= " WHERE fk_facture_fourn = ".$object->id;
+ $sql .= " WHERE fk_facture_fourn = ".((int) $object->id);
} else {
- $sql .= " WHERE fk_facture = ".$object->id;
+ $sql .= " WHERE fk_facture = ".((int) $object->id);
}
$sql .= " AND pfd.traite = 1";
$sql .= " AND pfd.ext_payment_id IS NULL";
diff --git a/htdocs/compta/paiement/cheque/class/remisecheque.class.php b/htdocs/compta/paiement/cheque/class/remisecheque.class.php
index 683b2fd0423..fe967543fdc 100644
--- a/htdocs/compta/paiement/cheque/class/remisecheque.class.php
+++ b/htdocs/compta/paiement/cheque/class/remisecheque.class.php
@@ -305,7 +305,7 @@ class RemiseCheque extends CommonObject
if ($this->errno === 0) {
$sql = "UPDATE ".MAIN_DB_PREFIX."bank";
$sql .= " SET fk_bordereau = 0";
- $sql .= " WHERE fk_bordereau = ".$this->id;
+ $sql .= " WHERE fk_bordereau = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -647,7 +647,7 @@ class RemiseCheque extends CommonObject
$nb = 0;
$sql = "SELECT amount ";
$sql .= " FROM ".MAIN_DB_PREFIX."bank";
- $sql .= " WHERE fk_bordereau = ".$this->id;
+ $sql .= " WHERE fk_bordereau = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/compta/paiement/class/paiement.class.php b/htdocs/compta/paiement/class/paiement.class.php
index 971400afa5e..94264d0f9f6 100644
--- a/htdocs/compta/paiement/class/paiement.class.php
+++ b/htdocs/compta/paiement/class/paiement.class.php
@@ -788,7 +788,7 @@ class Paiement extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET datep = '".$this->db->idate($date)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if (!$result) {
@@ -839,7 +839,7 @@ class Paiement extends CommonObject
if (!empty($num) && $this->statut != 1) {
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET num_paiement = '".$this->db->escape($num)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update_num", LOG_DEBUG);
$result = $this->db->query($sql);
diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php
index 10c8f304102..a97facc592c 100644
--- a/htdocs/compta/prelevement/class/bonprelevement.class.php
+++ b/htdocs/compta/prelevement/class/bonprelevement.class.php
@@ -1341,18 +1341,14 @@ class BonPrelevement extends CommonObject
}
- // phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps
/**
* Delete a notification def by id
*
* @param int $rowid id of notification
* @return int 0 if OK, <0 if KO
*/
- public function DeleteNotificationById($rowid)
+ public function deleteNotificationById($rowid)
{
- // phpcs:enable
- $result = 0;
-
$sql = "DELETE FROM ".MAIN_DB_PREFIX."notify_def";
$sql .= " WHERE rowid = ".((int) $rowid);
@@ -1363,21 +1359,23 @@ class BonPrelevement extends CommonObject
}
}
- // phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps
/**
* Delete a notification
*
- * @param int $user notification user
- * @param string $action notification action
- * @return int >0 if OK, <0 if KO
+ * @param int|User $user notification user
+ * @param string $action notification action
+ * @return int >0 if OK, <0 if KO
*/
- public function DeleteNotification($user, $action)
+ public function deleteNotification($user, $action)
{
- // phpcs:enable
- $result = 0;
+ if (is_object($user)) {
+ $userid = $user->id;
+ } else { // If user is an id
+ $userid = $user;
+ }
$sql = "DELETE FROM ".MAIN_DB_PREFIX."notify_def";
- $sql .= " WHERE fk_user=".$user." AND fk_action='".$this->db->escape($action)."'";
+ $sql .= " WHERE fk_user=".((int) $userid)." AND fk_action='".$this->db->escape($action)."'";
if ($this->db->query($sql)) {
return 0;
@@ -1390,28 +1388,34 @@ class BonPrelevement extends CommonObject
/**
* Add a notification
*
- * @param DoliDB $db database handler
- * @param int $user notification user
- * @param string $action notification action
- * @return int 0 if OK, <0 if KO
+ * @param DoliDB $db database handler
+ * @param int|User $user notification user
+ * @param string $action notification action
+ * @return int 0 if OK, <0 if KO
*/
- public function AddNotification($db, $user, $action)
+ public function addNotification($db, $user, $action)
{
// phpcs:enable
$result = 0;
- if ($this->DeleteNotification($user, $action) == 0) {
+ if (is_object($user)) {
+ $userid = $user->id;
+ } else { // If user is an id
+ $userid = $user;
+ }
+
+ if ($this->deleteNotification($user, $action) == 0) {
$now = dol_now();
$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec,fk_user, fk_soc, fk_contact, fk_action)";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$user.", 'NULL', 'NULL', '".$this->db->escape($action)."')";
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".$userid.", 'NULL', 'NULL', '".$this->db->escape($action)."')";
dol_syslog("adnotiff: ".$sql);
if ($this->db->query($sql)) {
$result = 0;
} else {
$result = -1;
- dol_syslog(get_class($this)."::AddNotification Error $result");
+ dol_syslog(get_class($this)."::addNotification Error $result");
}
}
diff --git a/htdocs/compta/sociales/class/chargesociales.class.php b/htdocs/compta/sociales/class/chargesociales.class.php
index 14b2cf67590..2b80e1bb4f4 100644
--- a/htdocs/compta/sociales/class/chargesociales.class.php
+++ b/htdocs/compta/sociales/class/chargesociales.class.php
@@ -445,7 +445,7 @@ class ChargeSociales extends CommonObject
{
$sql = "UPDATE ".MAIN_DB_PREFIX."chargesociales SET";
$sql .= " paye = 1";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$return = $this->db->query($sql);
if ($return) {
return 1;
@@ -480,7 +480,7 @@ class ChargeSociales extends CommonObject
{
$sql = "UPDATE ".MAIN_DB_PREFIX."chargesociales SET";
$sql .= " paye = 0";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$return = $this->db->query($sql);
if ($return) {
return 1;
diff --git a/htdocs/compta/tva/class/tva.class.php b/htdocs/compta/tva/class/tva.class.php
index 45d3d2e74b4..c412072ec89 100644
--- a/htdocs/compta/tva/class/tva.class.php
+++ b/htdocs/compta/tva/class/tva.class.php
@@ -247,7 +247,7 @@ class Tva extends CommonObject
// phpcs:enable
$sql = "UPDATE ".MAIN_DB_PREFIX."tva SET";
$sql .= " paye = 1";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
return 1;
@@ -267,7 +267,7 @@ class Tva extends CommonObject
// phpcs:enable
$sql = "UPDATE ".MAIN_DB_PREFIX."tva SET";
$sql .= " paye = 0";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
return 1;
diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php
index f364e82dd68..9b2364f7233 100644
--- a/htdocs/contrat/class/contrat.class.php
+++ b/htdocs/contrat/class/contrat.class.php
@@ -3202,7 +3202,7 @@ class ContratLigne extends CommonObjectLine
$sql .= ",total_localtax1=".price2num($this->total_localtax1, 'MT')."";
$sql .= ",total_localtax2=".price2num($this->total_localtax2, 'MT')."";
$sql .= ",total_ttc=".price2num($this->total_ttc, 'MT')."";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update_total", LOG_DEBUG);
diff --git a/htdocs/core/class/commonincoterm.class.php b/htdocs/core/class/commonincoterm.class.php
index 25745bb4c5c..11af43c2914 100644
--- a/htdocs/core/class/commonincoterm.class.php
+++ b/htdocs/core/class/commonincoterm.class.php
@@ -109,7 +109,7 @@ trait CommonIncoterm
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET fk_incoterms = ".($id_incoterm > 0 ? $id_incoterm : "null");
$sql .= ", location_incoterms = ".($id_incoterm > 0 ? "'".$this->db->escape($location)."'" : "null");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this).'::setIncoterms', LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index a7049ea5a76..89d7cb1c7d0 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -2782,7 +2782,7 @@ abstract class CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET model_pdf = '".$this->db->escape($newmodelpdf)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setDocModel", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -4500,7 +4500,7 @@ abstract class CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET extraparams = ".(!empty($extraparams) ? "'".$this->db->escape($extraparams)."'" : "null");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setExtraParameters", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -9223,7 +9223,7 @@ abstract class CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET ".$statusfield." = ".((int) $status);
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
if (!$error) {
diff --git a/htdocs/core/class/discount.class.php b/htdocs/core/class/discount.class.php
index eaf4bc511c8..07c6a509815 100644
--- a/htdocs/core/class/discount.class.php
+++ b/htdocs/core/class/discount.class.php
@@ -434,7 +434,7 @@ class DiscountAbsolute
$sql .= " SET fk_facture = ".((int) $rowidinvoice);
}
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::link_to_invoice", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -470,7 +470,7 @@ class DiscountAbsolute
} else {
$sql .= " SET fk_facture_line = NULL, fk_facture = NULL";
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::unlink_invoice", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/core/class/link.class.php b/htdocs/core/class/link.class.php
index be81c1e2737..5e008a1e1ac 100644
--- a/htdocs/core/class/link.class.php
+++ b/htdocs/core/class/link.class.php
@@ -182,7 +182,7 @@ class Link extends CommonObject
$sql .= ", label = '".$this->db->escape($this->label)."'";
$sql .= ", objecttype = '".$this->db->escape($this->objecttype)."'";
$sql .= ", objectid = ".$this->objectid;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update sql = ".$sql);
$resql = $this->db->query($sql);
@@ -365,7 +365,7 @@ class Link extends CommonObject
// Remove link
$sql = "DELETE FROM ".MAIN_DB_PREFIX."links";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::delete", LOG_DEBUG);
if (!$this->db->query($sql)) {
diff --git a/htdocs/delivery/class/delivery.class.php b/htdocs/delivery/class/delivery.class.php
index 019187fca28..de991d50f4e 100644
--- a/htdocs/delivery/class/delivery.class.php
+++ b/htdocs/delivery/class/delivery.class.php
@@ -189,7 +189,7 @@ class Delivery extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."delivery ";
$sql .= "SET ref = '".$this->db->escape($numref)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog("Delivery::create", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -427,7 +427,7 @@ class Delivery extends CommonObject
$sql .= ", fk_statut = 1";
$sql .= ", date_valid = '".$this->db->idate($now)."'";
$sql .= ", fk_user_valid = ".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$sql .= " AND fk_statut = 0";
$resql = $this->db->query($sql);
@@ -651,7 +651,7 @@ class Delivery extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."delivery";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
$this->db->commit();
@@ -1001,7 +1001,7 @@ class Delivery extends CommonObject
if ($user->rights->expedition->creer) {
$sql = "UPDATE ".MAIN_DB_PREFIX."delivery";
$sql .= " SET date_delivery = ".($delivery_date ? "'".$this->db->idate($delivery_date)."'" : 'null');
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setDeliveryDate", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/ecm/class/ecmdirectory.class.php b/htdocs/ecm/class/ecmdirectory.class.php
index c2961794bbc..3c7af135922 100644
--- a/htdocs/ecm/class/ecmdirectory.class.php
+++ b/htdocs/ecm/class/ecmdirectory.class.php
@@ -305,7 +305,7 @@ class EcmDirectory extends CommonObject
} else {
$sql .= " cachenbofdoc = cachenbofdoc ".$value." 1";
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::changeNbOfFiles", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -764,7 +764,7 @@ class EcmDirectory extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."ecm_directories SET";
$sql .= " cachenbofdoc = '".count($filelist)."'";
if (empty($all)) { // By default
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
} else {
$sql .= " WHERE entity = ".$conf->entity;
}
diff --git a/htdocs/eventorganization/class/conferenceorboothattendee.class.php b/htdocs/eventorganization/class/conferenceorboothattendee.class.php
index b6c80feadd4..cdc350480c5 100644
--- a/htdocs/eventorganization/class/conferenceorboothattendee.class.php
+++ b/htdocs/eventorganization/class/conferenceorboothattendee.class.php
@@ -558,7 +558,7 @@ class ConferenceOrBoothAttendee extends CommonObject
if (!empty($this->fields['fk_user_valid'])) {
$sql .= ", fk_user_valid = ".$user->id;
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate()", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/expedition/class/expedition.class.php b/htdocs/expedition/class/expedition.class.php
index 85245b38e89..a60f3c88c6a 100644
--- a/htdocs/expedition/class/expedition.class.php
+++ b/htdocs/expedition/class/expedition.class.php
@@ -363,7 +363,7 @@ class Expedition extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."expedition";
$sql .= " SET ref = '(PROV".$this->id.")'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::create", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -711,7 +711,7 @@ class Expedition extends CommonObject
$sql .= ", fk_statut = 1";
$sql .= ", date_valid = '".$this->db->idate($now)."'";
$sql .= ", fk_user_valid = ".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::valid update expedition", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1297,7 +1297,7 @@ class Expedition extends CommonObject
// No delete expedition
if (!$error) {
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."expedition";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
if (!empty($this->origin) && $this->origin_id > 0) {
@@ -1489,7 +1489,7 @@ class Expedition extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."expedition";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
if (!empty($this->origin) && $this->origin_id > 0) {
@@ -1973,7 +1973,7 @@ class Expedition extends CommonObject
if ($user->rights->expedition->creer) {
$sql = "UPDATE ".MAIN_DB_PREFIX."expedition";
$sql .= " SET date_delivery = ".($delivery_date ? "'".$this->db->idate($delivery_date)."'" : 'null');
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setDeliveryDate", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2814,7 +2814,7 @@ class ExpeditionLigne extends CommonObjectLine
}
$sql = "DELETE FROM ".MAIN_DB_PREFIX."expeditiondet";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if (!$error && $this->db->query($sql)) {
// Remove extrafields
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index b3601c00deb..a83ef94e520 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -495,7 +495,7 @@ class ExpenseReport extends CommonObject
$sql .= " , note_public = ".(!empty($this->note_public) ? "'".$this->db->escape($this->note_public)."'" : "''");
$sql .= " , note_private = ".(!empty($this->note_private) ? "'".$this->db->escape($this->note_private)."'" : "''");
$sql .= " , detail_refuse = ".(!empty($this->detail_refuse) ? "'".$this->db->escape($this->detail_refuse)."'" : "''");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG);
$result = $this->db->query($sql);
@@ -1252,7 +1252,7 @@ class ExpenseReport extends CommonObject
$sql .= " fk_statut = ".self::STATUS_VALIDATED.",";
$sql .= " date_valid='".$this->db->idate($this->date_valid)."',";
$sql .= " fk_user_valid = ".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -1746,7 +1746,7 @@ class ExpenseReport extends CommonObject
$sql .= " total_ht = ".$this->total_ht;
$sql .= " , total_ttc = ".$this->total_ttc;
$sql .= " , total_tva = ".$this->total_tva;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) :
@@ -1776,7 +1776,7 @@ class ExpenseReport extends CommonObject
$sql .= " total_ht = ".$this->total_ht;
$sql .= " , total_ttc = ".$this->total_ttc;
$sql .= " , total_tva = ".$this->total_tva;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) :
diff --git a/htdocs/fichinter/class/fichinter.class.php b/htdocs/fichinter/class/fichinter.class.php
index 371853dc70c..6da1a30b618 100644
--- a/htdocs/fichinter/class/fichinter.class.php
+++ b/htdocs/fichinter/class/fichinter.class.php
@@ -1004,7 +1004,7 @@ class Fichinter extends CommonObject
if (!$error) {
// Delete object
$sql = "DELETE FROM ".MAIN_DB_PREFIX."fichinter";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog("Fichinter::delete", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1066,7 +1066,7 @@ class Fichinter extends CommonObject
if ($user->rights->ficheinter->creer) {
$sql = "UPDATE ".MAIN_DB_PREFIX."fichinter ";
$sql .= " SET datei = '".$this->db->idate($date_delivery)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$sql .= " AND fk_statut = 0";
if ($this->db->query($sql)) {
@@ -1097,7 +1097,7 @@ class Fichinter extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."fichinter ";
$sql .= " SET description = '".$this->db->escape($description)."',";
$sql .= " fk_user_modif = ".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
$this->description = $description;
@@ -1127,7 +1127,7 @@ class Fichinter extends CommonObject
if ($user->rights->ficheinter->creer) {
$sql = "UPDATE ".MAIN_DB_PREFIX."fichinter ";
$sql .= " SET fk_contrat = ".((int) $contractid);
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
$this->fk_contrat = $contractid;
diff --git a/htdocs/fichinter/class/fichinterrec.class.php b/htdocs/fichinter/class/fichinterrec.class.php
index 4fe35c32a2c..9aec232cf0a 100644
--- a/htdocs/fichinter/class/fichinterrec.class.php
+++ b/htdocs/fichinter/class/fichinterrec.class.php
@@ -599,7 +599,7 @@ class FichinterRec extends Fichinter
$sql = "UPDATE ".MAIN_DB_PREFIX."fichinter_rec ";
$sql .= " SET frequency='".$this->db->escape($freq)."'";
$sql .= ", date_last_gen='".$this->db->escape($courant)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index abb5b01fb2c..f7c7ee26e1c 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -1579,7 +1579,7 @@ class FactureFournisseur extends CommonInvoice
$sql = "UPDATE ".MAIN_DB_PREFIX."facture_fourn";
$sql .= " SET ref='".$this->db->escape($num)."', fk_statut = 1, fk_user_valid = ".((int) $user->id).", date_valid = '".$this->db->idate($now)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1706,7 +1706,7 @@ class FactureFournisseur extends CommonInvoice
$sql = "UPDATE ".MAIN_DB_PREFIX."facture_fourn";
$sql .= " SET fk_statut = ".self::STATUS_DRAFT;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
diff --git a/htdocs/hrm/class/establishment.class.php b/htdocs/hrm/class/establishment.class.php
index 2cac4a1352b..cbbe1670a09 100644
--- a/htdocs/hrm/class/establishment.class.php
+++ b/htdocs/hrm/class/establishment.class.php
@@ -231,7 +231,7 @@ class Establishment extends CommonObject
$this->id = $this->db->last_insert_id(MAIN_DB_PREFIX.'establishment');
$sql = 'UPDATE '.MAIN_DB_PREFIX."establishment SET ref = '".$this->db->escape($this->id)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->query($sql);
$this->db->commit();
diff --git a/htdocs/loan/class/loan.class.php b/htdocs/loan/class/loan.class.php
index 91f384703a9..2e51b3871a9 100644
--- a/htdocs/loan/class/loan.class.php
+++ b/htdocs/loan/class/loan.class.php
@@ -404,7 +404,7 @@ class Loan extends CommonObject
{
$sql = "UPDATE ".MAIN_DB_PREFIX."loan SET";
$sql .= " paid = ".$this::STATUS_PAID;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$return = $this->db->query($sql);
if ($return) {
return 1;
@@ -440,7 +440,7 @@ class Loan extends CommonObject
{
$sql = "UPDATE ".MAIN_DB_PREFIX."loan SET";
$sql .= " paid = ".$this::STATUS_STARTED;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$return = $this->db->query($sql);
if ($return) {
return 1;
@@ -475,7 +475,7 @@ class Loan extends CommonObject
{
$sql = "UPDATE ".MAIN_DB_PREFIX."loan SET";
$sql .= " paid = ".$this::STATUS_UNPAID;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$return = $this->db->query($sql);
if ($return) {
return 1;
diff --git a/htdocs/mrp/class/mo.class.php b/htdocs/mrp/class/mo.class.php
index df5dcba60ad..b00aa6e8b91 100644
--- a/htdocs/mrp/class/mo.class.php
+++ b/htdocs/mrp/class/mo.class.php
@@ -838,7 +838,7 @@ class Mo extends CommonObject
$sql .= " status = ".self::STATUS_VALIDATED.",";
$sql .= " date_valid='".$this->db->idate($now)."',";
$sql .= " fk_user_valid = ".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate()", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/partnership/class/partnership.class.php b/htdocs/partnership/class/partnership.class.php
index feef3c7e81f..6de34719f77 100644
--- a/htdocs/partnership/class/partnership.class.php
+++ b/htdocs/partnership/class/partnership.class.php
@@ -627,7 +627,7 @@ class Partnership extends CommonObject
if (!empty($this->fields['fk_user_valid'])) {
$sql .= ", fk_user_valid = ".$user->id;
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate()", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -751,7 +751,7 @@ class Partnership extends CommonObject
// if (!empty($this->fields['fk_user_valid'])) {
// $sql .= ", fk_user_valid = ".$user->id;
// }
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::accept()", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index e7d568f87d4..fc8f5cc4720 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -1603,7 +1603,7 @@ class Product extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ";
$sql .= "$field = '".$this->db->escape($value)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(__METHOD__." sql=".$sql, LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/product/dynamic_price/class/price_expression.class.php b/htdocs/product/dynamic_price/class/price_expression.class.php
index db0c427c334..2a7f35a436b 100644
--- a/htdocs/product/dynamic_price/class/price_expression.class.php
+++ b/htdocs/product/dynamic_price/class/price_expression.class.php
@@ -257,7 +257,7 @@ class PriceExpression
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET";
$sql .= " title = ".(isset($this->title) ? "'".$this->db->escape($this->title)."'" : "''").",";
$sql .= " expression = ".(isset($this->expression) ? "'".$this->db->escape($this->expression)."'" : "''")."";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
diff --git a/htdocs/product/dynamic_price/class/price_global_variable.class.php b/htdocs/product/dynamic_price/class/price_global_variable.class.php
index 87cb8dea2c5..217ab25463a 100644
--- a/htdocs/product/dynamic_price/class/price_global_variable.class.php
+++ b/htdocs/product/dynamic_price/class/price_global_variable.class.php
@@ -183,7 +183,7 @@ class PriceGlobalVariable
$sql .= " code = ".(isset($this->code) ? "'".$this->db->escape($this->code)."'" : "''").",";
$sql .= " description = ".(isset($this->description) ? "'".$this->db->escape($this->description)."'" : "''").",";
$sql .= " value = ".((float) $this->value);
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
diff --git a/htdocs/product/dynamic_price/class/price_global_variable_updater.class.php b/htdocs/product/dynamic_price/class/price_global_variable_updater.class.php
index 331a65971b6..e24ff2c6769 100644
--- a/htdocs/product/dynamic_price/class/price_global_variable_updater.class.php
+++ b/htdocs/product/dynamic_price/class/price_global_variable_updater.class.php
@@ -207,7 +207,7 @@ class PriceGlobalVariableUpdater
$sql .= " update_interval = ".((int) $this->update_interval).",";
$sql .= " next_update = ".((int) $this->next_update).",";
$sql .= " last_status = ".(isset($this->last_status) ? "'".$this->db->escape($this->last_status)."'" : "''");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
@@ -570,7 +570,7 @@ class PriceGlobalVariableUpdater
// Update request
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET";
$sql .= " next_update = ".$this->next_update;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
@@ -614,7 +614,7 @@ class PriceGlobalVariableUpdater
// Update request
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET";
$sql .= " last_status = ".(isset($this->last_status) ? "'".$this->db->escape($this->last_status)."'" : "''");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
diff --git a/htdocs/product/stock/class/entrepot.class.php b/htdocs/product/stock/class/entrepot.class.php
index 92df16fa867..55ee6abf8fa 100644
--- a/htdocs/product/stock/class/entrepot.class.php
+++ b/htdocs/product/stock/class/entrepot.class.php
@@ -389,7 +389,7 @@ class Entrepot extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."entrepot";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql1 = $this->db->query($sql);
if (!$resql1) {
$error++;
diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php
index 905fbcb9216..16501940949 100644
--- a/htdocs/projet/class/project.class.php
+++ b/htdocs/projet/class/project.class.php
@@ -1080,7 +1080,7 @@ class Project extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."projet";
$sql .= " SET fk_statut = ".self::STATUS_CLOSED.", fk_user_close = ".((int) $user->id).", date_close = '".$this->db->idate($now)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$sql .= " AND fk_statut = ".self::STATUS_VALIDATED;
if (!empty($conf->global->PROJECT_USE_OPPORTUNITIES)) {
diff --git a/htdocs/projet/class/task.class.php b/htdocs/projet/class/task.class.php
index 2917b2ce811..70a38a6818b 100644
--- a/htdocs/projet/class/task.class.php
+++ b/htdocs/projet/class/task.class.php
@@ -1661,7 +1661,7 @@ class Task extends CommonObject
if (!$error) {
$sql = "UPDATE ".MAIN_DB_PREFIX."projet_task";
$sql .= " SET duration_effective = duration_effective - ".$this->db->escape($this->timespent_duration ? $this->timespent_duration : 0);
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::delTimeSpent", LOG_DEBUG);
if ($this->db->query($sql)) {
diff --git a/htdocs/reception/class/reception.class.php b/htdocs/reception/class/reception.class.php
index e1e2c857bc0..948822c1983 100644
--- a/htdocs/reception/class/reception.class.php
+++ b/htdocs/reception/class/reception.class.php
@@ -288,7 +288,7 @@ class Reception extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."reception";
$sql .= " SET ref = '(PROV".$this->id.")'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::create", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -543,7 +543,7 @@ class Reception extends CommonObject
$sql .= ", fk_statut = 1";
$sql .= ", date_valid = '".$this->db->idate($now)."'";
$sql .= ", fk_user_valid = ".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::valid update reception", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -954,7 +954,7 @@ class Reception extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."reception";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
// Call trigger
@@ -1260,7 +1260,7 @@ class Reception extends CommonObject
if ($user->rights->reception->creer) {
$sql = "UPDATE ".MAIN_DB_PREFIX."reception";
$sql .= " SET date_delivery = ".($delivery_date ? "'".$this->db->idate($delivery_date)."'" : 'null');
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setDeliveryDate", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1755,7 +1755,7 @@ class Reception extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."reception";
$sql .= " SET fk_statut = ".self::STATUS_DRAFT;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(__METHOD__, LOG_DEBUG);
if ($this->db->query($sql)) {
diff --git a/htdocs/recruitment/class/recruitmentcandidature.class.php b/htdocs/recruitment/class/recruitmentcandidature.class.php
index 0069ce2d30f..3c5cf401a92 100644
--- a/htdocs/recruitment/class/recruitmentcandidature.class.php
+++ b/htdocs/recruitment/class/recruitmentcandidature.class.php
@@ -519,7 +519,7 @@ class RecruitmentCandidature extends CommonObject
if (!empty($this->fields['fk_user_valid'])) {
$sql .= ", fk_user_valid = ".$user->id;
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate()", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/recruitment/class/recruitmentjobposition.class.php b/htdocs/recruitment/class/recruitmentjobposition.class.php
index 892ba4121e9..7e44aad7b64 100644
--- a/htdocs/recruitment/class/recruitmentjobposition.class.php
+++ b/htdocs/recruitment/class/recruitmentjobposition.class.php
@@ -528,7 +528,7 @@ class RecruitmentJobPosition extends CommonObject
if (!empty($this->fields['fk_user_valid'])) {
$sql .= ", fk_user_valid = ".$user->id;
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate()", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -672,7 +672,7 @@ class RecruitmentJobPosition extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET status = ".((int) $status).", note_private = '".$this->db->escape($newprivatenote)."'";
//$sql .= ", date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/salaries/class/salary.class.php b/htdocs/salaries/class/salary.class.php
index cc50c57ec84..ab1e06f3b34 100644
--- a/htdocs/salaries/class/salary.class.php
+++ b/htdocs/salaries/class/salary.class.php
@@ -639,7 +639,7 @@ class Salary extends CommonObject
// phpcs:enable
$sql = "UPDATE ".MAIN_DB_PREFIX."salary SET";
$sql .= " paye = 1";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$return = $this->db->query($sql);
if ($return) return 1;
else return -1;
@@ -657,7 +657,7 @@ class Salary extends CommonObject
// phpcs:enable
$sql = "UPDATE ".MAIN_DB_PREFIX."salary SET";
$sql .= " paye = 0";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$return = $this->db->query($sql);
if ($return) return 1;
else return -1;
diff --git a/htdocs/societe/class/companybankaccount.class.php b/htdocs/societe/class/companybankaccount.class.php
index 9b767cde34c..f4e871fce83 100644
--- a/htdocs/societe/class/companybankaccount.class.php
+++ b/htdocs/societe/class/companybankaccount.class.php
@@ -171,7 +171,7 @@ class CompanyBankAccount extends Account
} else {
$sql .= ",label = NULL";
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php
index fa19b23e6cd..0dd3e31da01 100644
--- a/htdocs/societe/class/societe.class.php
+++ b/htdocs/societe/class/societe.class.php
@@ -2058,7 +2058,7 @@ class Societe extends CommonObject
}
$sql = "UPDATE ".MAIN_DB_PREFIX."societe";
$sql .= " SET client = ".((int) $newclient);
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -2102,7 +2102,7 @@ class Societe extends CommonObject
// Position current discount
$sql = "UPDATE ".MAIN_DB_PREFIX."societe ";
$sql .= " SET remise_client = '".$this->db->escape($remise)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->db->rollback();
@@ -2161,7 +2161,7 @@ class Societe extends CommonObject
// Position current discount
$sql = "UPDATE ".MAIN_DB_PREFIX."societe ";
$sql .= " SET remise_supplier = '".$this->db->escape($remise)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->db->rollback();
@@ -4685,7 +4685,7 @@ class Societe extends CommonObject
if ($this->id) {
$sql = "UPDATE ".MAIN_DB_PREFIX."societe";
$sql .= " SET fk_typent = ".($typent_id > 0 ? $typent_id : "null");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this).'::setThirdpartyType', LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php
index 3961fefedf2..1ffec54ed22 100644
--- a/htdocs/ticket/class/ticket.class.php
+++ b/htdocs/ticket/class/ticket.class.php
@@ -1402,7 +1402,7 @@ class Ticket extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."ticket";
$sql .= " SET fk_statut = ".Ticket::STATUS_READ.", date_read='".$this->db->idate(dol_now())."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::markAsRead");
$resql = $this->db->query($sql);
@@ -1460,7 +1460,7 @@ class Ticket extends CommonObject
} else {
$sql .= " SET fk_user_assign=null, fk_statut = ".Ticket::STATUS_READ;
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::assignUser sql=".$sql);
$resql = $this->db->query($sql);
@@ -1944,7 +1944,7 @@ class Ticket extends CommonObject
if ($this->id) {
$sql = "UPDATE ".MAIN_DB_PREFIX."ticket";
$sql .= " SET fk_soc = ".($id > 0 ? $id : "null");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this).'::setCustomer sql='.$sql);
$resql = $this->db->query($sql);
if ($resql) {
@@ -1968,7 +1968,7 @@ class Ticket extends CommonObject
if ($this->id) {
$sql = "UPDATE ".MAIN_DB_PREFIX."ticket";
$sql .= " SET progress = ".($percent > 0 ? $percent : "null");
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this).'::set_progression sql='.$sql);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/user/class/userbankaccount.class.php b/htdocs/user/class/userbankaccount.class.php
index 7323fb93ab2..d9392ade9d7 100644
--- a/htdocs/user/class/userbankaccount.class.php
+++ b/htdocs/user/class/userbankaccount.class.php
@@ -140,7 +140,7 @@ class UserBankAccount extends Account
} else {
$sql .= ",label = NULL";
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
diff --git a/htdocs/workstation/class/workstation.class.php b/htdocs/workstation/class/workstation.class.php
index 5cb6baf3565..03d1e6e3dd4 100755
--- a/htdocs/workstation/class/workstation.class.php
+++ b/htdocs/workstation/class/workstation.class.php
@@ -599,7 +599,7 @@ class Workstation extends CommonObject
if (!empty($this->fields['fk_user_valid'])) {
$sql .= ", fk_user_valid = ".$user->id;
}
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate()", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/test/phpunit/CodingPhpTest.php b/test/phpunit/CodingPhpTest.php
index 2d9bfeac49d..5ba74969107 100644
--- a/test/phpunit/CodingPhpTest.php
+++ b/test/phpunit/CodingPhpTest.php
@@ -286,9 +286,9 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$ok=true;
$matches=array();
- // Check sql string AND ... yyy = ".$xxx
+ // Check sql string DELETE|OR|AND|WHERE|INSERT ... yyy = ".$xxx
// with xxx that is not 'thi' (for $this->db->sanitize) and 'db-' (for $db->sanitize). It means we forget a ' if string or an (int) if int when forging sql request.
- preg_match_all('/(DELETE|OR|AND)\s.*([^\s][^\s][^\s])\s*=\s*"\s*\.\s*\$(...)/', $filecontent, $matches, PREG_SET_ORDER);
+ preg_match_all('/(DELETE|OR|AND|WHERE|INSERT)\s.*([^\s][^\s][^\s])\s*=\s*"\s*\.\s*\$(...)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
if ($val[2] == 'ity' && $val[3] == 'con') {
continue;
@@ -314,7 +314,7 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$this->assertTrue($ok, 'Found non escaped string in building of a sql request '.$file['relativename'].' - Bad.');
// Check string sql|set...'".$yyy->xxx with xxx that is not 'escape', 'idate', .... It means we forget a db->escape when forging sql request.
- preg_match_all('/(sql|SET).+\s*\'"\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
+ preg_match_all('/(sql|SET|WHERE).+\s*\'"\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
if (! in_array($val[2], array('this->db-', 'this->esc', 'db->escap', 'dbsession', 'db->idate', 'excludeGr', 'includeGr'))) {
$ok=false;
From b492d49908057dd06c8dfdbbd7e13a0985a21ba1 Mon Sep 17 00:00:00 2001
From: Florian HENRY
Date: Fri, 27 Aug 2021 17:27:05 +0200
Subject: [PATCH 099/953] add hidden option to display date and duration in
invoice generation from task time spent
---
htdocs/projet/tasks/time.php | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/htdocs/projet/tasks/time.php b/htdocs/projet/tasks/time.php
index 11913957bc5..c438f8c133a 100644
--- a/htdocs/projet/tasks/time.php
+++ b/htdocs/projet/tasks/time.php
@@ -462,6 +462,15 @@ if ($action == 'confirm_generateinvoice') {
$arrayoftasks[$object->timespent_id]['timespent'] = $object->timespent_duration;
$arrayoftasks[$object->timespent_id]['totalvaluetodivideby3600'] = $object->timespent_duration * $object->timespent_thm;
$arrayoftasks[$object->timespent_id]['note'] = $ftask->ref.' - '.$ftask->label.' - '.$username.($object->timespent_note ? ' - '.$object->timespent_note : ''); // TODO Add user name in note
+ if (!empty($conf->global->PROJECT_TIME_SPENT_INTO_INVOICE_ADD_TIME_DT)) {
+ $arrayoftasks[$object->timespent_id]['note'] = "\n";
+ if (!empty($object->timespent_withhour)) {
+ $arrayoftasks[$object->timespent_id]['note'] .= $langs->trans("Date") . ': ' . dol_print_date($object->timespent_datehour);
+ } else {
+ $arrayoftasks[$object->timespent_id]['note'] .= $langs->trans("Date") . ': ' . dol_print_date($object->timespent_date);
+ }
+ $arrayoftasks[$object->timespent_id]['note'] .= ' - '.$langs->trans("Duration").': '.convertSecondToTime($object->timespent_duration, 'all', $conf->global->MAIN_DURATION_OF_WORKDAY);
+ }
$arrayoftasks[$object->timespent_id]['user'] = $object->timespent_fk_user;
}
@@ -471,7 +480,6 @@ if ($action == 'confirm_generateinvoice') {
// Define qty per hour
$qtyhour = $value['timespent'] / 3600;
- $qtyhourtext = convertSecondToTime($value['timespent'], 'all', $conf->global->MAIN_DURATION_OF_WORKDAY);
// If no unit price known
if (empty($pu_ht)) {
@@ -851,6 +859,7 @@ if (($id > 0 || !empty($ref)) || $projectidforalltimes > 0) {
}
$massactionbutton = '';
+ $arrayofmassactions = array();
if ($projectstatic->usage_bill_time) {
$arrayofmassactions = array(
'generateinvoice'=>$langs->trans("GenerateBill"),
From 3b6559b1a623d39fc4b52d93f0b23408e0128e43 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Fri, 27 Aug 2021 18:18:50 +0200
Subject: [PATCH 100/953] Clean code by adding cast int.
---
.../class/rejetprelevement.class.php | 6 +--
htdocs/compta/tva/class/paymentvat.class.php | 2 +-
htdocs/contact/class/contact.class.php | 10 ++--
htdocs/contrat/card.php | 2 +-
htdocs/contrat/class/contrat.class.php | 20 ++++----
htdocs/core/boxes/box_produits.php | 4 +-
.../core/boxes/box_produits_alerte_stock.php | 4 +-
htdocs/core/class/commonobject.class.php | 30 ++++++------
htdocs/core/class/html.form.class.php | 2 +-
htdocs/core/db/pgsql.class.php | 6 +--
htdocs/core/lib/admin.lib.php | 4 +-
htdocs/core/lib/company.lib.php | 24 +++++-----
htdocs/core/lib/functions.lib.php | 6 ++-
htdocs/core/lib/functions2.lib.php | 6 +--
htdocs/core/lib/invoice.lib.php | 6 +--
htdocs/core/lib/project.lib.php | 6 +--
.../modules/mailings/modules_mailings.php | 6 +--
.../core/modules/modReceiptPrinter.class.php | 5 +-
.../stock/doc/pdf_standard.modules.php | 4 +-
htdocs/don/class/don.class.php | 2 +-
htdocs/expedition/class/expedition.class.php | 4 +-
htdocs/fourn/card.php | 6 +--
htdocs/fourn/class/fournisseur.class.php | 2 +-
.../class/fournisseur.commande.class.php | 6 +--
.../fourn/class/fournisseur.facture.class.php | 14 +++---
.../fourn/class/fournisseur.product.class.php | 6 +--
htdocs/fourn/commande/dispatch.php | 16 +++----
htdocs/fourn/facture/card.php | 5 +-
htdocs/fourn/facture/list.php | 2 +-
htdocs/holiday/class/holiday.class.php | 6 +--
htdocs/install/repair.php | 2 +-
htdocs/install/upgrade2.php | 46 +++++++++----------
htdocs/loan/class/loanschedule.class.php | 5 +-
.../mailmanspip/class/mailmanspip.class.php | 4 +-
htdocs/mrp/class/mo.class.php | 2 +-
htdocs/product/class/product.class.php | 40 ++++++++--------
.../class/productcustomerprice.class.php | 2 +-
.../class/propalmergepdfproduct.class.php | 2 +-
htdocs/product/fournisseurs.php | 2 +-
htdocs/product/list.php | 4 +-
htdocs/product/reassortlot.php | 5 +-
htdocs/product/stock/card.php | 4 +-
htdocs/product/stock/class/entrepot.class.php | 6 +--
htdocs/projet/class/project.class.php | 4 +-
htdocs/projet/class/task.class.php | 10 ++--
htdocs/resource/class/dolresource.class.php | 2 +-
htdocs/salaries/class/salary.class.php | 2 +-
.../class/companybankaccount.class.php | 2 +-
htdocs/societe/class/societe.class.php | 25 +++++-----
htdocs/stripe/class/stripe.class.php | 8 ++--
htdocs/takepos/floors.php | 8 ++--
htdocs/ticket/class/ticket.class.php | 2 +-
htdocs/user/bank.php | 8 ++--
htdocs/user/card.php | 6 +--
test/phpunit/CodingPhpTest.php | 5 +-
55 files changed, 215 insertions(+), 213 deletions(-)
diff --git a/htdocs/compta/prelevement/class/rejetprelevement.class.php b/htdocs/compta/prelevement/class/rejetprelevement.class.php
index db92da8ce90..4a515357495 100644
--- a/htdocs/compta/prelevement/class/rejetprelevement.class.php
+++ b/htdocs/compta/prelevement/class/rejetprelevement.class.php
@@ -222,8 +222,8 @@ class RejetPrelevement
$sql = "SELECT fk_user_demande";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_facture_demande as pfd";
- $sql .= " WHERE pfd.fk_prelevement_bons = ".$this->bon_id;
- $sql .= " AND pfd.fk_facture".($this->type == 'bank-transfer' ? '_fourn=' : '=').$fac->id;
+ $sql .= " WHERE pfd.fk_prelevement_bons = ".((int) $this->bon_id);
+ $sql .= " AND pfd.fk_facture".($this->type == 'bank-transfer' ? '_fourn' : '').' = '.((int) $fac->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -296,7 +296,7 @@ class RejetPrelevement
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."facture as f ON (pf.fk_facture = f.rowid)";
}
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."prelevement_lignes as pl ON (pf.fk_prelevement_lignes = pl.rowid)";
- $sql .= " WHERE pf.fk_prelevement_lignes = ".$this->id;
+ $sql .= " WHERE pf.fk_prelevement_lignes = ".((int) $this->id);
$sql .= " AND f.entity IN (".getEntity('invoice').")";
$resql = $this->db->query($sql);
diff --git a/htdocs/compta/tva/class/paymentvat.class.php b/htdocs/compta/tva/class/paymentvat.class.php
index bc234b4516e..8eaf141b06c 100644
--- a/htdocs/compta/tva/class/paymentvat.class.php
+++ b/htdocs/compta/tva/class/paymentvat.class.php
@@ -620,7 +620,7 @@ class PaymentVAT extends CommonObject
public function update_fk_bank($id_bank)
{
// phpcs:enable
- $sql = "UPDATE ".MAIN_DB_PREFIX."payment_vat SET fk_bank = ".((int) $id_bank)." WHERE rowid = ".$this->id;
+ $sql = "UPDATE ".MAIN_DB_PREFIX."payment_vat SET fk_bank = ".((int) $id_bank)." WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update_fk_bank", LOG_DEBUG);
$result = $this->db->query($sql);
diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php
index 83bc4202b9d..fd9830f36ca 100644
--- a/htdocs/contact/class/contact.class.php
+++ b/htdocs/contact/class/contact.class.php
@@ -595,7 +595,7 @@ class Contact extends CommonObject
$sql .= ", fk_user_modif=".($user->id > 0 ? "'".$this->db->escape($user->id)."'" : "NULL");
$sql .= ", default_lang=".($this->default_lang ? "'".$this->db->escape($this->default_lang)."'" : "NULL");
$sql .= ", entity = ".((int) $this->entity);
- $sql .= " WHERE rowid=".((int) $id);
+ $sql .= " WHERE rowid = ".((int) $id);
dol_syslog(get_class($this)."::update", LOG_DEBUG);
$result = $this->db->query($sql);
@@ -871,12 +871,12 @@ class Contact extends CommonObject
// Mis a jour contact
$sql = "UPDATE ".MAIN_DB_PREFIX."socpeople SET";
- $sql .= " birthday=".($this->birthday ? "'".$this->db->idate($this->birthday)."'" : "null");
+ $sql .= " birthday = ".($this->birthday ? "'".$this->db->idate($this->birthday)."'" : "null");
$sql .= ", photo = ".($this->photo ? "'".$this->db->escape($this->photo)."'" : "null");
if ($user) {
- $sql .= ", fk_user_modif=".$user->id;
+ $sql .= ", fk_user_modif = ".((int) $user->id);
}
- $sql .= " WHERE rowid=".$this->db->escape($id);
+ $sql .= " WHERE rowid = ".((int) $id);
dol_syslog(get_class($this)."::update_perso this->birthday=".$this->birthday." -", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1278,7 +1278,7 @@ class Contact extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."socpeople";
- $sql .= " WHERE rowid=".((int) $this->id);
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(__METHOD__, LOG_DEBUG);
$result = $this->db->query($sql);
if (!$result) {
diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php
index 470895a2c22..56e3d797086 100644
--- a/htdocs/contrat/card.php
+++ b/htdocs/contrat/card.php
@@ -1433,7 +1433,7 @@ if ($action == 'create') {
$sql .= " p.rowid as pid, p.ref as pref, p.label as plabel, p.fk_product_type as ptype, p.entity as pentity, p.tosell, p.tobuy, p.tobatch";
$sql .= " FROM ".MAIN_DB_PREFIX."contratdet as cd";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product as p ON cd.fk_product = p.rowid";
- $sql .= " WHERE cd.rowid = ".$object->lines[$cursorline - 1]->id;
+ $sql .= " WHERE cd.rowid = ".((int) $object->lines[$cursorline - 1]->id);
$result = $db->query($sql);
if ($result) {
diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php
index 9b2364f7233..65ffcb7e99a 100644
--- a/htdocs/contrat/class/contrat.class.php
+++ b/htdocs/contrat/class/contrat.class.php
@@ -507,7 +507,7 @@ class Contrat extends CommonObject
if ($num) {
$sql = "UPDATE ".MAIN_DB_PREFIX."contrat SET ref = '".$this->db->escape($num)."', statut = 1";
//$sql.= ", fk_user_valid = ".$user->id.", date_valid = '".$this->db->idate($now)."'";
- $sql .= " WHERE rowid = ".$this->id." AND statut = 0";
+ $sql .= " WHERE rowid = ".((int) $this->id)." AND statut = 0";
dol_syslog(get_class($this)."::validate", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -607,7 +607,7 @@ class Contrat extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."contrat SET statut = 0";
//$sql.= ", fk_user_valid = null, date_valid = null";
- $sql .= " WHERE rowid = ".$this->id." AND statut = 1";
+ $sql .= " WHERE rowid = ".((int) $this->id)." AND statut = 1";
dol_syslog(get_class($this)."::validate", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1197,7 +1197,7 @@ class Contrat extends CommonObject
// Delete contratdet extrafields
$main = MAIN_DB_PREFIX.'contratdet';
$ef = $main."_extrafields";
- $sql = "DELETE FROM $ef WHERE fk_object IN (SELECT rowid FROM $main WHERE fk_contrat = ".((int) $this->id).")";
+ $sql = "DELETE FROM ".$ef." WHERE fk_object IN (SELECT rowid FROM ".$main." WHERE fk_contrat = ".((int) $this->id).")";
dol_syslog(get_class($this)."::delete contratdet_extrafields", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2112,7 +2112,7 @@ class Contrat extends CommonObject
$sql = "SELECT cd.rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."contratdet as cd";
- $sql .= " WHERE fk_contrat =".$this->id;
+ $sql .= " WHERE fk_contrat =".((int) $this->id);
if ($status >= 0) {
$sql .= " AND statut = ".((int) $status);
}
@@ -2146,9 +2146,9 @@ class Contrat extends CommonObject
$sql = "SELECT c.rowid, c.ref";
$sql .= " FROM ".MAIN_DB_PREFIX."contrat as c";
- $sql .= " WHERE fk_soc =".$this->socid;
+ $sql .= " WHERE fk_soc =".((int) $this->socid);
if ($option == 'others') {
- $sql .= " AND c.rowid != ".$this->id;
+ $sql .= " AND c.rowid <> ".((int) $this->id);
}
dol_syslog(get_class($this)."::getOtherContracts()", LOG_DEBUG);
@@ -3332,10 +3332,10 @@ class ContratLigne extends CommonObjectLine
if ($date_end >= 0) {
$sql .= " date_fin_validite = ".(dol_strlen($date_end) != 0 ? "'".$this->db->idate($date_end)."'" : "null").",";
}
- $sql .= " fk_user_ouverture = ".$user->id.",";
+ $sql .= " fk_user_ouverture = ".((int) $user->id).",";
$sql .= " date_cloture = null,";
$sql .= " commentaire = '".$this->db->escape($comment)."'";
- $sql .= " WHERE rowid = ".$this->id." AND (statut = ".ContratLigne::STATUS_INITIAL." OR statut = ".ContratLigne::STATUS_CLOSED.")";
+ $sql .= " WHERE rowid = ".((int) $this->id)." AND (statut = ".ContratLigne::STATUS_INITIAL." OR statut = ".ContratLigne::STATUS_CLOSED.")";
dol_syslog(get_class($this)."::active_line", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -3396,9 +3396,9 @@ class ContratLigne extends CommonObjectLine
$sql = "UPDATE ".MAIN_DB_PREFIX."contratdet SET statut = ".((int) ContratLigne::STATUS_CLOSED).",";
$sql .= " date_cloture = '".$this->db->idate($date_end)."',";
- $sql .= " fk_user_cloture = ".$user->id.",";
+ $sql .= " fk_user_cloture = ".((int) $user->id).",";
$sql .= " commentaire = '".$this->db->escape($comment)."'";
- $sql .= " WHERE rowid = ".$this->id." AND statut = ".((int) ContratLigne::STATUS_OPEN);
+ $sql .= " WHERE rowid = ".((int) $this->id)." AND statut = ".((int) ContratLigne::STATUS_OPEN);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/core/boxes/box_produits.php b/htdocs/core/boxes/box_produits.php
index dde3b685d25..d039881445e 100644
--- a/htdocs/core/boxes/box_produits.php
+++ b/htdocs/core/boxes/box_produits.php
@@ -122,8 +122,8 @@ class box_produits extends ModeleBoxes
if (!empty($conf->global->MAIN_MULTILANGS)) { // si l'option est active
$sqld = "SELECT label";
$sqld .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sqld .= " WHERE fk_product=".$objp->rowid;
- $sqld .= " AND lang='".$this->db->escape($langs->getDefaultLang())."'";
+ $sqld .= " WHERE fk_product = ".((int) $objp->rowid);
+ $sqld .= " AND lang = '".$this->db->escape($langs->getDefaultLang())."'";
$sqld .= " LIMIT 1";
$resultd = $this->db->query($sqld);
diff --git a/htdocs/core/boxes/box_produits_alerte_stock.php b/htdocs/core/boxes/box_produits_alerte_stock.php
index d7ae1566a44..5e7ec72d0e1 100644
--- a/htdocs/core/boxes/box_produits_alerte_stock.php
+++ b/htdocs/core/boxes/box_produits_alerte_stock.php
@@ -129,8 +129,8 @@ class box_produits_alerte_stock extends ModeleBoxes
if (!empty($conf->global->MAIN_MULTILANGS)) { // si l'option est active
$sqld = "SELECT label";
$sqld .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sqld .= " WHERE fk_product=".$objp->rowid;
- $sqld .= " AND lang='".$this->db->escape($langs->getDefaultLang())."'";
+ $sqld .= " WHERE fk_product = ".((int) $objp->rowid);
+ $sqld .= " AND lang = '".$this->db->escape($langs->getDefaultLang())."'";
$sqld .= " LIMIT 1";
$resultd = $this->db->query($sqld);
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index 89d7cb1c7d0..a60e0680536 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -1224,7 +1224,7 @@ abstract class CommonObject
$listId = implode(",", $temp);
$sql = "DELETE FROM ".MAIN_DB_PREFIX."element_contact";
- $sql .= " WHERE element_id = ".$this->id;
+ $sql .= " WHERE element_id = ".((int) $this->id);
if ($listId) {
$sql .= " AND fk_c_type_contact IN (".$this->db->sanitize($listId).")";
}
@@ -1272,9 +1272,9 @@ abstract class CommonObject
if ($source == 'external' || $source == 'thirdparty') {
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."socpeople t on ec.fk_socpeople = t.rowid";
}
- $sql .= " WHERE ec.element_id =".$this->id;
+ $sql .= " WHERE ec.element_id = ".((int) $this->id);
$sql .= " AND ec.fk_c_type_contact=tc.rowid";
- $sql .= " AND tc.element='".$this->db->escape($this->element)."'";
+ $sql .= " AND tc.element = '".$this->db->escape($this->element)."'";
if ($code) {
$sql .= " AND tc.code = '".$this->db->escape($code)."'";
}
@@ -2658,7 +2658,7 @@ abstract class CommonObject
}
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ".$fieldname." = ".((int) $id);
- $sql .= " WHERE rowid = ".$this->id." AND fk_statut = 0";
+ $sql .= " WHERE rowid = ".((int) $this->id)." AND fk_statut = 0";
if ($this->db->query($sql)) {
$this->fk_delivery_address = $id;
@@ -3219,7 +3219,7 @@ abstract class CommonObject
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET ref_ext = '".$this->db->escape($ref_ext)."'";
- $sql .= " WHERE ".(isset($this->table_rowid) ? $this->table_rowid : 'rowid')." = ".$this->id;
+ $sql .= " WHERE ".(isset($this->table_rowid) ? $this->table_rowid : 'rowid')." = ".((int) $this->id);
dol_syslog(get_class($this)."::update_ref_ext", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -3270,8 +3270,8 @@ abstract class CommonObject
}
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET note".$newsuffix." = ".(!empty($note) ? ("'".$this->db->escape($note)."'") : "NULL");
- $sql .= " ,".$fieldusermod." = ".$user->id;
- $sql .= " WHERE rowid =".$this->id;
+ $sql .= ", ".$fieldusermod." = ".((int) $user->id);
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update_note", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -3440,7 +3440,7 @@ abstract class CommonObject
//var_dump($diff_when_using_price_ht.' '.$diff_on_current_total);
if ($diff_when_using_price_ht && $diff_on_current_total) {
- $sqlfix = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldtva." = ".$tmpcal[1].", total_ttc = ".$tmpcal[2]." WHERE rowid = ".$obj->rowid;
+ $sqlfix = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldtva." = ".price2num((float) $tmpcal[1]).", total_ttc = ".price2num((float) $tmpcal[2])." WHERE rowid = ".((int) $obj->rowid);
dol_syslog('We found unconsistent data into detailed line (diff_when_using_price_ht = '.$diff_when_using_price_ht.' and diff_on_current_total = '.$diff_on_current_total.') for line rowid = '.$obj->rowid." (total vat of line calculated=".$tmpcal[1].", database=".$obj->total_tva."). We fix the total_vat and total_ttc of line by running sqlfix = ".$sqlfix, LOG_WARNING);
$resqlfix = $this->db->query($sqlfix);
if (!$resqlfix) {
@@ -3484,7 +3484,7 @@ abstract class CommonObject
dol_print_error('', $errmsg);
exit;
}
- $sqlfix = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldtva." = ".($obj->total_tva - $diff).", total_ttc = ".($obj->total_ttc - $diff)." WHERE rowid = ".$obj->rowid;
+ $sqlfix = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldtva." = ".price2num($obj->total_tva - $diff).", total_ttc = ".price2num($obj->total_ttc - $diff)." WHERE rowid = ".((int) $obj->rowid);
dol_syslog('We found a difference of '.$diff.' for line rowid = '.$obj->rowid.". We fix the total_vat and total_ttc of line by running sqlfix = ".$sqlfix);
$resqlfix = $this->db->query($sqlfix);
if (!$resqlfix) {
@@ -4359,7 +4359,7 @@ abstract class CommonObject
$sql = "SELECT subprice as pu_ht, qty, remise_percent, total_ht";
$sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= " WHERE ".$this->fk_element." = ".$this->id;
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
dol_syslog(get_class($this).'::getTotalDiscount', LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -6135,7 +6135,7 @@ abstract class CommonObject
foreach ($new_array_languages as $key => $langcodearray) { // $key = 'name', 'town', ...
foreach ($langcodearray as $langcode => $value) {
$sql_del = "DELETE FROM ".MAIN_DB_PREFIX."object_lang";
- $sql_del .= " WHERE fk_object = ".$this->id." AND property = '".$this->db->escape($key)."' AND type_object = '".$this->db->escape($table_element)."'";
+ $sql_del .= " WHERE fk_object = ".((int) $this->id)." AND property = '".$this->db->escape($key)."' AND type_object = '".$this->db->escape($table_element)."'";
$sql_del .= " AND lang = '".$this->db->escape($langcode)."'";
$this->db->query($sql_del);
@@ -6319,7 +6319,7 @@ abstract class CommonObject
$linealreadyfound = 0;
// Check if there is already a line for this object (in most cases, it is, but sometimes it is not, for example when extra field has been created after), so we must keep this overload)
- $sql = "SELECT COUNT(rowid) as nb FROM ".MAIN_DB_PREFIX.$this->table_element."_extrafields WHERE fk_object = ".$this->id;
+ $sql = "SELECT COUNT(rowid) as nb FROM ".MAIN_DB_PREFIX.$this->table_element."_extrafields WHERE fk_object = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
$tmpobj = $this->db->fetch_object($resql);
@@ -6334,7 +6334,7 @@ abstract class CommonObject
} else {
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element."_extrafields SET ".$key." = '".$this->db->escape($this->array_options["options_".$key])."'";
}
- $sql .= " WHERE fk_object = ".$this->id;
+ $sql .= " WHERE fk_object = ".((int) $this->id);
} else {
$result = $this->insertExtraFields('', $user);
if ($result < 0) {
@@ -8576,7 +8576,7 @@ abstract class CommonObject
if (is_null($value)) {
return 'NULL';
} elseif (preg_match('/^(int|double|real|price)/i', $fieldsentry['type'])) {
- return $this->db->escape("$value");
+ return price2num("$value");
} elseif ($fieldsentry['type'] == 'boolean') {
if ($value) {
return 'true';
@@ -8776,7 +8776,7 @@ abstract class CommonObject
if (!empty($id)) {
$sql .= ' WHERE t.rowid = '.((int) $id);
} elseif (!empty($ref)) {
- $sql .= " WHERE t.ref = ".$this->quote($ref, $this->fields['ref']);
+ $sql .= " WHERE t.ref = '".$this->db->escape($ref)."'";
} else {
$sql .= ' WHERE 1 = 1'; // usage with empty id and empty ref is very rare
}
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 8c1550bcb4c..8f3c92a3c43 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -2625,7 +2625,7 @@ class Form
if ((!empty($conf->global->PRODUIT_CUSTOMER_PRICES_BY_QTY) || !empty($conf->global->PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES)) && !empty($objp->price_by_qty) && $objp->price_by_qty == 1) { // Price by quantity will return many prices for the same product
$sql = "SELECT rowid, quantity, price, unitprice, remise_percent, remise, price_base_type";
$sql .= " FROM ".MAIN_DB_PREFIX."product_price_by_qty";
- $sql .= " WHERE fk_product_price=".$objp->price_rowid;
+ $sql .= " WHERE fk_product_price = ".((int) $objp->price_rowid);
$sql .= " ORDER BY quantity ASC";
dol_syslog(get_class($this)."::select_produits_list search prices by qty", LOG_DEBUG);
diff --git a/htdocs/core/db/pgsql.class.php b/htdocs/core/db/pgsql.class.php
index 5245a9dac3c..6e9a4f54db6 100644
--- a/htdocs/core/db/pgsql.class.php
+++ b/htdocs/core/db/pgsql.class.php
@@ -924,11 +924,11 @@ class DoliDBPgsql extends DoliDB
// phpcs:enable
$listtables = array();
- $like = '';
+ $escapedlike = '';
if ($table) {
- $like = " AND table_name LIKE '".$this->escape($table)."'";
+ $escapedlike = " AND table_name LIKE '".$this->escape($table)."'";
}
- $result = pg_query($this->db, "SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'".$like." ORDER BY table_name");
+ $result = pg_query($this->db, "SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'".$escapedlike." ORDER BY table_name");
if ($result) {
while ($row = $this->fetch_row($result)) {
$listtables[] = $row[0];
diff --git a/htdocs/core/lib/admin.lib.php b/htdocs/core/lib/admin.lib.php
index ec12e397052..6361860e392 100644
--- a/htdocs/core/lib/admin.lib.php
+++ b/htdocs/core/lib/admin.lib.php
@@ -536,7 +536,7 @@ function dolibarr_get_const($db, $name, $entity = 1)
$sql = "SELECT ".$db->decrypt('value')." as value";
$sql .= " FROM ".MAIN_DB_PREFIX."const";
- $sql .= " WHERE name = ".$db->encrypt($name, 1);
+ $sql .= " WHERE name = '".$db->escape($db->encrypt($name))."'";
$sql .= " AND entity = ".((int) $entity);
dol_syslog("admin.lib::dolibarr_get_const", LOG_DEBUG);
@@ -583,7 +583,7 @@ function dolibarr_set_const($db, $name, $value, $type = 'chaine', $visible = 0,
$db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX."const";
- $sql .= " WHERE name = ".$db->encrypt($name, 1);
+ $sql .= " WHERE name = '".$db->escape($db->encrypt($name))."'";
if ($entity >= 0) {
$sql .= " AND entity = ".((int) $entity);
}
diff --git a/htdocs/core/lib/company.lib.php b/htdocs/core/lib/company.lib.php
index 4b536ccb2ad..8806bcc8b92 100644
--- a/htdocs/core/lib/company.lib.php
+++ b/htdocs/core/lib/company.lib.php
@@ -64,7 +64,7 @@ function societe_prepare_head(Societe $object)
} else {
$sql = "SELECT COUNT(p.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."socpeople as p";
- $sql .= " WHERE p.fk_soc = ".$object->id;
+ $sql .= " WHERE p.fk_soc = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -140,7 +140,7 @@ function societe_prepare_head(Societe $object)
} else {
$sql = "SELECT COUNT(n.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."projet as n";
- $sql .= " WHERE fk_soc = ".$object->id;
+ $sql .= " WHERE fk_soc = ".((int) $object->id);
$sql .= " AND entity IN (".getEntity('project').")";
$resql = $db->query($sql);
if ($resql) {
@@ -223,7 +223,7 @@ function societe_prepare_head(Societe $object)
$sql = "SELECT COUNT(n.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_rib as n";
- $sql .= " WHERE n.fk_soc = ".$object->id;
+ $sql .= " WHERE n.fk_soc = ".((int) $object->id);
if (empty($conf->stripe->enabled)) {
$sql .= " AND n.stripe_card_ref IS NULL";
} else {
@@ -240,7 +240,7 @@ function societe_prepare_head(Societe $object)
//if (! empty($conf->stripe->enabled) && $nbBankAccount > 0) $nbBankAccount = '...'; // No way to know exact number
- $head[$h][0] = DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id;
+ $head[$h][0] = DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.urlencode($object->id);
$head[$h][1] = $title;
if ($foundonexternalonlinesystem) {
$head[$h][1] .= '... ';
@@ -252,12 +252,12 @@ function societe_prepare_head(Societe $object)
}
if (!empty($conf->website->enabled) && (!empty($conf->global->WEBSITE_USE_WEBSITE_ACCOUNTS)) && (!empty($user->rights->societe->lire))) {
- $head[$h][0] = DOL_URL_ROOT.'/societe/website.php?id='.$object->id;
+ $head[$h][0] = DOL_URL_ROOT.'/societe/website.php?id='.urlencode($object->id);
$head[$h][1] = $langs->trans("WebSiteAccounts");
$nbNote = 0;
$sql = "SELECT COUNT(n.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_account as n";
- $sql .= " WHERE fk_soc = ".$object->id.' AND fk_website > 0';
+ $sql .= " WHERE fk_soc = ".((int) $object->id).' AND fk_website > 0';
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -304,7 +304,7 @@ function societe_prepare_head(Societe $object)
} else {
$sql = "SELECT COUNT(n.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."notify_def as n";
- $sql .= " WHERE fk_soc = ".$object->id;
+ $sql .= " WHERE fk_soc = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -315,7 +315,7 @@ function societe_prepare_head(Societe $object)
dol_setcache($cachekey, $nbNotif, 120); // If setting cache fails, this is not a problem, so we do not test result.
}
- $head[$h][0] = DOL_URL_ROOT.'/societe/notify/card.php?socid='.$object->id;
+ $head[$h][0] = DOL_URL_ROOT.'/societe/notify/card.php?socid='.urlencode($object->id);
$head[$h][1] = $langs->trans("Notifications");
if ($nbNotif > 0) {
$head[$h][1] .= ''.$nbNotif.' ';
@@ -332,7 +332,7 @@ function societe_prepare_head(Societe $object)
if (!empty($object->note_public)) {
$nbNote++;
}
- $head[$h][0] = DOL_URL_ROOT.'/societe/note.php?id='.$object->id;
+ $head[$h][0] = DOL_URL_ROOT.'/societe/note.php?id='.urlencode($object->id);
$head[$h][1] = $langs->trans("Notes");
if ($nbNote > 0) {
$head[$h][1] .= ''.$nbNote.' ';
@@ -380,7 +380,7 @@ function societe_prepare_head(Societe $object)
} else {
$sql = "SELECT COUNT(id) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."actioncomm";
- $sql .= " WHERE fk_soc = ".$object->id;
+ $sql .= " WHERE fk_soc = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -806,7 +806,7 @@ function show_projects($conf, $langs, $db, $object, $backtopage = '', $nocreatel
$sql .= ", cls.code as opp_status_code";
$sql .= " FROM ".MAIN_DB_PREFIX."projet as p";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_lead_status as cls on p.fk_opp_status = cls.rowid";
- $sql .= " WHERE p.fk_soc = ".$object->id;
+ $sql .= " WHERE p.fk_soc = ".((int) $object->id);
$sql .= " AND p.entity IN (".getEntity('project').")";
$sql .= " ORDER BY p.dateo DESC";
@@ -1083,7 +1083,7 @@ function show_contacts($conf, $langs, $db, $object, $backtopage = '')
$sql .= " t.civility as civility_id, t.address, t.zip, t.town";
$sql .= " FROM ".MAIN_DB_PREFIX."socpeople as t";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."socpeople_extrafields as ef on (t.rowid = ef.fk_object)";
- $sql .= " WHERE t.fk_soc = ".$object->id;
+ $sql .= " WHERE t.fk_soc = ".((int) $object->id);
if ($search_status != '' && $search_status != '-1') {
$sql .= " AND t.statut = ".((int) $search_status);
}
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index ee353269e29..ddfad586e7c 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -5273,8 +5273,10 @@ function price($amount, $form = 0, $outlangs = '', $trunc = 1, $rounding = -1, $
* @param int $option Put 1 if you know that content is already universal format number (so no correction on decimal will be done)
* Put 2 if you know that number is a user input (so we know we don't have to fix decimal separator).
* @return string Amount with universal numeric format (Example: '99.99999').
- * If conversion fails, it return text unchanged if ($rounding = '' and $option = 1) or '0' if ($rounding is defined and $option = 1).
- * If amount is null or '', it returns '' if $rounding = '' or '0' if $rounding is defined..
+ * If conversion fails to return a numeric, it returns:
+ * text unchanged or partial if ($rounding = ''): price2num('W9ç', '', 0) => '9ç', price2num('W9ç', '', 1) => 'W9ç', price2num('W9ç', '', 2) => '9ç'
+ * '0' if ($rounding is defined): price2num('W9ç', 'MT', 0) => '9', price2num('W9ç', 'MT', 1) => '0', price2num('W9ç', 'MT', 2) => '9'
+ * If amount is null or '', it returns '' if $rounding = '' or '0' if $rounding is defined.
*
* @see price() Opposite function of price2num
*/
diff --git a/htdocs/core/lib/functions2.lib.php b/htdocs/core/lib/functions2.lib.php
index d79f688391d..ae7acf44861 100644
--- a/htdocs/core/lib/functions2.lib.php
+++ b/htdocs/core/lib/functions2.lib.php
@@ -1790,8 +1790,8 @@ function dol_set_user_param($db, $conf, &$user, $tab)
// We remove old parameters for all keys in $tab
$sql = "DELETE FROM ".MAIN_DB_PREFIX."user_param";
- $sql .= " WHERE fk_user = ".$user->id;
- $sql .= " AND entity = ".$conf->entity;
+ $sql .= " WHERE fk_user = ".((int) $user->id);
+ $sql .= " AND entity = ".((int) $conf->entity);
$sql .= " AND param in (";
$i = 0;
foreach ($tab as $key => $value) {
@@ -1815,7 +1815,7 @@ function dol_set_user_param($db, $conf, &$user, $tab)
// Set new parameters
if ($value) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."user_param(fk_user,entity,param,value)";
- $sql .= " VALUES (".$user->id.",".$conf->entity.",";
+ $sql .= " VALUES (".((int) $user->id).",".$conf->entity.",";
$sql .= " '".$db->escape($key)."','".$db->escape($value)."')";
dol_syslog("functions2.lib::dol_set_user_param", LOG_DEBUG);
diff --git a/htdocs/core/lib/invoice.lib.php b/htdocs/core/lib/invoice.lib.php
index 8f6a97894b9..1f797c67d1b 100644
--- a/htdocs/core/lib/invoice.lib.php
+++ b/htdocs/core/lib/invoice.lib.php
@@ -47,7 +47,7 @@ function facture_prepare_head($object)
if (empty($conf->global->MAIN_DISABLE_CONTACTS_TAB)) {
$nbContact = count($object->liste_contact(-1, 'internal')) + count($object->liste_contact(-1, 'external'));
- $head[$h][0] = DOL_URL_ROOT.'/compta/facture/contact.php?facid='.$object->id;
+ $head[$h][0] = DOL_URL_ROOT.'/compta/facture/contact.php?facid='.urlencode($object->id);
$head[$h][1] = $langs->trans('ContactsAddresses');
if ($nbContact > 0) {
$head[$h][1] .= ''.$nbContact.' ';
@@ -60,7 +60,7 @@ function facture_prepare_head($object)
$nbStandingOrders = 0;
$sql = "SELECT COUNT(pfd.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_facture_demande as pfd";
- $sql .= " WHERE pfd.fk_facture = ".$object->id;
+ $sql .= " WHERE pfd.fk_facture = ".((int) $object->id);
$sql .= " AND pfd.ext_payment_id IS NULL";
$resql = $db->query($sql);
if ($resql) {
@@ -71,7 +71,7 @@ function facture_prepare_head($object)
} else {
dol_print_error($db);
}
- $head[$h][0] = DOL_URL_ROOT.'/compta/facture/prelevement.php?facid='.$object->id;
+ $head[$h][0] = DOL_URL_ROOT.'/compta/facture/prelevement.php?facid='.urlencode($object->id);
$head[$h][1] = $langs->trans('StandingOrders');
if ($nbStandingOrders > 0) {
$head[$h][1] .= ''.$nbStandingOrders.' ';
diff --git a/htdocs/core/lib/project.lib.php b/htdocs/core/lib/project.lib.php
index ddf3aa64382..73fc5295a99 100644
--- a/htdocs/core/lib/project.lib.php
+++ b/htdocs/core/lib/project.lib.php
@@ -353,7 +353,7 @@ function task_prepare_head($object)
//$sql .= " FROM ".MAIN_DB_PREFIX."projet_task_time as t, ".MAIN_DB_PREFIX."projet_task as pt, ".MAIN_DB_PREFIX."user as u";
//$sql .= " WHERE t.fk_user = u.rowid AND t.fk_task = pt.rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."projet_task_time as t";
- $sql .= " WHERE t.fk_task =".$object->id;
+ $sql .= " WHERE t.fk_task = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -364,7 +364,7 @@ function task_prepare_head($object)
dol_print_error($db);
}
- $head[$h][0] = DOL_URL_ROOT.'/projet/tasks/time.php?id='.$object->id.(GETPOST('withproject') ? '&withproject=1' : '');
+ $head[$h][0] = DOL_URL_ROOT.'/projet/tasks/time.php?id='.urlencode($object->id).(GETPOST('withproject') ? '&withproject=1' : '');
$head[$h][1] = $langs->trans("TimeSpent");
if ($nbTimeSpent > 0) {
$head[$h][1] .= '... ';
@@ -386,7 +386,7 @@ function task_prepare_head($object)
if (!empty($object->note_public)) {
$nbNote++;
}
- $head[$h][0] = DOL_URL_ROOT.'/projet/tasks/note.php?id='.$object->id.(GETPOST('withproject') ? '&withproject=1' : '');
+ $head[$h][0] = DOL_URL_ROOT.'/projet/tasks/note.php?id='.urlencode($object->id).(GETPOST('withproject') ? '&withproject=1' : '');
$head[$h][1] = $langs->trans('Notes');
if ($nbNote > 0) {
$head[$h][1] .= ''.$nbNote.' ';
diff --git a/htdocs/core/modules/mailings/modules_mailings.php b/htdocs/core/modules/mailings/modules_mailings.php
index 7c0aa2b19b5..de5feb233ad 100644
--- a/htdocs/core/modules/mailings/modules_mailings.php
+++ b/htdocs/core/modules/mailings/modules_mailings.php
@@ -208,7 +208,7 @@ class MailingTargets // This can't be abstract as it is used for some method
//Update the status to show thirdparty mail that don't want to be contacted anymore'
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles";
$sql .= " SET statut=3";
- $sql .= " WHERE fk_mailing=".$mailing_id." AND email in (SELECT email FROM ".MAIN_DB_PREFIX."societe where fk_stcomm=-1)";
+ $sql .= " WHERE fk_mailing = ".((int) $mailing_id)." AND email in (SELECT email FROM ".MAIN_DB_PREFIX."societe where fk_stcomm=-1)";
$sql .= " AND source_type='thirdparty'";
dol_syslog(__METHOD__.": mailing update status to display thirdparty mail that do not want to be contacted");
$result=$this->db->query($sql);
@@ -216,7 +216,7 @@ class MailingTargets // This can't be abstract as it is used for some method
//Update the status to show contact mail that don't want to be contacted anymore'
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles";
$sql .= " SET statut=3";
- $sql .= " WHERE fk_mailing=".$mailing_id." AND source_type='contact' AND (email in (SELECT sc.email FROM ".MAIN_DB_PREFIX."socpeople AS sc ";
+ $sql .= " WHERE fk_mailing = ".((int) $mailing_id)." AND source_type='contact' AND (email in (SELECT sc.email FROM ".MAIN_DB_PREFIX."socpeople AS sc ";
$sql .= " INNER JOIN ".MAIN_DB_PREFIX."societe s ON s.rowid=sc.fk_soc WHERE s.fk_stcomm=-1 OR no_email=1))";
dol_syslog(__METHOD__.": mailing update status to display contact mail that do not want to be contacted",LOG_DEBUG);
$result=$this->db->query($sql);
@@ -224,7 +224,7 @@ class MailingTargets // This can't be abstract as it is used for some method
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles";
$sql .= " SET statut=3";
- $sql .= " WHERE fk_mailing=".$mailing_id." AND email IN (SELECT mu.email FROM ".MAIN_DB_PREFIX."mailing_unsubscribe AS mu WHERE mu.entity IN ('".getEntity('mailing')."'))";
+ $sql .= " WHERE fk_mailing =" .((int) $mailing_id)." AND email IN (SELECT mu.email FROM ".MAIN_DB_PREFIX."mailing_unsubscribe AS mu WHERE mu.entity IN ('".getEntity('mailing')."'))";
dol_syslog(__METHOD__.":mailing update status to display emails that do not want to be contacted anymore", LOG_DEBUG);
$result = $this->db->query($sql);
diff --git a/htdocs/core/modules/modReceiptPrinter.class.php b/htdocs/core/modules/modReceiptPrinter.class.php
index ee87f4c57ba..1e26de93bcb 100644
--- a/htdocs/core/modules/modReceiptPrinter.class.php
+++ b/htdocs/core/modules/modReceiptPrinter.class.php
@@ -133,6 +133,7 @@ class modReceiptPrinter extends DolibarrModules
public function init($options = '')
{
global $conf, $langs;
+
// Clean before activation
$this->remove($options);
@@ -140,8 +141,8 @@ class modReceiptPrinter extends DolibarrModules
$sql = array(
"CREATE TABLE IF NOT EXISTS ".MAIN_DB_PREFIX."printer_receipt (rowid integer AUTO_INCREMENT PRIMARY KEY, name varchar(128), fk_type integer, fk_profile integer, parameter varchar(128), entity integer) ENGINE=innodb;",
"CREATE TABLE IF NOT EXISTS ".MAIN_DB_PREFIX."printer_receipt_template (rowid integer AUTO_INCREMENT PRIMARY KEY, name varchar(128), template text, entity integer) ENGINE=innodb;",
- "DELETE FROM ".MAIN_DB_PREFIX."printer_receipt_template WHERE name = '".$langs->trans('Example')."';",
- "INSERT INTO ".MAIN_DB_PREFIX."printer_receipt_template (name,template,entity) VALUES ('".$langs->trans('Example')."', '".$templateexample."', 1);",
+ "DELETE FROM ".MAIN_DB_PREFIX."printer_receipt_template WHERE name = '".$this->db->escape($langs->trans('Example'))."';",
+ "INSERT INTO ".MAIN_DB_PREFIX."printer_receipt_template (name,template,entity) VALUES ('".$this->db->escape($langs->trans('Example'))."', '".$this->db->escape($templateexample)."', 1);",
);
return $this->_init($sql, $options);
}
diff --git a/htdocs/core/modules/stock/doc/pdf_standard.modules.php b/htdocs/core/modules/stock/doc/pdf_standard.modules.php
index ebc109151d6..5374245cea4 100644
--- a/htdocs/core/modules/stock/doc/pdf_standard.modules.php
+++ b/htdocs/core/modules/stock/doc/pdf_standard.modules.php
@@ -337,8 +337,8 @@ class pdf_standard extends ModelePDFStock
if (!empty($conf->global->MAIN_MULTILANGS)) { // si l'option est active
$sql = "SELECT label";
$sql .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$objp->rowid;
- $sql .= " AND lang='".$this->db->escape($langs->getDefaultLang())."'";
+ $sql .= " WHERE fk_product = ".((int) $objp->rowid);
+ $sql .= " AND lang = '".$this->db->escape($langs->getDefaultLang())."'";
$sql .= " LIMIT 1";
$result = $this->db->query($sql);
diff --git a/htdocs/don/class/don.class.php b/htdocs/don/class/don.class.php
index 181b3fc0ca3..6bb4c99b86d 100644
--- a/htdocs/don/class/don.class.php
+++ b/htdocs/don/class/don.class.php
@@ -555,7 +555,7 @@ class Don extends CommonObject
// Delete donation
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."don_extrafields";
- $sql .= " WHERE fk_object=".$this->id;
+ $sql .= " WHERE fk_object = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/expedition/class/expedition.class.php b/htdocs/expedition/class/expedition.class.php
index a60f3c88c6a..42d290aa02f 100644
--- a/htdocs/expedition/class/expedition.class.php
+++ b/htdocs/expedition/class/expedition.class.php
@@ -2805,7 +2805,7 @@ class ExpeditionLigne extends CommonObjectLine
// delete batch expedition line
if ($conf->productbatch->enabled) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."expeditiondet_batch";
- $sql .= " WHERE fk_expeditiondet = ".$this->id;
+ $sql .= " WHERE fk_expeditiondet = ".((int) $this->id);
if (!$this->db->query($sql)) {
$this->errors[] = $this->db->lasterror()." - sql=$sql";
@@ -2951,7 +2951,7 @@ class ExpeditionLigne extends CommonObjectLine
if (!$error && !empty($expedition_batch_id)) {
// delete lot expedition line
$sql = "DELETE FROM ".MAIN_DB_PREFIX."expeditiondet_batch";
- $sql .= " WHERE fk_expeditiondet = ".$this->id;
+ $sql .= " WHERE fk_expeditiondet = ".((int) $this->id);
$sql .= " AND rowid = ".((int) $expedition_batch_id);
if (!$this->db->query($sql)) {
diff --git a/htdocs/fourn/card.php b/htdocs/fourn/card.php
index 866fd31318e..f37e96ba602 100644
--- a/htdocs/fourn/card.php
+++ b/htdocs/fourn/card.php
@@ -589,7 +589,7 @@ if ($object->id > 0) {
$sql = "SELECT p.rowid, p.ref, p.date_valid as dc, p.fk_statut, p.total_ht, p.total_tva, p.total_ttc";
$sql .= " FROM ".MAIN_DB_PREFIX."supplier_proposal as p ";
- $sql .= " WHERE p.fk_soc =".$object->id;
+ $sql .= " WHERE p.fk_soc = ".((int) $object->id);
$sql .= " AND p.entity IN (".getEntity('supplier_proposal').")";
$sql .= " ORDER BY p.date_valid DESC";
$sql .= $db->plimit($MAXLIST);
@@ -681,7 +681,7 @@ if ($object->id > 0) {
// TODO move to DAO class
$sql = "SELECT count(p.rowid) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseur as p";
- $sql .= " WHERE p.fk_soc =".$object->id;
+ $sql .= " WHERE p.fk_soc = ".((int) $object->id);
$sql .= " AND p.entity IN (".getEntity('commande_fournisseur').")";
$resql = $db->query($sql);
if ($resql) {
@@ -691,7 +691,7 @@ if ($object->id > 0) {
$sql = "SELECT p.rowid,p.ref, p.date_commande as dc, p.fk_statut, p.total_ht, p.total_tva, p.total_ttc";
$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseur as p";
- $sql .= " WHERE p.fk_soc =".$object->id;
+ $sql .= " WHERE p.fk_soc = ".((int) $object->id);
$sql .= " AND p.entity IN (".getEntity('commande_fournisseur').")";
$sql .= " ORDER BY p.date_commande DESC";
$sql .= $db->plimit($MAXLIST);
diff --git a/htdocs/fourn/class/fournisseur.class.php b/htdocs/fourn/class/fournisseur.class.php
index 121e699757c..805ed7c1ba6 100644
--- a/htdocs/fourn/class/fournisseur.class.php
+++ b/htdocs/fourn/class/fournisseur.class.php
@@ -59,7 +59,7 @@ class Fournisseur extends Societe
{
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseur as cf";
- $sql .= " WHERE cf.fk_soc = ".$this->id;
+ $sql .= " WHERE cf.fk_soc = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php
index 3d71fd46b11..d248ed44321 100644
--- a/htdocs/fourn/class/fournisseur.commande.class.php
+++ b/htdocs/fourn/class/fournisseur.commande.class.php
@@ -473,7 +473,7 @@ class CommandeFournisseur extends CommonOrder
if (!empty($conf->global->PRODUCT_USE_SUPPLIER_PACKAGING)) {
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_fournisseur_price as pfp ON l.fk_product = pfp.fk_product and l.ref = pfp.ref_fourn AND pfp.fk_soc = ".((int) $this->socid);
}
- $sql .= " WHERE l.fk_commande = ".$this->id;
+ $sql .= " WHERE l.fk_commande = ".((int) $this->id);
if ($only_product) {
$sql .= ' AND p.fk_product_type = 0';
}
@@ -627,7 +627,7 @@ class CommandeFournisseur extends CommonOrder
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'fournisseur/commande/".$this->db->escape($this->newref)."'";
- $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'fournisseur/commande/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
+ $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'fournisseur/commande/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++; $this->error = $this->db->lasterror();
@@ -2236,7 +2236,7 @@ class CommandeFournisseur extends CommonOrder
$sql .= " FROM ".MAIN_DB_PREFIX."product as p,";
$sql .= " ".MAIN_DB_PREFIX."commande_fournisseur_dispatch as cfd";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."entrepot as e ON cfd.fk_entrepot = e.rowid";
- $sql .= " WHERE cfd.fk_commande = ".$this->id;
+ $sql .= " WHERE cfd.fk_commande = ".((int) $this->id);
$sql .= " AND cfd.fk_product = p.rowid";
if ($status >= 0) {
$sql .= " AND cfd.status = ".((int) $status);
diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index f7c7ee26e1c..e8ec417edd7 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -2946,7 +2946,7 @@ class FactureFournisseur extends CommonInvoice
{
$isUsed = false;
- $sql = "SELECT fk_invoice_supplier FROM ".MAIN_DB_PREFIX."societe_remise_except WHERE fk_invoice_supplier_source=".$this->id;
+ $sql = "SELECT fk_invoice_supplier FROM ".MAIN_DB_PREFIX."societe_remise_except WHERE fk_invoice_supplier_source = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!empty($resql)) {
$obj = $this->db->fetch_object($resql);
@@ -3701,12 +3701,12 @@ class SupplierInvoiceLine extends CommonObjectLine
// Mise a jour ligne en base
$sql = "UPDATE ".MAIN_DB_PREFIX."facture_fourn_det SET";
- $sql .= " total_ht='".price2num($this->total_ht)."'";
- $sql .= ", tva='".price2num($this->total_tva)."'";
- $sql .= ", total_localtax1='".price2num($this->total_localtax1)."'";
- $sql .= ", total_localtax2='".price2num($this->total_localtax2)."'";
- $sql .= ", total_ttc='".price2num($this->total_ttc)."'";
- $sql .= " WHERE rowid = ".$this->rowid;
+ $sql .= " total_ht = ".price2num($this->total_ht);
+ $sql .= ", tva= ".price2num($this->total_tva);
+ $sql .= ", total_localtax1 = ".price2num($this->total_localtax1);
+ $sql .= ", total_localtax2 = ".price2num($this->total_localtax2);
+ $sql .= ", total_ttc = ".price2num($this->total_ttc);
+ $sql .= " WHERE rowid = ".((int) $this->rowid);
dol_syslog("FactureFournisseurLigne.class.php::update_total", LOG_DEBUG);
diff --git a/htdocs/fourn/class/fournisseur.product.class.php b/htdocs/fourn/class/fournisseur.product.class.php
index 3eaed8d27b8..b08d9237c63 100644
--- a/htdocs/fourn/class/fournisseur.product.class.php
+++ b/htdocs/fourn/class/fournisseur.product.class.php
@@ -164,7 +164,7 @@ class ProductFournisseur extends Product
$this->db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX."product_fournisseur_price";
- $sql .= " WHERE fk_product = ".$this->id." AND fk_soc = ".((int) $id_fourn);
+ $sql .= " WHERE fk_product = ".((int) $this->id)." AND fk_soc = ".((int) $id_fourn);
dol_syslog(get_class($this)."::remove_fournisseur", LOG_DEBUG);
$resql2 = $this->db->query($sql);
@@ -438,7 +438,7 @@ class ProductFournisseur extends Product
// Delete price for this quantity
$sql = "DELETE FROM ".MAIN_DB_PREFIX."product_fournisseur_price";
- $sql .= " WHERE fk_soc = ".$fourn->id." AND ref_fourn = '".$this->db->escape($ref_fourn)."' AND quantity = ".((float) $qty)." AND entity = ".$conf->entity;
+ $sql .= " WHERE fk_soc = ".((int) $fourn->id)." AND ref_fourn = '".$this->db->escape($ref_fourn)."' AND quantity = ".((float) $qty)." AND entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if ($resql) {
// Add price for this quantity to supplier
@@ -459,7 +459,7 @@ class ProductFournisseur extends Product
$sql .= " ".((int) $fourn->id).",";
$sql .= " '".$this->db->escape($ref_fourn)."',";
$sql .= " '".$this->db->escape($desc_fourn)."',";
- $sql .= " ".$user->id.",";
+ $sql .= " ".((int) $user->id).",";
$sql .= " ".price2num($buyprice).",";
$sql .= " ".((float) $qty).",";
$sql .= " ".((float) $remise_percent).",";
diff --git a/htdocs/fourn/commande/dispatch.php b/htdocs/fourn/commande/dispatch.php
index 09588389cb1..ead05251920 100644
--- a/htdocs/fourn/commande/dispatch.php
+++ b/htdocs/fourn/commande/dispatch.php
@@ -341,11 +341,11 @@ if ($action == 'dispatch' && $user->rights->fournisseur->commande->receptionner)
if (GETPOSTISSET($saveprice)) {
// TODO Use class
$sql = "UPDATE ".MAIN_DB_PREFIX."product_fournisseur_price";
- $sql .= " SET unitprice='".GETPOST($pu)."'";
- $sql .= ", price=".GETPOST($pu)."*quantity";
- $sql .= ", remise_percent='".(!empty($dto) ? $dto : 0)."'";
- $sql .= " WHERE fk_soc=".$object->socid;
- $sql .= " AND fk_product=".GETPOST($prod, 'int');
+ $sql .= " SET unitprice = ".price2num(GETPOST($pu), 'MU', 2);
+ $sql .= ", price = ".price2num(GETPOST($pu), 'MU', 2)." * quantity";
+ $sql .= ", remise_percent = ".price2num((empty($dto) ? 0 : $dto), 3, 2)."'";
+ $sql .= " WHERE fk_soc = ".((int) $object->socid);
+ $sql .= " AND fk_product=".((int) GETPOST($prod, 'int'));
$resql = $db->query($sql);
}
@@ -653,7 +653,7 @@ if ($id > 0 || !empty($ref)) {
$sql = "SELECT l.rowid, cfd.fk_product, sum(cfd.qty) as qty";
$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseur_dispatch as cfd";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."commande_fournisseurdet as l on l.rowid = cfd.fk_commandefourndet";
- $sql .= " WHERE cfd.fk_commande = ".$object->id;
+ $sql .= " WHERE cfd.fk_commande = ".((int) $object->id);
$sql .= " GROUP BY l.rowid, cfd.fk_product";
$resql = $db->query($sql);
@@ -689,7 +689,7 @@ if ($id > 0 || !empty($ref)) {
$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseurdet as l";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product as p ON l.fk_product=p.rowid";
- $sql .= " WHERE l.fk_commande = ".$object->id;
+ $sql .= " WHERE l.fk_commande = ".((int) $object->id);
if (empty($conf->global->STOCK_SUPPORTS_SERVICES)) {
$sql .= " AND l.product_type = 0";
}
@@ -1113,7 +1113,7 @@ if ($id > 0 || !empty($ref)) {
if ($conf->reception->enabled) {
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."reception as r ON cfd.fk_reception = r.rowid";
}
- $sql .= " WHERE cfd.fk_commande = ".$object->id;
+ $sql .= " WHERE cfd.fk_commande = ".((int) $object->id);
$sql .= " AND cfd.fk_product = p.rowid";
$sql .= " ORDER BY cfd.rowid ASC";
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index ae0d306b2cd..2f3fb2b0078 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -595,7 +595,7 @@ if (empty($reshook)) {
$sql = "SELECT re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc,";
$sql .= " re.description, re.fk_invoice_supplier_source";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re";
- $sql .= " WHERE fk_invoice_supplier = ".$object->id;
+ $sql .= " WHERE fk_invoice_supplier = ".((int) $object->id);
$resql = $db->query($sql);
if (!empty($resql)) {
while ($obj = $db->fetch_object($resql)) {
@@ -3132,11 +3132,10 @@ if ($action == 'create') {
$creditnoteamount = 0;
$depositamount = 0;
-
$sql = "SELECT re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc,";
$sql .= " re.description, re.fk_invoice_supplier_source";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re";
- $sql .= " WHERE fk_invoice_supplier = ".$object->id;
+ $sql .= " WHERE fk_invoice_supplier = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php
index 0d34a3790df..8f2aaadb8ea 100644
--- a/htdocs/fourn/facture/list.php
+++ b/htdocs/fourn/facture/list.php
@@ -344,7 +344,7 @@ if (empty($reshook)) {
$rsql .= " , u.rowid as user_id, u.lastname, u.firstname, u.login";
$rsql .= " FROM ".MAIN_DB_PREFIX."prelevement_facture_demande as pfd";
$rsql .= " , ".MAIN_DB_PREFIX."user as u";
- $rsql .= " WHERE fk_facture_fourn = ".$objecttmp->id;
+ $rsql .= " WHERE fk_facture_fourn = ".((int) $objecttmp->id);
$rsql .= " AND pfd.fk_user_demande = u.rowid";
$rsql .= " AND pfd.traite = 0";
$rsql .= " ORDER BY pfd.date_demande DESC";
diff --git a/htdocs/holiday/class/holiday.class.php b/htdocs/holiday/class/holiday.class.php
index 41af59a751b..ec7b4c463b6 100644
--- a/htdocs/holiday/class/holiday.class.php
+++ b/htdocs/holiday/class/holiday.class.php
@@ -719,7 +719,7 @@ class Holiday extends CommonObject
$error++;
}
$sql .= " ref = '".$this->db->escape($num)."'";
- $sql .= " WHERE rowid= ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
@@ -828,7 +828,7 @@ class Holiday extends CommonObject
} else {
$sql .= " detail_refuse = NULL";
}
- $sql .= " WHERE rowid= ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
@@ -937,7 +937,7 @@ class Holiday extends CommonObject
$sql .= " detail_refuse = NULL";
}
- $sql .= " WHERE rowid= ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$this->db->begin();
diff --git a/htdocs/install/repair.php b/htdocs/install/repair.php
index 5cfe9f66846..037c7ee4b82 100644
--- a/htdocs/install/repair.php
+++ b/htdocs/install/repair.php
@@ -929,7 +929,7 @@ if ($ok && GETPOST('clean_product_stock_batch', 'alpha')) {
// TODO If it fails, we must make update
//$sql2 ="UPDATE ".MAIN_DB_PREFIX."product_batch";
//$sql2.=" SET ".$obj->psrowid.", '000000', ".($obj->reel - $obj->reelbatch).")";
- //$sql2.=" WHERE fk_product_stock = ".$obj->psrowid"
+ //$sql2.=" WHERE fk_product_stock = ".((int) $obj->psrowid)
}
}
}
diff --git a/htdocs/install/upgrade2.php b/htdocs/install/upgrade2.php
index de34a38e82c..974dd4c8324 100644
--- a/htdocs/install/upgrade2.php
+++ b/htdocs/install/upgrade2.php
@@ -2097,7 +2097,7 @@ function migrate_commande_livraison($db, $langs, $conf)
$sqlu = "UPDATE ".MAIN_DB_PREFIX."livraison SET";
$sqlu .= " ref_client='".$db->escape($obj->ref_client)."'";
$sqlu .= ", date_livraison='".$db->idate($delivery_date)."'";
- $sqlu .= " WHERE rowid = ".$obj->rowid;
+ $sqlu .= " WHERE rowid = ".((int) $obj->rowid);
$resql3 = $db->query($sqlu);
if (!$resql3) {
$error++;
@@ -2170,11 +2170,11 @@ function migrate_detail_livraison($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sql = "UPDATE ".MAIN_DB_PREFIX."livraisondet SET";
- $sql .= " fk_product=".$obj->fk_product;
- $sql .= ",description='".$db->escape($obj->description)."'";
- $sql .= ",subprice='".$db->escape($obj->subprice)."'";
- $sql .= ",total_ht='".$db->escape($obj->total_ht)."'";
- $sql .= " WHERE fk_commande_ligne = ".$obj->rowid;
+ $sql .= " fk_product = ".((int) $obj->fk_product);
+ $sql .= ",description = '".$db->escape($obj->description)."'";
+ $sql .= ",subprice = ".price2num($obj->subprice);
+ $sql .= ",total_ht = ".price2num($obj->total_ht);
+ $sql .= " WHERE fk_commande_ligne = ".((int) $obj->rowid);
$resql2 = $db->query($sql);
if ($resql2) {
@@ -2188,8 +2188,8 @@ function migrate_detail_livraison($db, $langs, $conf)
$total_ht = $obju->total_ht + $obj->total_ht;
$sqlu = "UPDATE ".MAIN_DB_PREFIX."livraison SET";
- $sqlu .= " total_ht='".$db->escape($total_ht)."'";
- $sqlu .= " WHERE rowid=".$obj->fk_livraison;
+ $sqlu .= " total_ht = ".price2num($total_ht, 'MT');
+ $sqlu .= " WHERE rowid = ".((int) $obj->fk_livraison);
$resql4 = $db->query($sqlu);
if (!$resql4) {
$error++;
@@ -2266,8 +2266,8 @@ function migrate_stocks($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sql = "UPDATE ".MAIN_DB_PREFIX."product SET";
- $sql .= " stock = '".$db->escape($obj->total)."'";
- $sql .= " WHERE rowid=".$obj->fk_product;
+ $sql .= " stock = ".price2num($obj->total, 'MS');
+ $sql .= " WHERE rowid = ".((int) $obj->fk_product);
$resql2 = $db->query($sql);
if ($resql2) {
@@ -2330,7 +2330,7 @@ function migrate_menus($db, $langs, $conf)
$sql = "UPDATE ".MAIN_DB_PREFIX."menu SET";
$sql .= " enabled = '".$db->escape($obj->action)."'";
- $sql .= " WHERE rowid=".$obj->rowid;
+ $sql .= " WHERE rowid = ".((int) $obj->rowid);
$sql .= " AND enabled = '1'";
$resql2 = $db->query($sql);
@@ -2400,7 +2400,7 @@ function migrate_commande_deliveryaddress($db, $langs, $conf)
$sql = "UPDATE ".MAIN_DB_PREFIX."expedition SET";
$sql .= " fk_adresse_livraison = '".$db->escape($obj->fk_adresse_livraison)."'";
- $sql .= " WHERE rowid=".$obj->fk_expedition;
+ $sql .= " WHERE rowid = ".((int) $obj->fk_expedition);
$resql2 = $db->query($sql);
if (!$resql2) {
@@ -3049,7 +3049,7 @@ function migrate_shipping_delivery($db, $langs, $conf)
$result = $db->query($sqlInsert);
if ($result) {
$sqlUpdate = "UPDATE ".MAIN_DB_PREFIX."livraison SET fk_expedition = NULL";
- $sqlUpdate .= " WHERE rowid = ".$obj->rowid;
+ $sqlUpdate .= " WHERE rowid = ".((int) $obj->rowid);
$result = $db->query($sqlUpdate);
if (!$result) {
@@ -3137,7 +3137,7 @@ function migrate_shipping_delivery2($db, $langs, $conf)
$sqlUpdate = "UPDATE ".MAIN_DB_PREFIX."livraison SET";
$sqlUpdate .= " ref_customer = '".$db->escape($obj->ref_customer)."',";
$sqlUpdate .= " date_delivery = ".($obj->date_delivery ? "'".$db->escape($obj->date_delivery)."'" : 'null');
- $sqlUpdate .= " WHERE rowid = ".$obj->delivery_id;
+ $sqlUpdate .= " WHERE rowid = ".((int) $obj->delivery_id);
$result = $db->query($sqlUpdate);
if (!$result) {
@@ -3629,7 +3629,7 @@ function migrate_reset_blocked_log($db, $langs, $conf)
print 'Process entity '.$obj->entity;
- $sqlSearch = "SELECT count(rowid) as nb FROM ".MAIN_DB_PREFIX."blockedlog WHERE action = 'MODULE_SET' and entity = ".$obj->entity;
+ $sqlSearch = "SELECT count(rowid) as nb FROM ".MAIN_DB_PREFIX."blockedlog WHERE action = 'MODULE_SET' and entity = ".((int) $obj->entity);
$resqlSearch = $db->query($sqlSearch);
if ($resqlSearch) {
$objSearch = $db->fetch_object($resqlSearch);
@@ -3638,7 +3638,7 @@ function migrate_reset_blocked_log($db, $langs, $conf)
print ' - Record for entity must be reset...';
$sqlUpdate = "DELETE FROM ".MAIN_DB_PREFIX."blockedlog";
- $sqlUpdate .= " WHERE entity = ".$obj->entity;
+ $sqlUpdate .= " WHERE entity = ".((int) $obj->entity);
$resqlUpdate = $db->query($sqlUpdate);
if (!$resqlUpdate) {
$error++;
@@ -3725,7 +3725,7 @@ function migrate_remise_entity($db, $langs, $conf)
$sqlUpdate = "UPDATE ".MAIN_DB_PREFIX."societe_remise SET";
$sqlUpdate .= " entity = ".$obj->entity;
- $sqlUpdate .= " WHERE rowid = ".$obj->rowid;
+ $sqlUpdate .= " WHERE rowid = ".((int) $obj->rowid);
$result = $db->query($sqlUpdate);
if (!$result) {
@@ -3810,8 +3810,8 @@ function migrate_remise_except_entity($db, $langs, $conf)
$obj2 = $db->fetch_object($resql2);
$sqlUpdate = "UPDATE ".MAIN_DB_PREFIX."societe_remise_except SET";
- $sqlUpdate .= " entity = ".$obj2->entity;
- $sqlUpdate .= " WHERE rowid = ".$obj->rowid;
+ $sqlUpdate .= " entity = ".((int) $obj2->entity);
+ $sqlUpdate .= " WHERE rowid = ".((int) $obj->rowid);
$result = $db->query($sqlUpdate);
if (!$result) {
@@ -3880,8 +3880,8 @@ function migrate_user_rights_entity($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sqlUpdate = "UPDATE ".MAIN_DB_PREFIX."user_rights SET";
- $sqlUpdate .= " entity = ".$obj->entity;
- $sqlUpdate .= " WHERE fk_user = ".$obj->rowid;
+ $sqlUpdate .= " entity = ".((int) $obj->entity);
+ $sqlUpdate .= " WHERE fk_user = ".((int) $obj->rowid);
$result = $db->query($sqlUpdate);
if (!$result) {
@@ -3945,8 +3945,8 @@ function migrate_usergroup_rights_entity($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sqlUpdate = "UPDATE ".MAIN_DB_PREFIX."usergroup_rights SET";
- $sqlUpdate .= " entity = ".$obj->entity;
- $sqlUpdate .= " WHERE fk_usergroup = ".$obj->rowid;
+ $sqlUpdate .= " entity = ".((int) $obj->entity);
+ $sqlUpdate .= " WHERE fk_usergroup = ".((int) $obj->rowid);
$result = $db->query($sqlUpdate);
if (!$result) {
diff --git a/htdocs/loan/class/loanschedule.class.php b/htdocs/loan/class/loanschedule.class.php
index 126002eb47a..9beff9dd22e 100644
--- a/htdocs/loan/class/loanschedule.class.php
+++ b/htdocs/loan/class/loanschedule.class.php
@@ -498,7 +498,7 @@ class LoanSchedule extends CommonObject
$toinsert = array();
$sql = "SELECT l.rowid";
- $sql .= " FROM ".MAIN_DB_PREFIX."loan as l ";
+ $sql .= " FROM ".MAIN_DB_PREFIX."loan as l";
$sql .= " WHERE l.paid = 0";
$resql = $this->db->query($sql);
@@ -511,7 +511,8 @@ class LoanSchedule extends CommonObject
$this->db->begin();
$sql = "INSERT INTO ".MAIN_DB_PREFIX."payment_loan ";
$sql .= "(fk_loan,datec,tms,datep,amount_capital,amount_insurance,amount_interest,fk_typepayment,num_payment,note_private,note_public,fk_bank,fk_user_creat,fk_user_modif) ";
- $sql .= "SELECT fk_loan,datec,tms,datep,amount_capital,amount_insurance,amount_interest,fk_typepayment,num_payment,note_private,note_public,fk_bank,fk_user_creat,fk_user_modif FROM ".MAIN_DB_PREFIX."loan_schedule WHERE rowid =".$echid;
+ $sql .= "SELECT fk_loan,datec,tms,datep,amount_capital,amount_insurance,amount_interest,fk_typepayment,num_payment,note_private,note_public,fk_bank,fk_user_creat,fk_user_modif";
+ $sql .= " FROM ".MAIN_DB_PREFIX."loan_schedule WHERE rowid =".((int) $echid);
$res = $this->db->query($sql);
if ($res) {
$this->db->commit();
diff --git a/htdocs/mailmanspip/class/mailmanspip.class.php b/htdocs/mailmanspip/class/mailmanspip.class.php
index d08f6f65094..c5ce2292f6a 100644
--- a/htdocs/mailmanspip/class/mailmanspip.class.php
+++ b/htdocs/mailmanspip/class/mailmanspip.class.php
@@ -232,7 +232,7 @@ class MailmanSpip
$mydb = $this->connectSpip();
if ($mydb) {
- $query = "DELETE FROM spip_auteurs WHERE login='".$object->login."'";
+ $query = "DELETE FROM spip_auteurs WHERE login = '".$mydb->escape($object->login)."'";
$result = $mydb->query($query);
@@ -271,7 +271,7 @@ class MailmanSpip
$mydb = $this->connectSpip();
if ($mydb) {
- $query = "SELECT login FROM spip_auteurs WHERE login='".$object->login."'";
+ $query = "SELECT login FROM spip_auteurs WHERE login = '".$mydb->escape($object->login)."'";
$result = $mydb->query($query);
diff --git a/htdocs/mrp/class/mo.class.php b/htdocs/mrp/class/mo.class.php
index b00aa6e8b91..a0bc74bc4ad 100644
--- a/htdocs/mrp/class/mo.class.php
+++ b/htdocs/mrp/class/mo.class.php
@@ -546,7 +546,7 @@ class Mo extends CommonObject
$result = 0;
$sql = 'SELECT COUNT(rowid) as nb FROM '.MAIN_DB_PREFIX.'stock_mouvement as sm';
- $sql .= " WHERE sm.origintype = 'mo' and sm.fk_origin = ".$this->id;
+ $sql .= " WHERE sm.origintype = 'mo' and sm.fk_origin = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index fc8f5cc4720..ae2aca9fbc9 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -1446,8 +1446,8 @@ class Product extends CommonObject
if ($key == $current_lang) {
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$this->id;
- $sql .= " AND lang='".$this->db->escape($key)."'";
+ $sql .= " WHERE fk_product = ".((int) $this->id);
+ $sql .= " AND lang = '".$this->db->escape($key)."'";
$result = $this->db->query($sql);
@@ -1459,7 +1459,7 @@ class Product extends CommonObject
if (!empty($conf->global->PRODUCT_USE_OTHER_FIELD_IN_TRANSLATION)) {
$sql2 .= ", note='".$this->db->escape($this->other)."'";
}
- $sql2 .= " WHERE fk_product=".$this->id." AND lang='".$this->db->escape($key)."'";
+ $sql2 .= " WHERE fk_product = ".((int) $this->id)." AND lang = '".$this->db->escape($key)."'";
} else {
$sql2 = "INSERT INTO ".MAIN_DB_PREFIX."product_lang (fk_product, lang, label, description";
if (!empty($conf->global->PRODUCT_USE_OTHER_FIELD_IN_TRANSLATION)) {
@@ -1486,20 +1486,20 @@ class Product extends CommonObject
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$this->id;
- $sql .= " AND lang='".$this->db->escape($key)."'";
+ $sql .= " WHERE fk_product = ".((int) $this->id);
+ $sql .= " AND lang = '".$this->db->escape($key)."'";
$result = $this->db->query($sql);
if ($this->db->num_rows($result)) { // if there is already a description line for this language
$sql2 = "UPDATE ".MAIN_DB_PREFIX."product_lang";
$sql2 .= " SET ";
- $sql2 .= " label='".$this->db->escape($this->multilangs["$key"]["label"])."',";
- $sql2 .= " description='".$this->db->escape($this->multilangs["$key"]["description"])."'";
+ $sql2 .= " label = '".$this->db->escape($this->multilangs["$key"]["label"])."',";
+ $sql2 .= " description = '".$this->db->escape($this->multilangs["$key"]["description"])."'";
if (!empty($conf->global->PRODUCT_USE_OTHER_FIELD_IN_TRANSLATION)) {
- $sql2 .= ", note='".$this->db->escape($this->multilangs["$key"]["other"])."'";
+ $sql2 .= ", note = '".$this->db->escape($this->multilangs["$key"]["other"])."'";
}
- $sql2 .= " WHERE fk_product=".$this->id." AND lang='".$this->db->escape($key)."'";
+ $sql2 .= " WHERE fk_product = ".((int) $this->id)." AND lang = '".$this->db->escape($key)."'";
} else {
$sql2 = "INSERT INTO ".MAIN_DB_PREFIX."product_lang (fk_product, lang, label, description";
if (!empty($conf->global->PRODUCT_USE_OTHER_FIELD_IN_TRANSLATION)) {
@@ -1548,7 +1548,7 @@ class Product extends CommonObject
public function delMultiLangs($langtodelete, $user)
{
$sql = "DELETE FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$this->id." AND lang='".$this->db->escape($langtodelete)."'";
+ $sql .= " WHERE fk_product = ".((int) $this->id)." AND lang = '".$this->db->escape($langtodelete)."'";
dol_syslog(get_class($this).'::delMultiLangs', LOG_DEBUG);
$result = $this->db->query($sql);
@@ -1645,7 +1645,7 @@ class Product extends CommonObject
$sql = "SELECT lang, label, description, note as other";
$sql .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$this->id;
+ $sql .= " WHERE fk_product = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
@@ -1750,7 +1750,7 @@ class Product extends CommonObject
{
// phpcs:enable
$sql = "DELETE FROM ".MAIN_DB_PREFIX."product_price_by_qty";
- $sql .= " WHERE fk_product_price=".((int) $rowid);
+ $sql .= " WHERE fk_product_price = ".((int) $rowid);
$resql = $this->db->query($sql);
$sql = "DELETE FROM ".MAIN_DB_PREFIX."product_price";
@@ -2265,7 +2265,7 @@ class Product extends CommonObject
$separatedStock = false; // Set to true will count stock from subtable llx_product_stock. It is slower than using denormalized field 'stock', but it is required when using multientity and shared warehouses.
if (!empty($conf->global->MULTICOMPANY_PRODUCT_SHARING_ENABLED)) {
if (!empty($conf->global->MULTICOMPANY_PMP_PER_ENTITY_ENABLED)) {
- $checkPMPPerEntity = $this->db->query("SELECT pmp FROM " . MAIN_DB_PREFIX . "product_perentity WHERE fk_product = ".((int) $id)." AND entity = ".(int) $conf->entity);
+ $checkPMPPerEntity = $this->db->query("SELECT pmp FROM " . MAIN_DB_PREFIX . "product_perentity WHERE fk_product = ".((int) $id)." AND entity = ".(int) $conf->entity);
if ($this->db->num_rows($checkPMPPerEntity)>0) {
$separatedEntityPMP = true;
}
@@ -2470,7 +2470,7 @@ class Product extends CommonObject
{
$sql = "SELECT rowid, price, unitprice, quantity, remise_percent, remise, price_base_type";
$sql.= " FROM ".MAIN_DB_PREFIX."product_price_by_qty";
- $sql.= " WHERE fk_product_price = ".$this->prices_by_qty_id[$i];
+ $sql.= " WHERE fk_product_price = ".((int) $this->prices_by_qty_id[$i]);
$sql.= " ORDER BY quantity ASC";
$resultat=array();
$resql = $this->db->query($sql);
@@ -2578,7 +2578,7 @@ class Product extends CommonObject
if ($this->prices_by_qty[$i] == 1) {
$sql = "SELECT rowid, price, unitprice, quantity, remise_percent, remise, price_base_type";
$sql .= " FROM ".MAIN_DB_PREFIX."product_price_by_qty";
- $sql .= " WHERE fk_product_price = ".$this->prices_by_qty_id[$i];
+ $sql .= " WHERE fk_product_price = ".((int) $this->prices_by_qty_id[$i]);
$sql .= " ORDER BY quantity ASC";
$resultat = array();
$resql = $this->db->query($sql);
@@ -4062,9 +4062,9 @@ class Product extends CommonObject
}
$sql = 'UPDATE '.MAIN_DB_PREFIX.'product_association SET ';
- $sql .= 'qty='.$qty;
- $sql .= ',incdec='.$incdec;
- $sql .= ' WHERE fk_product_pere='.$id_pere.' AND fk_product_fils='.$id_fils;
+ $sql .= 'qty = '.price2num($qty, 'MS');
+ $sql .= ',incdec = '.price2num($incdec, 'MS');
+ $sql .= ' WHERE fk_product_pere = '.((int) $id_pere).' AND fk_product_fils = '.((int) $id_fils);
if (!$this->db->query($sql)) {
dol_print_error($this->db);
@@ -4569,7 +4569,7 @@ class Product extends CommonObject
public function hasVariants()
{
$nb = 0;
- $sql = "SELECT count(rowid) as nb FROM ".MAIN_DB_PREFIX."product_attribute_combination WHERE fk_product_parent = ".$this->id;
+ $sql = "SELECT count(rowid) as nb FROM ".MAIN_DB_PREFIX."product_attribute_combination WHERE fk_product_parent = ".((int) $this->id);
$sql .= " AND entity IN (".getEntity('product').")";
$resql = $this->db->query($sql);
@@ -4593,7 +4593,7 @@ class Product extends CommonObject
{
global $conf;
if (!empty($conf->variants->enabled)) {
- $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."product_attribute_combination WHERE fk_product_child = ".$this->id." AND entity IN (".getEntity('product').")";
+ $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."product_attribute_combination WHERE fk_product_child = ".((int) $this->id)." AND entity IN (".getEntity('product').")";
$query = $this->db->query($sql);
diff --git a/htdocs/product/class/productcustomerprice.class.php b/htdocs/product/class/productcustomerprice.class.php
index 0683732d6cb..07590099571 100644
--- a/htdocs/product/class/productcustomerprice.class.php
+++ b/htdocs/product/class/productcustomerprice.class.php
@@ -721,7 +721,7 @@ class Productcustomerprice extends CommonObject
$sql .= " t.import_key";
$sql .= " FROM ".MAIN_DB_PREFIX."product_customer_price as t";
- $sql .= " WHERE t.rowid = ".$this->id;
+ $sql .= " WHERE t.rowid = ".((int) $this->id);
$this->db->begin();
dol_syslog(get_class($this)."::update", LOG_DEBUG);
diff --git a/htdocs/product/class/propalmergepdfproduct.class.php b/htdocs/product/class/propalmergepdfproduct.class.php
index 67c24ac37c8..99b7e7e188b 100644
--- a/htdocs/product/class/propalmergepdfproduct.class.php
+++ b/htdocs/product/class/propalmergepdfproduct.class.php
@@ -445,7 +445,7 @@ class Propalmergepdfproduct extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product";
- $sql .= " WHERE fk_product=".$this->fk_product." AND file_name='".$this->db->escape($this->file_name)."'";
+ $sql .= " WHERE fk_product = ".((int) $this->fk_product)." AND file_name = '".$this->db->escape($this->file_name)."'";
dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/product/fournisseurs.php b/htdocs/product/fournisseurs.php
index 97f29de72f6..9451fec435e 100644
--- a/htdocs/product/fournisseurs.php
+++ b/htdocs/product/fournisseurs.php
@@ -272,7 +272,7 @@ if (empty($reshook)) {
$extralabels = $extrafields->fetch_name_optionals_label("product_fournisseur_price");
$extrafield_values = $extrafields->getOptionalsFromPost("product_fournisseur_price");
if (!empty($extrafield_values)) {
- $resql = $db->query("SELECT fk_object FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".$object->product_fourn_price_id);
+ $resql = $db->query("SELECT fk_object FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".((int) $object->product_fourn_price_id));
// Insert a new extrafields row, if none exists
if ($db->num_rows($resql) != 1) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields (fk_object, ";
diff --git a/htdocs/product/list.php b/htdocs/product/list.php
index a975dc2c21b..ff21caf96f9 100644
--- a/htdocs/product/list.php
+++ b/htdocs/product/list.php
@@ -1253,8 +1253,8 @@ if ($resql) {
if (!empty($conf->global->MAIN_MULTILANGS)) { // If multilang is enabled
$sql = "SELECT label";
$sql .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$obj->rowid;
- $sql .= " AND lang='".$db->escape($langs->getDefaultLang())."'";
+ $sql .= " WHERE fk_product = ".((int) $obj->rowid);
+ $sql .= " AND lang = '".$db->escape($langs->getDefaultLang())."'";
$sql .= " LIMIT 1";
$result = $db->query($sql);
diff --git a/htdocs/product/reassortlot.php b/htdocs/product/reassortlot.php
index 65e69b91384..2380b4103a2 100644
--- a/htdocs/product/reassortlot.php
+++ b/htdocs/product/reassortlot.php
@@ -393,8 +393,8 @@ if ($resql) {
if (!empty($conf->global->MAIN_MULTILANGS)) { // si l'option est active
$sql = "SELECT label";
$sql .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$objp->rowid;
- $sql .= " AND lang='".$db->escape($langs->getDefaultLang())."'";
+ $sql .= " WHERE fk_product = ".((int) $objp->rowid);
+ $sql .= " AND lang = '".$db->escape($langs->getDefaultLang())."'";
$sql .= " LIMIT 1";
$result = $db->query($sql);
@@ -406,7 +406,6 @@ if ($resql) {
}
}
-
$product_static->ref = $objp->ref;
$product_static->id = $objp->rowid;
$product_static->label = $objp->label;
diff --git a/htdocs/product/stock/card.php b/htdocs/product/stock/card.php
index 6760da10cb0..7defecb7c62 100644
--- a/htdocs/product/stock/card.php
+++ b/htdocs/product/stock/card.php
@@ -662,8 +662,8 @@ if ($action == 'create') {
if (!empty($conf->global->MAIN_MULTILANGS)) { // si l'option est active
$sql = "SELECT label";
$sql .= " FROM ".MAIN_DB_PREFIX."product_lang";
- $sql .= " WHERE fk_product=".$objp->rowid;
- $sql .= " AND lang='".$db->escape($langs->getDefaultLang())."'";
+ $sql .= " WHERE fk_product = ".((int) $objp->rowid);
+ $sql .= " AND lang = '".$db->escape($langs->getDefaultLang())."'";
$sql .= " LIMIT 1";
$result = $db->query($sql);
diff --git a/htdocs/product/stock/class/entrepot.class.php b/htdocs/product/stock/class/entrepot.class.php
index 55ee6abf8fa..04dcddb8fab 100644
--- a/htdocs/product/stock/class/entrepot.class.php
+++ b/htdocs/product/stock/class/entrepot.class.php
@@ -366,7 +366,7 @@ class Entrepot extends CommonObject
foreach ($elements as $table) {
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX.$table;
- $sql .= " WHERE fk_entrepot = ".$this->id;
+ $sql .= " WHERE fk_entrepot = ".((int) $this->id);
$result = $this->db->query($sql);
if (!$result) {
@@ -585,7 +585,7 @@ class Entrepot extends CommonObject
$sql = "SELECT count(distinct p.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."product_stock as ps";
$sql .= ", ".MAIN_DB_PREFIX."product as p";
- $sql .= " WHERE ps.fk_entrepot = ".$this->id;
+ $sql .= " WHERE ps.fk_entrepot = ".((int) $this->id);
$sql .= " AND ps.fk_product = p.rowid";
//print $sql;
@@ -630,7 +630,7 @@ class Entrepot extends CommonObject
if ($separatedPMP) {
$sql .= ", ".MAIN_DB_PREFIX."product_perentity as pa";
}
- $sql .= " WHERE ps.fk_entrepot = ".$this->id;
+ $sql .= " WHERE ps.fk_entrepot = ".((int) $this->id);
if ($separatedPMP) {
$sql .= " AND pa.fk_product = p.rowid AND pa.entity = ". (int) $conf->entity;
}
diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php
index 16501940949..02939ead090 100644
--- a/htdocs/projet/class/project.class.php
+++ b/htdocs/projet/class/project.class.php
@@ -867,7 +867,7 @@ class Project extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."projet_extrafields";
- $sql .= " WHERE fk_object=".$this->id;
+ $sql .= " WHERE fk_object = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -944,7 +944,7 @@ class Project extends CommonObject
}
if ($type == 'agenda') {
- $sql = "SELECT COUNT(id) as nb FROM ".MAIN_DB_PREFIX."actioncomm WHERE fk_project = ".$this->id." AND entity IN (".getEntity('agenda').")";
+ $sql = "SELECT COUNT(id) as nb FROM ".MAIN_DB_PREFIX."actioncomm WHERE fk_project = ".((int) $this->id)." AND entity IN (".getEntity('agenda').")";
} elseif ($type == 'expensereport') {
$sql = "SELECT COUNT(ed.rowid) as nb FROM ".MAIN_DB_PREFIX."expensereport as e, ".MAIN_DB_PREFIX."expensereport_det as ed WHERE e.rowid = ed.fk_expensereport AND e.entity IN (".getEntity('expensereport').") AND ed.fk_projet = ".((int) $this->id);
} elseif ($type == 'project_task') {
diff --git a/htdocs/projet/class/task.class.php b/htdocs/projet/class/task.class.php
index 70a38a6818b..53973f7672e 100644
--- a/htdocs/projet/class/task.class.php
+++ b/htdocs/projet/class/task.class.php
@@ -519,7 +519,7 @@ class Task extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."projet_task_time";
- $sql .= " WHERE fk_task=".$this->id;
+ $sql .= " WHERE fk_task = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -529,7 +529,7 @@ class Task extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."projet_task_extrafields";
- $sql .= " WHERE fk_object=".$this->id;
+ $sql .= " WHERE fk_object = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -603,7 +603,7 @@ class Task extends CommonObject
$sql = "SELECT COUNT(*) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."projet_task";
- $sql .= " WHERE fk_task_parent=".$this->id;
+ $sql .= " WHERE fk_task_parent = ".((int) $this->id);
dol_syslog(get_class($this)."::hasChildren", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -636,7 +636,7 @@ class Task extends CommonObject
$sql = "SELECT COUNT(*) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."projet_task_time";
- $sql .= " WHERE fk_task=".$this->id;
+ $sql .= " WHERE fk_task = ".((int) $this->id);
dol_syslog(get_class($this)."::hasTimeSpent", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1639,7 +1639,7 @@ class Task extends CommonObject
$this->db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX."projet_task_time";
- $sql .= " WHERE rowid = ".$this->timespent_id;
+ $sql .= " WHERE rowid = ".((int) $this->timespent_id);
dol_syslog(get_class($this)."::delTimeSpent", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/resource/class/dolresource.class.php b/htdocs/resource/class/dolresource.class.php
index 91f68951842..b7f16a9ff9d 100644
--- a/htdocs/resource/class/dolresource.class.php
+++ b/htdocs/resource/class/dolresource.class.php
@@ -360,7 +360,7 @@ class Dolresource extends CommonObject
$sql .= " t.fk_user_create,";
$sql .= " t.tms";
$sql .= " FROM ".MAIN_DB_PREFIX."element_resources as t";
- $sql .= " WHERE t.rowid = ".$this->db->escape($id);
+ $sql .= " WHERE t.rowid = ".((int) $id);
dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/salaries/class/salary.class.php b/htdocs/salaries/class/salary.class.php
index ab1e06f3b34..17274813ef5 100644
--- a/htdocs/salaries/class/salary.class.php
+++ b/htdocs/salaries/class/salary.class.php
@@ -286,7 +286,7 @@ class Salary extends CommonObject
/*if (!$error)
{
$sql = "DELETE FROM ".MAIN_DB_PREFIX."salary_extrafields";
- $sql .= " WHERE fk_object=".$this->id;
+ $sql .= " WHERE fk_object = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql)
diff --git a/htdocs/societe/class/companybankaccount.class.php b/htdocs/societe/class/companybankaccount.class.php
index f4e871fce83..24e8c40165b 100644
--- a/htdocs/societe/class/companybankaccount.class.php
+++ b/htdocs/societe/class/companybankaccount.class.php
@@ -292,7 +292,7 @@ class CompanyBankAccount extends Account
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."societe_rib";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if (!$this->db->query($sql)) {
$error++;
diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php
index 0dd3e31da01..555fa3b05e1 100644
--- a/htdocs/societe/class/societe.class.php
+++ b/htdocs/societe/class/societe.class.php
@@ -917,7 +917,7 @@ class Societe extends CommonObject
// update accountancy for this entity
if (!$error && !empty($conf->global->MAIN_COMPANY_PERENTITY_SHARED)) {
- $this->db->query("DELETE FROM " . MAIN_DB_PREFIX . "societe_perentity WHERE fk_soc = " . $this->id . " AND entity = " . $conf->entity);
+ $this->db->query("DELETE FROM " . MAIN_DB_PREFIX . "societe_perentity WHERE fk_soc = " . ((int) $this->id) . " AND entity = " . ((int) $conf->entity));
$sql = "INSERT INTO " . MAIN_DB_PREFIX . "societe_perentity (";
$sql .= " fk_soc";
@@ -1535,7 +1535,7 @@ class Societe extends CommonObject
// update accountancy for this entity
if (!$error && !empty($conf->global->MAIN_COMPANY_PERENTITY_SHARED)) {
- $this->db->query("DELETE FROM " . MAIN_DB_PREFIX . "societe_perentity WHERE fk_soc = " . $this->id . " AND entity = " . $conf->entity);
+ $this->db->query("DELETE FROM " . MAIN_DB_PREFIX . "societe_perentity WHERE fk_soc = " . ((int) $this->id) . " AND entity = " . ((int) $conf->entity));
$sql = "INSERT INTO " . MAIN_DB_PREFIX . "societe_perentity (";
$sql .= " fk_soc";
@@ -2401,7 +2401,7 @@ class Societe extends CommonObject
if (!$error) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."societe_commerciaux";
- $sql .= " WHERE fk_soc = ".$this->id." AND fk_user = ".((int) $commid);
+ $sql .= " WHERE fk_soc = ".((int) $this->id)." AND fk_user = ".((int) $commid);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -2413,7 +2413,7 @@ class Societe extends CommonObject
if (!$error) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."societe_commerciaux";
$sql .= " (fk_soc, fk_user)";
- $sql .= " VALUES (".$this->id.", ".$commid.")";
+ $sql .= " VALUES (".((int) $this->id).", ".((int) $commid).")";
$resql = $this->db->query($sql);
if (!$resql) {
@@ -2423,7 +2423,7 @@ class Societe extends CommonObject
}
if (!$error) {
- $this->context = array('commercial_modified'=>$commid);
+ $this->context = array('commercial_modified' => $commid);
$result = $this->call_trigger('COMPANY_LINK_SALE_REPRESENTATIVE', $user);
if ($result < 0) {
@@ -2464,7 +2464,7 @@ class Societe extends CommonObject
if ($this->id > 0 && $commid > 0) {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."societe_commerciaux ";
- $sql .= " WHERE fk_soc = ".$this->id." AND fk_user = ".((int) $commid);
+ $sql .= " WHERE fk_soc = ".((int) $this->id)." AND fk_user = ".((int) $commid);
if (!$this->db->query($sql)) {
dol_syslog(get_class($this)."::del_commercial Erreur");
@@ -2837,7 +2837,7 @@ class Societe extends CommonObject
$sql = "SELECT rowid, email, statut as status, phone_mobile, lastname, poste, firstname";
$sql .= " FROM ".MAIN_DB_PREFIX."socpeople";
- $sql .= " WHERE fk_soc = ".$this->id;
+ $sql .= " WHERE fk_soc = ".((int) $this->id);
$sql .= " ORDER BY lastname, firstname";
$resql = $this->db->query($sql);
@@ -2897,7 +2897,7 @@ class Societe extends CommonObject
// phpcs:enable
$contacts = array();
- $sql = "SELECT rowid, lastname, firstname FROM ".MAIN_DB_PREFIX."socpeople WHERE fk_soc = ".$this->id;
+ $sql = "SELECT rowid, lastname, firstname FROM ".MAIN_DB_PREFIX."socpeople WHERE fk_soc = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
$nump = $this->db->num_rows($resql);
@@ -2927,7 +2927,7 @@ class Societe extends CommonObject
require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
$contacts = array();
- $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."socpeople WHERE fk_soc = ".$this->id;
+ $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."socpeople WHERE fk_soc = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
$nump = $this->db->num_rows($resql);
@@ -3743,7 +3743,7 @@ class Societe extends CommonObject
public function has_projects()
{
// phpcs:enable
- $sql = 'SELECT COUNT(*) as numproj FROM '.MAIN_DB_PREFIX.'projet WHERE fk_soc = '.$this->id;
+ $sql = 'SELECT COUNT(*) as numproj FROM '.MAIN_DB_PREFIX.'projet WHERE fk_soc = '.((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
$obj = $this->db->fetch_object($resql);
@@ -4761,6 +4761,7 @@ class Societe extends CommonObject
$this->db->begin();
+ $field = 'accountancy_code_sell';
if ($type == 'buy') {
$field = 'accountancy_code_buy';
} elseif ($type == 'sell') {
@@ -4770,8 +4771,8 @@ class Societe extends CommonObject
}
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ";
- $sql.= "$field = '".$this->db->escape($value)."'";
- $sql.= " WHERE rowid = ".$this->id;
+ $sql.= $field." = '".$this->db->escape($value)."'";
+ $sql.= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::".__FUNCTION__." sql=".$sql, LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/stripe/class/stripe.class.php b/htdocs/stripe/class/stripe.class.php
index 5614b3c6138..c671ac9c396 100644
--- a/htdocs/stripe/class/stripe.class.php
+++ b/htdocs/stripe/class/stripe.class.php
@@ -170,7 +170,7 @@ class Stripe extends CommonObject
$sql = "SELECT sa.key_account as key_account, sa.entity"; // key_account is cus_....
$sql .= " FROM ".MAIN_DB_PREFIX."societe_account as sa";
- $sql .= " WHERE sa.fk_soc = ".$object->id;
+ $sql .= " WHERE sa.fk_soc = ".((int) $object->id);
$sql .= " AND sa.entity IN (".getEntity('societe').")";
$sql .= " AND sa.site = 'stripe' AND sa.status = ".((int) $status);
$sql .= " AND (sa.site_account IS NULL OR sa.site_account = '' OR sa.site_account = '".$this->db->escape($stripearrayofkeysbyenv[$status]['publishable_key'])."')";
@@ -359,7 +359,7 @@ class Stripe extends CommonObject
$sql = "SELECT pi.ext_payment_id, pi.entity, pi.fk_facture, pi.sourcetype, pi.ext_payment_site";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_facture_demande as pi";
- $sql .= " WHERE pi.fk_facture = ".$object->id;
+ $sql .= " WHERE pi.fk_facture = ".((int) $object->id);
$sql .= " AND pi.sourcetype = '".$this->db->escape($object->element)."'";
$sql .= " AND pi.entity IN (".getEntity('societe').")";
$sql .= " AND pi.ext_payment_site = '".$this->db->escape($service)."'";
@@ -728,7 +728,7 @@ class Stripe extends CommonObject
$sql = "SELECT sa.stripe_card_ref, sa.proprio, sa.exp_date_month, sa.exp_date_year, sa.number, sa.cvn"; // stripe_card_ref is card_....
$sql .= " FROM ".MAIN_DB_PREFIX."societe_rib as sa";
- $sql .= " WHERE sa.rowid = ".$object->id; // We get record from ID, no need for filter on entity
+ $sql .= " WHERE sa.rowid = ".((int) $object->id); // We get record from ID, no need for filter on entity
$sql .= " AND sa.type = 'card'";
dol_syslog(get_class($this)."::fetch search stripe card id for paymentmode id=".$object->id.", stripeacc=".$stripeacc.", status=".$status.", createifnotlinkedtostripe=".$createifnotlinkedtostripe, LOG_DEBUG);
@@ -826,7 +826,7 @@ class Stripe extends CommonObject
$sql .= " SET stripe_card_ref = '".$this->db->escape($card->id)."', card_type = '".$this->db->escape($card->brand)."',";
$sql .= " country_code = '".$this->db->escape($card->country)."',";
$sql .= " approved = ".($card->cvc_check == 'pass' ? 1 : 0);
- $sql .= " WHERE rowid = ".$object->id;
+ $sql .= " WHERE rowid = ".((int) $object->id);
$sql .= " AND type = 'card'";
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/takepos/floors.php b/htdocs/takepos/floors.php
index 508d6e670b3..b3ba955f4e8 100644
--- a/htdocs/takepos/floors.php
+++ b/htdocs/takepos/floors.php
@@ -93,9 +93,9 @@ if ($action == "update") {
$top = 95;
}
if ($left > 3 or $top > 4) {
- $db->query("UPDATE ".MAIN_DB_PREFIX."takepos_floor_tables set leftpos=".$left.", toppos=".$top." WHERE rowid='".$place."'");
+ $db->query("UPDATE ".MAIN_DB_PREFIX."takepos_floor_tables set leftpos = ".((int) $left).", toppos = ".((int) $top)." WHERE rowid = ".((int) $place));
} else {
- $db->query("DELETE from ".MAIN_DB_PREFIX."takepos_floor_tables where rowid='".$place."'");
+ $db->query("DELETE from ".MAIN_DB_PREFIX."takepos_floor_tables where rowid = ".((int) $place));
}
}
@@ -104,11 +104,11 @@ if ($action == "updatename") {
if (strlen($newname) > 3) {
$newname = substr($newname, 0, 3); // Only 3 chars
}
- $db->query("UPDATE ".MAIN_DB_PREFIX."takepos_floor_tables set label='".$db->escape($newname)."' WHERE rowid='".$place."'");
+ $db->query("UPDATE ".MAIN_DB_PREFIX."takepos_floor_tables set label='".$db->escape($newname)."' WHERE rowid = ".((int) $place));
}
if ($action == "add") {
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."takepos_floor_tables(entity, label, leftpos, toppos, floor) VALUES (".$conf->entity.", '', '45', '45', ".$floor.")";
+ $sql = "INSERT INTO ".MAIN_DB_PREFIX."takepos_floor_tables(entity, label, leftpos, toppos, floor) VALUES (".$conf->entity.", '', '45', '45', ".((int) $floor).")";
$asdf = $db->query($sql);
$db->query("update ".MAIN_DB_PREFIX."takepos_floor_tables set label=rowid where label=''"); // No empty table names
}
diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php
index 1ffec54ed22..bf08e2fdf01 100644
--- a/htdocs/ticket/class/ticket.class.php
+++ b/htdocs/ticket/class/ticket.class.php
@@ -2296,7 +2296,7 @@ class Ticket extends CommonObject
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."socpeople t on ec.fk_socpeople = t.rowid";
}
- $sql .= " WHERE ec.element_id =".$this->id;
+ $sql .= " WHERE ec.element_id = ".((int) $this->id);
$sql .= " AND ec.fk_c_type_contact=tc.rowid";
$sql .= " AND tc.element='".$this->db->escape($this->element)."'";
if ($source == 'internal') {
diff --git a/htdocs/user/bank.php b/htdocs/user/bank.php
index aa6f97a6c05..00b85dc23a6 100644
--- a/htdocs/user/bank.php
+++ b/htdocs/user/bank.php
@@ -369,7 +369,7 @@ if ($action != 'edit' && $action != 'create') { // If not bank account yet, $ac
$sql = "SELECT s.rowid as sid, s.ref as sref, s.label, s.datesp, s.dateep, s.paye, s.amount, SUM(ps.amount) as alreadypaid";
$sql .= " FROM ".MAIN_DB_PREFIX."salary as s";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."payment_salary as ps ON (s.rowid = ps.fk_salary)";
- $sql .= " WHERE s.fk_user = ".$object->id;
+ $sql .= " WHERE s.fk_user = ".((int) $object->id);
$sql .= " AND s.entity IN (".getEntity('salary').")";
$sql .= " GROUP BY s.rowid, s.ref, s.label, s.datesp, s.dateep, s.paye, s.amount";
$sql .= " ORDER BY s.dateep DESC";
@@ -433,7 +433,7 @@ if ($action != 'edit' && $action != 'create') { // If not bank account yet, $ac
$sql = "SELECT h.rowid, h.statut as status, h.fk_type, h.date_debut, h.date_fin, h.halfday";
$sql .= " FROM ".MAIN_DB_PREFIX."holiday as h";
- $sql .= " WHERE h.fk_user = ".$object->id;
+ $sql .= " WHERE h.fk_user = ".((int) $object->id);
$sql .= " AND h.entity IN (".getEntity('holiday').")";
$sql .= " ORDER BY h.date_debut DESC";
@@ -485,8 +485,8 @@ if ($action != 'edit' && $action != 'create') { // If not bank account yet, $ac
$sql = "SELECT e.rowid, e.ref, e.fk_statut as status, e.date_debut, e.total_ttc";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport as e";
- $sql .= " WHERE e.fk_user_author = ".$object->id;
- $sql .= " AND e.entity = ".$conf->entity;
+ $sql .= " WHERE e.fk_user_author = ".((int) $object->id);
+ $sql .= " AND e.entity = ".((int) $conf->entity);
$sql .= " ORDER BY e.date_debut DESC";
$resql = $db->query($sql);
diff --git a/htdocs/user/card.php b/htdocs/user/card.php
index ad1007f3c52..be91f302b97 100644
--- a/htdocs/user/card.php
+++ b/htdocs/user/card.php
@@ -512,15 +512,15 @@ if (empty($reshook)) {
if (!empty($contact->socid)) {
$sql .= ", fk_soc=".((int) $contact->socid);
}
- $sql .= " WHERE rowid=".$object->id;
+ $sql .= " WHERE rowid = ".((int) $object->id);
} elseif ($socid > 0) {
$sql = "UPDATE ".MAIN_DB_PREFIX."user";
$sql .= " SET fk_socpeople=NULL, fk_soc=".((int) $socid);
- $sql .= " WHERE rowid=".$object->id;
+ $sql .= " WHERE rowid = ".((int) $object->id);
} else {
$sql = "UPDATE ".MAIN_DB_PREFIX."user";
$sql .= " SET fk_socpeople=NULL, fk_soc=NULL";
- $sql .= " WHERE rowid=".$object->id;
+ $sql .= " WHERE rowid = ".((int) $object->id);
}
dol_syslog("usercard::update", LOG_DEBUG);
$resql = $db->query($sql);
diff --git a/test/phpunit/CodingPhpTest.php b/test/phpunit/CodingPhpTest.php
index 5ba74969107..e4a0e015fe8 100644
--- a/test/phpunit/CodingPhpTest.php
+++ b/test/phpunit/CodingPhpTest.php
@@ -143,7 +143,6 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$user=$this->savuser;
$langs=$this->savlangs;
$db=$this->savdb;
-
print __METHOD__."\n";
}
@@ -290,7 +289,7 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
// with xxx that is not 'thi' (for $this->db->sanitize) and 'db-' (for $db->sanitize). It means we forget a ' if string or an (int) if int when forging sql request.
preg_match_all('/(DELETE|OR|AND|WHERE|INSERT)\s.*([^\s][^\s][^\s])\s*=\s*"\s*\.\s*\$(...)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
- if ($val[2] == 'ity' && $val[3] == 'con') {
+ if ($val[2] == 'ity' && $val[3] == 'con') { // exclude entity = $conf->entity
continue;
}
var_dump($matches);
@@ -316,7 +315,7 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
// Check string sql|set...'".$yyy->xxx with xxx that is not 'escape', 'idate', .... It means we forget a db->escape when forging sql request.
preg_match_all('/(sql|SET|WHERE).+\s*\'"\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
- if (! in_array($val[2], array('this->db-', 'this->esc', 'db->escap', 'dbsession', 'db->idate', 'excludeGr', 'includeGr'))) {
+ if (! in_array($val[2], array('this->db-', 'this->esc', 'db->escap', 'mydb->esc', 'dbsession', 'db->idate', 'escapedli', 'excludeGr', 'includeGr'))) {
$ok=false;
break;
}
From 46d993c9a6d8355d13fe1add39bace8b2640507b Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Fri, 27 Aug 2021 22:42:04 +0200
Subject: [PATCH 101/953] Clean code
---
htdocs/accountancy/admin/card.php | 4 +-
htdocs/accountancy/admin/productaccount.php | 4 +-
htdocs/accountancy/bookkeeping/list.php | 20 +++----
.../class/accountancycategory.class.php | 4 +-
.../class/accountancysystem.class.php | 6 +-
.../class/accountingaccount.class.php | 14 ++---
.../class/accountingjournal.class.php | 8 +--
.../accountancy/class/bookkeeping.class.php | 27 +++++----
htdocs/accountancy/class/lettering.class.php | 2 +-
htdocs/accountancy/closure/index.php | 6 +-
htdocs/accountancy/customer/card.php | 2 +-
htdocs/accountancy/customer/index.php | 18 +++---
htdocs/accountancy/customer/list.php | 2 +-
htdocs/accountancy/expensereport/card.php | 2 +-
htdocs/accountancy/expensereport/index.php | 16 ++---
htdocs/accountancy/expensereport/list.php | 2 +-
htdocs/accountancy/supplier/card.php | 2 +-
htdocs/accountancy/supplier/index.php | 6 +-
htdocs/accountancy/supplier/list.php | 2 +-
htdocs/adherents/cartes/carte.php | 2 +-
htdocs/adherents/class/adherent.class.php | 4 +-
.../adherents/class/adherent_type.class.php | 2 +-
htdocs/adherents/class/api_members.class.php | 2 +-
htdocs/adherents/list.php | 2 +-
htdocs/admin/emailcollector_list.php | 6 +-
htdocs/admin/limits.php | 6 +-
htdocs/admin/mails_senderprofile_list.php | 6 +-
htdocs/admin/translation.php | 2 +-
htdocs/api/class/api.class.php | 26 ++++++--
htdocs/asset/list.php | 6 +-
htdocs/bom/bom_list.php | 4 +-
htdocs/bom/class/bom.class.php | 18 +++---
htdocs/categories/class/categorie.class.php | 23 ++++---
htdocs/comm/action/class/actioncomm.class.php | 18 +++---
htdocs/comm/action/index.php | 2 +-
htdocs/comm/action/list.php | 2 +-
.../mailing/class/advtargetemailing.class.php | 52 ++++++++--------
.../html.formadvtargetemailing.class.php | 22 +++----
htdocs/comm/mailing/class/mailing.class.php | 4 +-
htdocs/comm/propal/class/propal.class.php | 2 +-
htdocs/comm/propal/list.php | 2 +-
htdocs/commande/class/commande.class.php | 22 +++----
htdocs/commande/list.php | 2 +-
htdocs/compta/bank/bankentries_list.php | 2 +-
htdocs/compta/bank/list.php | 2 +-
.../compta/cashcontrol/cashcontrol_list.php | 4 +-
.../compta/facture/invoicetemplate_list.php | 2 +-
htdocs/compta/facture/list.php | 2 +-
.../compta/paiement/class/paiement.class.php | 6 +-
.../class/bonprelevement.class.php | 6 +-
htdocs/compta/stats/byratecountry.php | 4 +-
htdocs/contact/list.php | 2 +-
htdocs/contrat/class/contrat.class.php | 10 ++--
htdocs/contrat/list.php | 2 +-
htdocs/contrat/services_list.php | 2 +-
htdocs/core/class/cproductnature.class.php | 2 +-
htdocs/core/class/ctyperesource.class.php | 2 +-
htdocs/core/class/cunits.class.php | 2 +-
htdocs/core/class/defaultvalues.class.php | 2 +-
htdocs/core/class/notify.class.php | 6 +-
htdocs/core/db/DoliDB.class.php | 4 +-
htdocs/core/lib/admin.lib.php | 2 +-
htdocs/core/lib/functions2.lib.php | 2 +-
htdocs/core/modules/DolibarrModules.class.php | 12 ++--
htdocs/core/modules/modAdherent.class.php | 4 +-
htdocs/core/modules/modBom.class.php | 4 +-
htdocs/core/modules/modCommande.class.php | 4 +-
htdocs/core/modules/modContrat.class.php | 5 +-
htdocs/core/modules/modDon.class.php | 4 +-
.../core/modules/modEmailCollector.class.php | 60 ++++++++-----------
.../modules/modEventOrganization.class.php | 8 +--
htdocs/core/modules/modExpedition.class.php | 8 +--
.../core/modules/modExpenseReport.class.php | 4 +-
htdocs/core/modules/modFacture.class.php | 4 +-
htdocs/core/modules/modFicheinter.class.php | 4 +-
htdocs/core/modules/modFournisseur.class.php | 4 +-
htdocs/core/modules/modHoliday.class.php | 4 +-
.../modules/modKnowledgeManagement.class.php | 8 +--
htdocs/core/modules/modMrp.class.php | 4 +-
htdocs/core/modules/modPartnership.class.php | 8 +--
htdocs/core/modules/modPrelevement.class.php | 4 +-
htdocs/core/modules/modProjet.class.php | 12 ++--
htdocs/core/modules/modPropale.class.php | 4 +-
htdocs/core/modules/modReception.class.php | 4 +-
htdocs/core/modules/modRecruitment.class.php | 8 +--
htdocs/core/modules/modStock.class.php | 9 ++-
.../modules/modSupplierProposal.class.php | 4 +-
htdocs/core/modules/modTicket.class.php | 4 +-
htdocs/core/modules/modWorkstation.class.php | 8 +--
.../movement/doc/pdf_standard.modules.php | 2 +-
htdocs/ecm/class/ecmfiles.class.php | 2 +-
.../class/conferenceorbooth.class.php | 2 +-
.../class/conferenceorboothattendee.class.php | 2 +-
.../conferenceorbooth_list.php | 2 +-
.../conferenceorboothattendee_list.php | 2 +-
htdocs/expedition/list.php | 2 +-
.../class/expensereport.class.php | 14 ++---
htdocs/expensereport/list.php | 2 +-
htdocs/fichinter/list.php | 2 +-
.../class/fournisseur.commande.class.php | 12 ++--
.../fournisseur.commande.dispatch.class.php | 2 +-
htdocs/fourn/commande/list.php | 2 +-
htdocs/fourn/facture/list.php | 2 +-
htdocs/holiday/list.php | 2 +-
htdocs/hrm/class/establishment.class.php | 2 +-
htdocs/intracommreport/list.php | 2 +-
.../class/knowledgerecord.class.php | 8 +--
.../knowledgerecord_list.php | 4 +-
.../template/class/myobject.class.php | 12 ++--
.../modulebuilder/template/myobject_list.php | 4 +-
htdocs/mrp/class/mo.class.php | 16 ++---
htdocs/mrp/mo_list.php | 4 +-
htdocs/mrp/mo_movements.php | 2 +-
.../partnership/class/partnership.class.php | 10 ++--
htdocs/partnership/partnership_list.php | 4 +-
htdocs/product/class/product.class.php | 2 +-
.../class/productcustomerprice.class.php | 4 +-
.../class/productfournisseurprice.class.php | 8 +--
htdocs/product/inventory/list.php | 4 +-
htdocs/product/list.php | 2 +-
.../class/productstockentrepot.class.php | 2 +-
htdocs/product/stock/list.php | 6 +-
htdocs/product/stock/movement_card.php | 2 +-
htdocs/product/stock/movement_list.php | 2 +-
htdocs/product/stock/productlot_list.php | 6 +-
htdocs/projet/class/task.class.php | 4 +-
htdocs/projet/list.php | 2 +-
htdocs/projet/tasks/list.php | 2 +-
htdocs/public/recruitment/index.php | 2 +-
htdocs/public/ticket/list.php | 2 +-
htdocs/reception/list.php | 2 +-
.../class/recruitmentcandidature.class.php | 10 ++--
.../class/recruitmentjobposition.class.php | 10 ++--
.../recruitmentcandidature_list.php | 6 +-
.../recruitmentjobposition_list.php | 4 +-
htdocs/resource/class/dolresource.class.php | 2 +-
htdocs/societe/class/societe.class.php | 2 +-
htdocs/societe/list.php | 2 +-
htdocs/societe/website.php | 6 +-
htdocs/supplier_proposal/list.php | 2 +-
htdocs/ticket/class/cticketcategory.class.php | 10 ++--
htdocs/ticket/class/ticket.class.php | 18 +++---
htdocs/ticket/list.php | 4 +-
htdocs/user/class/user.class.php | 10 ++--
htdocs/user/list.php | 2 +-
htdocs/user/notify/card.php | 6 +-
.../class/ProductAttributeValue.class.php | 3 +-
htdocs/website/class/website.class.php | 2 +-
htdocs/website/class/websitepage.class.php | 2 +-
.../workstation/class/workstation.class.php | 10 ++--
htdocs/workstation/workstation_list.php | 4 +-
htdocs/zapier/class/hook.class.php | 8 +--
test/phpunit/CodingPhpTest.php | 41 +++++++++++--
153 files changed, 515 insertions(+), 477 deletions(-)
diff --git a/htdocs/accountancy/admin/card.php b/htdocs/accountancy/admin/card.php
index 46d8dc0dc80..86efee3a04a 100644
--- a/htdocs/accountancy/admin/card.php
+++ b/htdocs/accountancy/admin/card.php
@@ -261,7 +261,7 @@ if ($action == 'create') {
// autosuggest from existing account types if found
print '';
$sql = 'SELECT DISTINCT pcg_type FROM ' . MAIN_DB_PREFIX . 'accounting_account';
- $sql .= ' WHERE fk_pcg_version = "' . $db->escape($accountsystem->ref) . '"';
+ $sql .= " WHERE fk_pcg_version = '" . $db->escape($accountsystem->ref) . "'";
$sql .= ' AND entity in ('.getEntity('accounting_account', 0).')'; // Always limit to current entity. No sharing in accountancy.
$sql .= ' LIMIT 50000'; // just as a sanity check
$resql = $db->query($sql);
@@ -337,7 +337,7 @@ if ($action == 'create') {
// autosuggest from existing account types if found
print '';
$sql = 'SELECT DISTINCT pcg_type FROM ' . MAIN_DB_PREFIX . 'accounting_account';
- $sql .= ' WHERE fk_pcg_version = "' . $db->escape($accountsystem->ref) . '"';
+ $sql .= " WHERE fk_pcg_version = '" . $db->escape($accountsystem->ref) . "'";
$sql .= ' AND entity in ('.getEntity('accounting_account', 0).')'; // Always limit to current entity. No sharing in accountancy.
$sql .= ' LIMIT 50000'; // just as a sanity check
$resql = $db->query($sql);
diff --git a/htdocs/accountancy/admin/productaccount.php b/htdocs/accountancy/admin/productaccount.php
index e29653a3e40..9596cd96af8 100644
--- a/htdocs/accountancy/admin/productaccount.php
+++ b/htdocs/accountancy/admin/productaccount.php
@@ -198,7 +198,7 @@ if ($action == 'update') {
$sql .= " WHERE rowid = ".((int) $productid);
}
- dol_syslog("/accountancy/admin/productaccount.php sql=".$sql, LOG_DEBUG);
+ dol_syslog("/accountancy/admin/productaccount.php", LOG_DEBUG);
if ($db->query($sql)) {
$ok++;
$db->commit();
@@ -329,7 +329,7 @@ if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST)) {
$sql .= $db->plimit($limit + 1, $offset);
-dol_syslog("/accountancy/admin/productaccount.php:: sql=".$sql, LOG_DEBUG);
+dol_syslog("/accountancy/admin/productaccount.php", LOG_DEBUG);
$result = $db->query($sql);
if ($result) {
$num = $db->num_rows($result);
diff --git a/htdocs/accountancy/bookkeeping/list.php b/htdocs/accountancy/bookkeeping/list.php
index bc260c77ed3..73c23e4d63b 100644
--- a/htdocs/accountancy/bookkeeping/list.php
+++ b/htdocs/accountancy/bookkeeping/list.php
@@ -530,25 +530,25 @@ $sqlwhere = array();
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.doc_date') {
- $sqlwhere[] = $key.'=\''.$db->idate($value).'\'';
+ $sqlwhere[] = $key."='".$db->idate($value)."'";
} elseif ($key == 't.doc_date>=' || $key == 't.doc_date<=') {
- $sqlwhere[] = $key.'\''.$db->idate($value).'\'';
+ $sqlwhere[] = $key."'".$db->idate($value)."'";
} elseif ($key == 't.numero_compte>=' || $key == 't.numero_compte<=') {
- $sqlwhere[] = $key.'\''.$db->escape($value).'\'';
+ $sqlwhere[] = $key."'".$db->escape($value)."'";
} elseif ($key == 't.fk_doc' || $key == 't.fk_docdet' || $key == 't.piece_num') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key.'='.((int) $value);
} elseif ($key == 't.numero_compte') {
- $sqlwhere[] = $key.' LIKE \''.$db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '".$db->escape($value)."%'";
} elseif ($key == 't.subledger_account') {
$sqlwhere[] = natural_search($key, $value, 0, 1);
} elseif ($key == 't.date_creation>=' || $key == 't.date_creation<=') {
- $sqlwhere[] = $key.'\''.$db->idate($value).'\'';
+ $sqlwhere[] = $key."'".$db->idate($value)."'";
} elseif ($key == 't.tms>=' || $key == 't.tms<=') {
- $sqlwhere[] = $key.'\''.$db->idate($value).'\'';
+ $sqlwhere[] = $key."'".$db->idate($value)."'";
} elseif ($key == 't.date_export>=' || $key == 't.date_export<=') {
- $sqlwhere[] = $key.'\''.$db->idate($value).'\'';
+ $sqlwhere[] = $key."'".$db->idate($value)."'";
} elseif ($key == 't.date_validated>=' || $key == 't.date_validated<=') {
- $sqlwhere[] = $key.'\''.$db->idate($value).'\'';
+ $sqlwhere[] = $key."'".$db->idate($value)."'";
} elseif ($key == 't.credit' || $key == 't.debit') {
$sqlwhere[] = natural_search($key, $value, 1, 1);
} elseif ($key == 't.reconciled_option') {
@@ -612,7 +612,7 @@ if ($action == 'export_fileconfirm' && $user->rights->accounting->mouvements->ex
}
$sql .= " WHERE rowid = ".((int) $movement->id);
- dol_syslog("/accountancy/bookeeping/list.php Function export_file Specify movements as exported sql=".$sql, LOG_DEBUG);
+ dol_syslog("/accountancy/bookeeping/list.php Function export_file Specify movements as exported", LOG_DEBUG);
$result = $db->query($sql);
if (!$result) {
$error++;
diff --git a/htdocs/accountancy/class/accountancycategory.class.php b/htdocs/accountancy/class/accountancycategory.class.php
index 77d10516daa..bc7226edb22 100644
--- a/htdocs/accountancy/class/accountancycategory.class.php
+++ b/htdocs/accountancy/class/accountancycategory.class.php
@@ -433,7 +433,7 @@ class AccountancyCategory // extends CommonObject
$this->lines_display = array();
- dol_syslog(__METHOD__." sql=".$sql, LOG_DEBUG);
+ dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$num = $this->db->num_rows($resql);
@@ -632,7 +632,7 @@ class AccountancyCategory // extends CommonObject
$sql .= " WHERE aa.rowid = ".((int) $cpt_id);
$this->db->begin();
- dol_syslog(__METHOD__." sql=".$sql, LOG_DEBUG);
+ dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
diff --git a/htdocs/accountancy/class/accountancysystem.class.php b/htdocs/accountancy/class/accountancysystem.class.php
index 1b481027ac0..a62dddd6a26 100644
--- a/htdocs/accountancy/class/accountancysystem.class.php
+++ b/htdocs/accountancy/class/accountancysystem.class.php
@@ -105,7 +105,7 @@ class AccountancySystem
$sql .= " a.pcg_version = '".$this->db->escape($ref)."'";
}
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
$obj = $this->db->fetch_object($result);
@@ -143,9 +143,9 @@ class AccountancySystem
$sql = "INSERT INTO ".MAIN_DB_PREFIX."accounting_system";
$sql .= " (date_creation, fk_user_author, numero, label)";
- $sql .= " VALUES ('".$this->db->idate($now)."',".$user->id.",'".$this->db->escape($this->numero)."','".$this->db->escape($this->label)."')";
+ $sql .= " VALUES ('".$this->db->idate($now)."',".((int) $user->id).",'".$this->db->escape($this->numero)."','".$this->db->escape($this->label)."')";
- dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::create", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$id = $this->db->last_insert_id(MAIN_DB_PREFIX."accounting_system");
diff --git a/htdocs/accountancy/class/accountingaccount.class.php b/htdocs/accountancy/class/accountingaccount.class.php
index 3c95af8afee..35178e43947 100644
--- a/htdocs/accountancy/class/accountingaccount.class.php
+++ b/htdocs/accountancy/class/accountingaccount.class.php
@@ -150,7 +150,7 @@ class AccountingAccount extends CommonObject
global $conf;
$this->db = $db;
- $this->next_prev_filter = 'fk_pcg_version IN (SELECT pcg_version FROM '.MAIN_DB_PREFIX.'accounting_system WHERE rowid='.$conf->global->CHARTOFACCOUNTS.')'; // Used to add a filter in Form::showrefnav method
+ $this->next_prev_filter = "fk_pcg_version IN (SELECT pcg_version FROM ".MAIN_DB_PREFIX."accounting_system WHERE rowid=".((int) $conf->global->CHARTOFACCOUNTS).")"; // Used to add a filter in Form::showrefnav method
}
/**
@@ -185,7 +185,7 @@ class AccountingAccount extends CommonObject
$sql .= " AND a.fk_pcg_version = '".$this->db->escape($limittoachartaccount)."'";
}
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
$obj = $this->db->fetch_object($result);
@@ -289,7 +289,7 @@ class AccountingAccount extends CommonObject
$this->db->begin();
- dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::create", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
@@ -352,7 +352,7 @@ class AccountingAccount extends CommonObject
$sql .= " , reconcilable = ".(int) $this->reconcilable;
$sql .= " WHERE rowid = ".((int) $this->id);
- dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::update", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
$this->db->commit();
@@ -379,7 +379,7 @@ class AccountingAccount extends CommonObject
$sql .= " (SELECT fk_code_ventilation FROM ".MAIN_DB_PREFIX."facture_fourn_det";
$sql .= " WHERE fk_code_ventilation=".((int) $this->id).")";
- dol_syslog(get_class($this)."::checkUsage sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::checkUsage", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
@@ -604,7 +604,7 @@ class AccountingAccount extends CommonObject
$sql .= "SET ".$fieldtouse." = '0'";
$sql .= " WHERE rowid = ".((int) $id);
- dol_syslog(get_class($this)."::accountDeactivate ".$fieldtouse." sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::accountDeactivate ".$fieldtouse, LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
@@ -642,7 +642,7 @@ class AccountingAccount extends CommonObject
$sql .= " SET ".$fieldtouse." = '1'";
$sql .= " WHERE rowid = ".((int) $id);
- dol_syslog(get_class($this)."::account_activate ".$fieldtouse." sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::account_activate ".$fieldtouse, LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
$this->db->commit();
diff --git a/htdocs/accountancy/class/accountingjournal.class.php b/htdocs/accountancy/class/accountingjournal.class.php
index 95a69466658..376178b45ba 100644
--- a/htdocs/accountancy/class/accountingjournal.class.php
+++ b/htdocs/accountancy/class/accountingjournal.class.php
@@ -113,7 +113,7 @@ class AccountingJournal extends CommonObject
$sql .= " AND entity = ".$conf->entity;
}
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
$obj = $this->db->fetch_object($result);
@@ -170,18 +170,18 @@ class AccountingJournal extends CommonObject
$sql .= ' WHERE 1 = 1';
$sql .= " AND entity IN (".getEntity('accountancy').")";
if (count($sqlwhere) > 0) {
- $sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere);
+ $sql .= " AND ".implode(" ".$filtermode." ", $sqlwhere);
}
if (!empty($sortfield)) {
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
$this->lines = array();
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$num = $this->db->num_rows($resql);
diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php
index 0ea00c9c98c..acdce0229d0 100644
--- a/htdocs/accountancy/class/bookkeeping.class.php
+++ b/htdocs/accountancy/class/bookkeeping.class.php
@@ -647,7 +647,7 @@ class BookKeeping extends CommonObject
$sql .= ' '.(!isset($this->credit) ? 'NULL' : $this->credit).',';
$sql .= ' '.(!isset($this->montant) ? 'NULL' : $this->montant).',';
$sql .= ' '.(!isset($this->sens) ? 'NULL' : "'".$this->db->escape($this->sens)."'").',';
- $sql .= ' '.$user->id.',';
+ $sql .= ' '.((int) $user->id).',';
$sql .= ' '."'".$this->db->idate($now)."',";
$sql .= ' '.(empty($this->code_journal) ? 'NULL' : "'".$this->db->escape($this->code_journal)."'").',';
$sql .= ' '.(empty($this->journal_label) ? 'NULL' : "'".$this->db->escape($this->journal_label)."'").',';
@@ -883,7 +883,7 @@ class BookKeeping extends CommonObject
$sql .= ' WHERE 1 = 1';
$sql .= " AND entity IN (".getEntity('accountancy').")";
if (count($sqlwhere) > 0) {
- $sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere);
+ $sql .= " AND ".implode(" ".$filtermode." ", $sqlwhere);
}
// Affichage par compte comptable
if (!empty($option)) {
@@ -894,10 +894,10 @@ class BookKeeping extends CommonObject
}
if (!empty($sortfield)) {
- $sql .= ', '.$sortfield.' '.$sortorder;
+ $sql .= ", ".$sortfield." ".$sortorder;
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
$resql = $this->db->query($sql);
@@ -1043,13 +1043,13 @@ class BookKeeping extends CommonObject
$sql .= " AND t.date_export IS NULL";
}
if (count($sqlwhere) > 0) {
- $sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere);
+ $sql .= ' AND '.implode(" ".$filtermode." ", $sqlwhere);
}
if (!empty($sortfield)) {
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
$this->lines = array();
@@ -1161,7 +1161,7 @@ class BookKeeping extends CommonObject
}
$sql .= ' WHERE entity IN ('.getEntity('accountancy').')';
if (count($sqlwhere) > 0) {
- $sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere);
+ $sql .= " AND ".implode(" ".$filtermode." ", $sqlwhere);
}
$sql .= ' GROUP BY t.numero_compte';
@@ -1170,7 +1170,7 @@ class BookKeeping extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
$resql = $this->db->query($sql);
@@ -1347,8 +1347,9 @@ class BookKeeping extends CommonObject
$this->db->begin();
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element.$mode;
- $sql .= ' SET '.$field.'='.(is_numeric($value) ? $value : "'".$this->db->escape($value)."'");
+ $sql .= " SET ".$field." = ".(is_numeric($value) ? ((float) $value) : "'".$this->db->escape($value)."'");
$sql .= " WHERE piece_num = ".((int) $piece_num);
+
$resql = $this->db->query($sql);
if (!$resql) {
@@ -1678,7 +1679,7 @@ class BookKeeping extends CommonObject
$sql = "SELECT MAX(piece_num)+1 as max FROM ".MAIN_DB_PREFIX.$this->table_element.$mode;
$sql .= " WHERE entity IN (".getEntity('accountancy').")";
- dol_syslog(get_class($this)."getNextNumMvt sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."getNextNumMvt", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
@@ -1858,7 +1859,7 @@ class BookKeeping extends CommonObject
$sql .= ' SELECT doc_date, doc_type,';
$sql .= ' doc_ref, fk_doc, fk_docdet, entity, thirdparty_code, subledger_account, subledger_label,';
$sql .= ' numero_compte, label_compte, label_operation, debit, credit,';
- $sql .= ' montant, sens, fk_user_author, import_key, code_journal, journal_label, '.$next_piecenum.", '".$this->db->idate($now)."'";
+ $sql .= ' montant, sens, fk_user_author, import_key, code_journal, journal_label, '.((int) $next_piecenum).", '".$this->db->idate($now)."'";
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -2017,7 +2018,7 @@ class BookKeeping extends CommonObject
$sql .= " WHERE aa.account_number = '".$this->db->escape($account)."'";
$sql .= " AND aa.entity IN (".getEntity('accountancy').")";
- dol_syslog(get_class($this)."::select_account sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::select_account", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$obj = '';
@@ -2057,7 +2058,7 @@ class BookKeeping extends CommonObject
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_accounting_category as cat ON aa.fk_accounting_category = cat.rowid";
$sql .= " WHERE aa.entity IN (".getEntity('accountancy').")";
- dol_syslog(get_class($this)."::select_account sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::select_account", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$obj = '';
diff --git a/htdocs/accountancy/class/lettering.class.php b/htdocs/accountancy/class/lettering.class.php
index b2abf01948e..1dd4c4df3e5 100644
--- a/htdocs/accountancy/class/lettering.class.php
+++ b/htdocs/accountancy/class/lettering.class.php
@@ -279,7 +279,7 @@ class Lettering extends BookKeeping
$sql .= " WHERE rowid IN (".$this->db->sanitize(implode(',', $ids)).") AND date_validated IS NULL ";
$this->db->begin();
- dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::update", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
diff --git a/htdocs/accountancy/closure/index.php b/htdocs/accountancy/closure/index.php
index b612762d358..a7220d01a28 100644
--- a/htdocs/accountancy/closure/index.php
+++ b/htdocs/accountancy/closure/index.php
@@ -95,7 +95,7 @@ if ($action == 'validate_movements_confirm' && !empty($user->rights->accounting-
$sql .= " AND doc_date >= '" . $db->idate($date_start) . "'";
$sql .= " AND doc_date <= '" . $db->idate($date_end) . "'";
- dol_syslog("/accountancy/closure/index.php :: Function validate_movement_confirm Specify movements as validated sql=".$sql, LOG_DEBUG);
+ dol_syslog("/accountancy/closure/index.php :: Function validate_movement_confirm Specify movements as validated", LOG_DEBUG);
$result = $db->query($sql);
if (!$result) {
$error++;
@@ -189,7 +189,7 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(b.doc_date)='.$j, '1', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(b.doc_date)=".$j, "1", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " COUNT(b.rowid) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."accounting_bookkeeping as b";
@@ -198,7 +198,7 @@ $sql .= " AND b.doc_date <= '".$db->idate($search_date_end)."'";
$sql .= " AND b.entity IN (".getEntity('bookkeeping', 0).")"; // We don't share object for accountancy
$sql .= " AND date_validated IS NULL";
-dol_syslog('htdocs/accountancy/closure/index.php sql='.$sql, LOG_DEBUG);
+dol_syslog('htdocs/accountancy/closure/index.php', LOG_DEBUG);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
diff --git a/htdocs/accountancy/customer/card.php b/htdocs/accountancy/customer/card.php
index b3ce892b235..296d6729301 100644
--- a/htdocs/accountancy/customer/card.php
+++ b/htdocs/accountancy/customer/card.php
@@ -117,7 +117,7 @@ if (!empty($id)) {
$sql .= " WHERE f.fk_statut > 0 AND l.rowid = ".((int) $id);
$sql .= " AND f.entity IN (".getEntity('invoice', 0).")"; // We don't share object for accountancy
- dol_syslog("/accounting/customer/card.php sql=".$sql, LOG_DEBUG);
+ dol_syslog("/accounting/customer/card.php", LOG_DEBUG);
$result = $db->query($sql);
if ($result) {
diff --git a/htdocs/accountancy/customer/index.php b/htdocs/accountancy/customer/index.php
index ede72c9d9e6..3b30d00dbf6 100644
--- a/htdocs/accountancy/customer/index.php
+++ b/htdocs/accountancy/customer/index.php
@@ -85,8 +85,8 @@ if ($action == 'clean' || $action == 'validatehistory') {
$sql1 .= ' (SELECT accnt.rowid ';
$sql1 .= ' FROM '.MAIN_DB_PREFIX.'accounting_account as accnt';
$sql1 .= ' INNER JOIN '.MAIN_DB_PREFIX.'accounting_system as syst';
- $sql1 .= ' ON accnt.fk_pcg_version = syst.pcg_version AND syst.rowid='.$conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity.')';
- $sql1 .= ' AND fd.fk_facture IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'facture WHERE entity = '.$conf->entity.')';
+ $sql1 .= ' ON accnt.fk_pcg_version = syst.pcg_version AND syst.rowid='.((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.((int) $conf->entity).')';
+ $sql1 .= ' AND fd.fk_facture IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'facture WHERE entity = '.((int) $conf->entity).')';
$sql1 .= ' AND fk_code_ventilation <> 0';
dol_syslog("htdocs/accountancy/customer/index.php fixaccountancycode", LOG_DEBUG);
@@ -110,13 +110,13 @@ if ($action == 'validatehistory') {
$sql1 = "UPDATE " . MAIN_DB_PREFIX . "facturedet";
$sql1 .= " SET fk_code_ventilation = accnt.rowid";
$sql1 .= " FROM " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst";
- $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facturedet.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity;
+ $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facturedet.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.((int) $conf->entity);
$sql1 .= " AND accnt.active = 1 AND p.accountancy_code_sell=accnt.account_number";
$sql1 .= " AND " . MAIN_DB_PREFIX . "facturedet.fk_code_ventilation = 0";
} else {
$sql1 = "UPDATE " . MAIN_DB_PREFIX . "facturedet as fd, " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst";
$sql1 .= " SET fk_code_ventilation = accnt.rowid";
- $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity;
+ $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.((int) $conf->entity);
$sql1 .= " AND accnt.active = 1 AND p.accountancy_code_sell=accnt.account_number";
$sql1 .= " AND fd.fk_code_ventilation = 0";
}*/
@@ -283,7 +283,7 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(f.datef)='.$j, 'fd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(f.datef)=".$j, "fd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(fd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd";
@@ -306,7 +306,7 @@ if (!empty($conf->global->FACTURE_DEPOSITS_ARE_JUST_PAYMENTS)) {
}
$sql .= " GROUP BY fd.fk_code_ventilation,aa.account_number,aa.label";
-dol_syslog('htdocs/accountancy/customer/index.php sql='.$sql, LOG_DEBUG);
+dol_syslog('htdocs/accountancy/customer/index.php', LOG_DEBUG);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
@@ -367,7 +367,7 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(f.datef)='.$j, 'fd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(f.datef)=".$j, "fd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(fd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd";
@@ -452,7 +452,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL > 0) { // This part of code looks strange
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(f.datef)='.$j, 'fd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(f.datef)=".$j, "fd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(fd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd";
@@ -513,7 +513,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL > 0) { // This part of code looks strange
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(f.datef)='.$j, '(fd.total_ht-(fd.qty * fd.buy_price_ht))', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(f.datef)=".$j, "(fd.total_ht-(fd.qty * fd.buy_price_ht))", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM((fd.total_ht-(fd.qty * fd.buy_price_ht))) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd";
diff --git a/htdocs/accountancy/customer/list.php b/htdocs/accountancy/customer/list.php
index 5ce9f5e13e8..35e02d5b007 100644
--- a/htdocs/accountancy/customer/list.php
+++ b/htdocs/accountancy/customer/list.php
@@ -188,7 +188,7 @@ if ($massaction == 'ventil' && $user->rights->accounting->bind->write) {
$accountventilated = new AccountingAccount($db);
$accountventilated->fetch($monCompte, '', 1);
- dol_syslog("accountancy/customer/list.php sql=".$sql, LOG_DEBUG);
+ dol_syslog("accountancy/customer/list.php", LOG_DEBUG);
if ($db->query($sql)) {
$msg .= ''.$langs->trans("Lineofinvoice", $monId).' - '.$langs->trans("VentilatedinAccount").' : '.length_accountg($accountventilated->account_number).'
';
$ok++;
diff --git a/htdocs/accountancy/expensereport/card.php b/htdocs/accountancy/expensereport/card.php
index db270b9d2db..7c2310ccce4 100644
--- a/htdocs/accountancy/expensereport/card.php
+++ b/htdocs/accountancy/expensereport/card.php
@@ -110,7 +110,7 @@ if (!empty($id)) {
$sql .= " WHERE er.fk_statut > 0 AND erd.rowid = ".((int) $id);
$sql .= " AND er.entity IN (".getEntity('expensereport', 0).")"; // We don't share object for accountancy
- dol_syslog("/accounting/expensereport/card.php sql=".$sql, LOG_DEBUG);
+ dol_syslog("/accounting/expensereport/card.php", LOG_DEBUG);
$result = $db->query($sql);
if ($result) {
diff --git a/htdocs/accountancy/expensereport/index.php b/htdocs/accountancy/expensereport/index.php
index f06dd5f8d6f..1544976bb07 100644
--- a/htdocs/accountancy/expensereport/index.php
+++ b/htdocs/accountancy/expensereport/index.php
@@ -79,8 +79,8 @@ if (($action == 'clean' || $action == 'validatehistory') && $user->rights->accou
$sql1 .= ' (SELECT accnt.rowid ';
$sql1 .= ' FROM '.MAIN_DB_PREFIX.'accounting_account as accnt';
$sql1 .= ' INNER JOIN '.MAIN_DB_PREFIX.'accounting_system as syst';
- $sql1 .= ' ON accnt.fk_pcg_version = syst.pcg_version AND syst.rowid='.$conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity.')';
- $sql1 .= ' AND erd.fk_expensereport IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'expensereport WHERE entity = '.$conf->entity.')';
+ $sql1 .= ' ON accnt.fk_pcg_version = syst.pcg_version AND syst.rowid='.((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.((int) $conf->entity).')';
+ $sql1 .= ' AND erd.fk_expensereport IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'expensereport WHERE entity = '.((int) $conf->entity).')';
$sql1 .= ' AND fk_code_ventilation <> 0';
dol_syslog("htdocs/accountancy/customer/index.php fixaccountancycode", LOG_DEBUG);
$resql1 = $db->query($sql1);
@@ -103,13 +103,13 @@ if ($action == 'validatehistory') {
$sql1 = "UPDATE ".MAIN_DB_PREFIX."expensereport_det";
$sql1 .= " SET fk_code_ventilation = accnt.rowid";
$sql1 .= " FROM ".MAIN_DB_PREFIX."c_type_fees as t, ".MAIN_DB_PREFIX."accounting_account as accnt , ".MAIN_DB_PREFIX."accounting_system as syst";
- $sql1 .= " WHERE ".MAIN_DB_PREFIX."expensereport_det.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity;
+ $sql1 .= " WHERE ".MAIN_DB_PREFIX."expensereport_det.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.((int) $conf->entity);
$sql1 .= " AND accnt.active = 1 AND t.accountancy_code = accnt.account_number";
$sql1 .= " AND ".MAIN_DB_PREFIX."expensereport_det.fk_code_ventilation = 0";
} else {
$sql1 = "UPDATE ".MAIN_DB_PREFIX."expensereport_det as erd, ".MAIN_DB_PREFIX."c_type_fees as t, ".MAIN_DB_PREFIX."accounting_account as accnt , ".MAIN_DB_PREFIX."accounting_system as syst";
$sql1 .= " SET erd.fk_code_ventilation = accnt.rowid";
- $sql1 .= " WHERE erd.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity;
+ $sql1 .= " WHERE erd.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.((int) $conf->entity);
$sql1 .= " AND accnt.active = 1 AND t.accountancy_code=accnt.account_number";
$sql1 .= " AND erd.fk_code_ventilation = 0";
}
@@ -166,13 +166,13 @@ for ($i = 1; $i <= 12; $i++) {
print ''.$langs->trans("Total").' ';
$sql = "SELECT ".$db->ifsql('aa.account_number IS NULL', "'tobind'", 'aa.account_number')." AS codecomptable,";
-$sql .= " ".$db->ifsql('aa.label IS NULL', "'tobind'", 'aa.label')." AS intitule,";
+$sql .= " ".$db->ifsql('aa.label IS NULL', "'tobind'", 'aa.label')." AS intitule,";
for ($i = 1; $i <= 12; $i++) {
$j = $i + ($conf->global->SOCIETE_FISCAL_MONTH_START ? $conf->global->SOCIETE_FISCAL_MONTH_START : 1) - 1;
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(er.date_debut)='.$j, 'erd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(er.date_debut)=".$j, "erd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(erd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport_det as erd";
@@ -251,7 +251,7 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(er.date_debut)='.$j, 'erd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(er.date_debut)=".$j, "erd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " ROUND(SUM(erd.total_ht),2) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport_det as erd";
@@ -330,7 +330,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL > 0) { // This part of code looks strange
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(er.date_create)='.$j, 'erd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(er.date_create)=".$j, "erd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(erd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport_det as erd";
diff --git a/htdocs/accountancy/expensereport/list.php b/htdocs/accountancy/expensereport/list.php
index d69e78fead2..4cfc4dfb4ba 100644
--- a/htdocs/accountancy/expensereport/list.php
+++ b/htdocs/accountancy/expensereport/list.php
@@ -159,7 +159,7 @@ if ($massaction == 'ventil' && $user->rights->accounting->bind->write) {
$accountventilated = new AccountingAccount($db);
$accountventilated->fetch($monCompte, '', 1);
- dol_syslog('accountancy/expensereport/list.php:: sql='.$sql, LOG_DEBUG);
+ dol_syslog('accountancy/expensereport/list.php', LOG_DEBUG);
if ($db->query($sql)) {
$msg .= ''.$langs->trans("LineOfExpenseReport").' '.$monId.' - '.$langs->trans("VentilatedinAccount").' : '.length_accountg($accountventilated->account_number).'
';
$ok++;
diff --git a/htdocs/accountancy/supplier/card.php b/htdocs/accountancy/supplier/card.php
index 1e7887c1bdc..05d32d0cec5 100644
--- a/htdocs/accountancy/supplier/card.php
+++ b/htdocs/accountancy/supplier/card.php
@@ -118,7 +118,7 @@ if (!empty($id)) {
$sql .= " WHERE f.fk_statut > 0 AND l.rowid = ".((int) $id);
$sql .= " AND f.entity IN (".getEntity('facture_fourn', 0).")"; // We don't share object for accountancy
- dol_syslog("/accounting/supplier/card.php sql=".$sql, LOG_DEBUG);
+ dol_syslog("/accounting/supplier/card.php", LOG_DEBUG);
$result = $db->query($sql);
if ($result) {
diff --git a/htdocs/accountancy/supplier/index.php b/htdocs/accountancy/supplier/index.php
index f047ddf70de..1836687d042 100644
--- a/htdocs/accountancy/supplier/index.php
+++ b/htdocs/accountancy/supplier/index.php
@@ -283,7 +283,7 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(ff.datef)='.$j, 'ffd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(ff.datef)=".$j, "ffd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(ffd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn_det as ffd";
@@ -362,7 +362,7 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(ff.datef)='.$j, 'ffd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(ff.datef)=".$j, "ffd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(ffd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn_det as ffd";
@@ -441,7 +441,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL > 0) { // This part of code looks strange
if ($j > 12) {
$j -= 12;
}
- $sql .= " SUM(".$db->ifsql('MONTH(ff.datef)='.$j, 'ffd.total_ht', '0').") AS month".str_pad($j, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(ff.datef)=".$j, "ffd.total_ht", "0").") AS month".str_pad($j, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(ffd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn_det as ffd";
diff --git a/htdocs/accountancy/supplier/list.php b/htdocs/accountancy/supplier/list.php
index 4fd16df2afe..c6cfd3f7c92 100644
--- a/htdocs/accountancy/supplier/list.php
+++ b/htdocs/accountancy/supplier/list.php
@@ -193,7 +193,7 @@ if ($massaction == 'ventil' && $user->rights->accounting->bind->write) {
$accountventilated = new AccountingAccount($db);
$accountventilated->fetch($monCompte, '', 1);
- dol_syslog('accountancy/supplier/list.php sql='.$sql, LOG_DEBUG);
+ dol_syslog('accountancy/supplier/list.php', LOG_DEBUG);
if ($db->query($sql)) {
$msg .= ''.$langs->trans("Lineofinvoice").' '.$monId.' - '.$langs->trans("VentilatedinAccount").' : '.length_accountg($accountventilated->account_number).'
';
$ok++;
diff --git a/htdocs/adherents/cartes/carte.php b/htdocs/adherents/cartes/carte.php
index 8d9ed70a925..0512349ec4f 100644
--- a/htdocs/adherents/cartes/carte.php
+++ b/htdocs/adherents/cartes/carte.php
@@ -73,7 +73,7 @@ if ((!empty($foruserid) || !empty($foruserlogin) || !empty($mode)) && !$mesg) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
$sql .= " FROM ".MAIN_DB_PREFIX."adherent_type as t, ".MAIN_DB_PREFIX."adherent as d";
diff --git a/htdocs/adherents/class/adherent.class.php b/htdocs/adherents/class/adherent.class.php
index 75470b32173..78deca61028 100644
--- a/htdocs/adherents/class/adherent.class.php
+++ b/htdocs/adherents/class/adherent.class.php
@@ -1831,8 +1831,8 @@ class Adherent extends CommonObject
if (!$error && !empty($bank_line_id)) {
// Update fk_bank into subscription table
- $sql = 'UPDATE '.MAIN_DB_PREFIX.'subscription SET fk_bank='.$bank_line_id;
- $sql .= ' WHERE rowid='.$subscriptionid;
+ $sql = 'UPDATE '.MAIN_DB_PREFIX.'subscription SET fk_bank='.((int) $bank_line_id);
+ $sql .= ' WHERE rowid='.((int) $subscriptionid);
$result = $this->db->query($sql);
if (!$result) {
diff --git a/htdocs/adherents/class/adherent_type.class.php b/htdocs/adherents/class/adherent_type.class.php
index 1a00a03e932..88dbf6e2b39 100644
--- a/htdocs/adherents/class/adherent_type.class.php
+++ b/htdocs/adherents/class/adherent_type.class.php
@@ -584,7 +584,7 @@ class AdherentType extends CommonObject
/**
* Return array of Member objects for member type this->id (or all if this->id not defined)
*
- * @param string $excludefilter Filter to exclude
+ * @param string $excludefilter Filter to exclude. This value must not come from a user input.
* @param int $mode 0=Return array of member instance
* 1=Return array of member instance without extra data
* 2=Return array of members id only
diff --git a/htdocs/adherents/class/api_members.class.php b/htdocs/adherents/class/api_members.class.php
index d57a01510d4..b95313bdbc1 100644
--- a/htdocs/adherents/class/api_members.class.php
+++ b/htdocs/adherents/class/api_members.class.php
@@ -204,7 +204,7 @@ class Members extends DolibarrApi
* @param int $limit Limit for list
* @param int $page Page number
* @param string $typeid ID of the type of member
- * @param int $category Use this param to filter list by category
+ * @param int $category Use this param to filter list by category
* @param string $sqlfilters Other criteria to filter answers separated by a comma.
* Example: "(t.ref:like:'SO-%') and ((t.date_creation:<:'20160101') or (t.nature:is:NULL))"
* @return array Array of member objects
diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php
index 68430a71bab..fd667ad6a2f 100644
--- a/htdocs/adherents/list.php
+++ b/htdocs/adherents/list.php
@@ -323,7 +323,7 @@ $sql .= " state.code_departement as state_code, state.nom as state_name,";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
diff --git a/htdocs/admin/emailcollector_list.php b/htdocs/admin/emailcollector_list.php
index c57e681be34..ddfa847d813 100644
--- a/htdocs/admin/emailcollector_list.php
+++ b/htdocs/admin/emailcollector_list.php
@@ -208,12 +208,12 @@ $title = $langs->trans('ListOf', $langs->transnoentitiesnoconv("EmailCollector")
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -259,7 +259,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY ";
foreach ($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/admin/limits.php b/htdocs/admin/limits.php
index 4a599499053..ef0c996569f 100644
--- a/htdocs/admin/limits.php
+++ b/htdocs/admin/limits.php
@@ -108,9 +108,9 @@ $aCurrencies = array($conf->currency); // Default currency always first position
if (!empty($conf->multicurrency->enabled) && !empty($conf->global->MULTICURRENCY_USE_LIMIT_BY_CURRENCY)) {
require_once DOL_DOCUMENT_ROOT.'/core/lib/multicurrency.lib.php';
- $sql = 'SELECT rowid, code FROM '.MAIN_DB_PREFIX.'multicurrency';
- $sql .= ' WHERE entity = '.$conf->entity;
- $sql .= ' AND code != "'.$conf->currency.'"'; // Default currency always first position
+ $sql = "SELECT rowid, code FROM ".MAIN_DB_PREFIX."multicurrency";
+ $sql .= " WHERE entity = ".((int) $conf->entity);
+ $sql .= " AND code <> '".$db->escape($conf->currency)."'"; // Default currency always first position
$resql = $db->query($sql);
if ($resql) {
while ($obj = $db->fetch_object($resql)) {
diff --git a/htdocs/admin/mails_senderprofile_list.php b/htdocs/admin/mails_senderprofile_list.php
index f91b9685c88..baa8c3688d8 100644
--- a/htdocs/admin/mails_senderprofile_list.php
+++ b/htdocs/admin/mails_senderprofile_list.php
@@ -226,12 +226,12 @@ print " \n";
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -282,7 +282,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY "
foreach($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php
index 3fa2e5d0af9..4fb4e05f771 100644
--- a/htdocs/admin/translation.php
+++ b/htdocs/admin/translation.php
@@ -146,7 +146,7 @@ if ($action == 'add') {
if (!$error) {
$db->begin();
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."overwrite_trans(lang, transkey, transvalue, entity) VALUES ('".$db->escape($langcode)."','".$db->escape($transkey)."','".$db->escape($transvalue)."', ".$db->escape($conf->entity).")";
+ $sql = "INSERT INTO ".MAIN_DB_PREFIX."overwrite_trans(lang, transkey, transvalue, entity) VALUES ('".$db->escape($langcode)."','".$db->escape($transkey)."','".$db->escape($transvalue)."', ".((int) $conf->entity).")";
$result = $db->query($sql);
if ($result > 0) {
$db->commit();
diff --git a/htdocs/api/class/api.class.php b/htdocs/api/class/api.class.php
index 0a84de7b7c1..ab65576811a 100644
--- a/htdocs/api/class/api.class.php
+++ b/htdocs/api/class/api.class.php
@@ -327,7 +327,7 @@ class DolibarrApi
* Function to forge a SQL criteria
*
* @param array $matches Array of found string by regex search.
- * Example: "t.ref:like:'SO-%'" or "t.date_creation:<:'20160101'" or "t.date_creation:<:'2016-01-01 12:30:00'" or "t.nature:is:NULL"
+ * Example: "t.ref:like:'SO-%'" or "t.date_creation:<:'20160101'" or "t.date_creation:<:'2016-01-01 12:30:00'" or "t.nature:is:NULL" or "t.nature:isnot:NULL"
* @return string Forged criteria. Example: "t.field like 'abc%'"
*/
protected static function _forge_criteria_callback($matches)
@@ -345,18 +345,36 @@ class DolibarrApi
return '';
}
+ // Sanitize operand
$operand = preg_replace('/[^a-z0-9\._]/i', '', trim($tmp[0]));
+ // Sanitize operator
$operator = strtoupper(preg_replace('/[^a-z<>=]/i', '', trim($tmp[1])));
+ // Only some operators are allowed.
+ if (! in_array($operator, array('LIKE', 'ULIKE', '<', '>', '<=', '>=', '=', '<>', 'IS', 'ISNOT', 'IN'))) {
+ return '';
+ }
+ if ($operator == 'ISNOT') {
+ $operator = 'IS NOT';
+ }
+ // Sanitize value
$tmpescaped = trim($tmp[2]);
$regbis = array();
if ($operator == 'IN') {
$tmpescaped = "(".$db->sanitize($tmpescaped, 1).")";
- } elseif (preg_match('/^\'(.*)\'$/', $tmpescaped, $regbis)) {
- $tmpescaped = "'".$db->escape($regbis[1])."'";
+ } elseif (in_array($operator, array('<', '>', '<=', '>=', '=', '<>'))) {
+ if (preg_match('/^\'(.*)\'$/', $tmpescaped, $regbis)) { // If 'YYYY-MM-DD HH:MM:SS+X'
+ $tmpescaped = "'".$db->escape($regbis[1])."'";
+ } else {
+ $tmpescaped = ((float) $tmpescaped);
+ }
} else {
- $tmpescaped = $db->sanitize($db->escape($tmpescaped));
+ if (preg_match('/^\'(.*)\'$/', $tmpescaped, $regbis)) {
+ $tmpescaped = "'".$db->escape($regbis[1])."'";
+ } else {
+ $tmpescaped = "'".$db->escape($tmpescaped)."'";
+ }
}
return $db->escape($operand).' '.$db->escape($operator)." ".$tmpescaped;
diff --git a/htdocs/asset/list.php b/htdocs/asset/list.php
index 1d994e25177..770493a90f6 100644
--- a/htdocs/asset/list.php
+++ b/htdocs/asset/list.php
@@ -197,12 +197,12 @@ $title = $langs->trans('ListOf', $langs->transnoentitiesnoconv("Assets"));
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -249,7 +249,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY "
foreach($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/bom/bom_list.php b/htdocs/bom/bom_list.php
index df21938aec5..4a94dc7ce86 100644
--- a/htdocs/bom/bom_list.php
+++ b/htdocs/bom/bom_list.php
@@ -297,7 +297,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.' ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.' ' : '');
}
}
// Add fields from hooks
@@ -363,7 +363,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY ";
foreach($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/bom/class/bom.class.php b/htdocs/bom/class/bom.class.php
index 3996b5e49bd..6de13ac137a 100644
--- a/htdocs/bom/class/bom.class.php
+++ b/htdocs/bom/class/bom.class.php
@@ -431,25 +431,25 @@ class BOM extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
if (count($sqlwhere) > 0) {
- $sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
+ $sql .= " AND (".implode(" ".$filtermode." ", $sqlwhere).")";
}
if (!empty($sortfield)) {
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
@@ -1288,13 +1288,13 @@ class BOMLine extends CommonObjectLine
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -1306,7 +1306,7 @@ class BOMLine extends CommonObjectLine
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php
index 689014ad14e..ba5515149d4 100644
--- a/htdocs/categories/class/categorie.class.php
+++ b/htdocs/categories/class/categorie.class.php
@@ -455,7 +455,7 @@ class Categorie extends CommonObject
$sql .= ($this->socid > 0 ? $this->socid : 'null').", ";
}
$sql .= "'".$this->db->escape($this->visible)."', ";
- $sql .= $this->db->escape($type).", ";
+ $sql .= ((int) $type).", ";
$sql .= (!empty($this->import_key) ? "'".$this->db->escape($this->import_key)."'" : 'null').", ";
$sql .= (!empty($this->ref_ext) ? "'".$this->db->escape($this->ref_ext)."'" : 'null').", ";
$sql .= (int) $conf->entity.", ";
@@ -687,7 +687,7 @@ class Categorie extends CommonObject
$sql = "INSERT INTO ".MAIN_DB_PREFIX."categorie_".(empty($this->MAP_CAT_TABLE[$type]) ? $type : $this->MAP_CAT_TABLE[$type]);
$sql .= " (fk_categorie, fk_".(empty($this->MAP_CAT_FK[$type]) ? $type : $this->MAP_CAT_FK[$type]).")";
- $sql .= " VALUES (".$this->id.", ".$obj->id.")";
+ $sql .= " VALUES (".((int) $this->id).", ".((int) $obj->id).")";
dol_syslog(get_class($this).'::add_type', LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -924,12 +924,11 @@ class Categorie extends CommonObject
$idoftype = array_search($type, self::$MAP_ID_TO_CODE);
$sql = "SELECT s.rowid";
- $sql .= " FROM ".MAIN_DB_PREFIX."categorie as s";
- $sql .= " , ".MAIN_DB_PREFIX."categorie_".$sub_type." as sub ";
+ $sql .= " FROM ".MAIN_DB_PREFIX."categorie as s, ".MAIN_DB_PREFIX."categorie_".$sub_type." as sub";
$sql .= ' WHERE s.entity IN ('.getEntity('category').')';
$sql .= ' AND s.type='.((int) $idoftype);
$sql .= ' AND s.rowid = sub.fk_categorie';
- $sql .= ' AND sub.'.$subcol_name.' = '.((int) $id);
+ $sql .= " AND sub.".$subcol_name." = ".((int) $id);
$sql .= $this->db->order($sortfield, $sortorder);
@@ -1811,13 +1810,13 @@ class Categorie extends CommonObject
if ($key == $current_lang) {
if ($this->db->num_rows($result)) { // si aucune ligne dans la base
$sql2 = "UPDATE ".MAIN_DB_PREFIX."categorie_lang";
- $sql2 .= " SET label='".$this->db->escape($this->label)."',";
- $sql2 .= " description='".$this->db->escape($this->description)."'";
- $sql2 .= " WHERE fk_category=".((int) $this->id)." AND lang='".$this->db->escape($key)."'";
+ $sql2 .= " SET label = '".$this->db->escape($this->label)."',";
+ $sql2 .= " description = '".$this->db->escape($this->description)."'";
+ $sql2 .= " WHERE fk_category = ".((int) $this->id)." AND lang = '".$this->db->escape($key)."'";
} else {
$sql2 = "INSERT INTO ".MAIN_DB_PREFIX."categorie_lang (fk_category, lang, label, description)";
- $sql2 .= " VALUES(".$this->id.",'".$this->db->escape($key)."','".$this->db->escape($this->label);
- $sql2 .= "','".$this->db->escape($this->multilangs["$key"]["description"])."')";
+ $sql2 .= " VALUES(".((int) $this->id).", '".$this->db->escape($key)."', '".$this->db->escape($this->label)."'";
+ $sql2 .= ", '".$this->db->escape($this->multilangs["$key"]["description"])."')";
}
dol_syslog(get_class($this).'::setMultiLangs', LOG_DEBUG);
if (!$this->db->query($sql2)) {
@@ -1832,8 +1831,8 @@ class Categorie extends CommonObject
$sql2 .= " WHERE fk_category=".((int) $this->id)." AND lang='".$this->db->escape($key)."'";
} else {
$sql2 = "INSERT INTO ".MAIN_DB_PREFIX."categorie_lang (fk_category, lang, label, description)";
- $sql2 .= " VALUES(".$this->id.",'".$this->db->escape($key)."','".$this->db->escape($this->multilangs["$key"]["label"]);
- $sql2 .= "','".$this->db->escape($this->multilangs["$key"]["description"])."')";
+ $sql2 .= " VALUES(".((int) $this->id).", '".$this->db->escape($key)."', '".$this->db->escape($this->multilangs["$key"]["label"])."'";
+ $sql2 .= ",'".$this->db->escape($this->multilangs["$key"]["description"])."')";
}
// on ne sauvegarde pas des champs vides
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index 1e8de65cb43..b7530e788a8 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -542,18 +542,18 @@ class ActionComm extends CommonObject
$sql .= (isset($this->type_id) ? $this->type_id : "null").",";
$sql .= ($code ? ("'".$this->db->escape($code)."'") : "null").", ";
$sql .= (!empty($this->ref_ext) ? "'".$this->db->escape($this->ref_ext)."'" : "null").", ";
- $sql .= ((isset($this->socid) && $this->socid > 0) ? $this->socid : "null").", ";
- $sql .= ((isset($this->fk_project) && $this->fk_project > 0) ? $this->fk_project : "null").", ";
+ $sql .= ((isset($this->socid) && $this->socid > 0) ? ((int) $this->socid) : "null").", ";
+ $sql .= ((isset($this->fk_project) && $this->fk_project > 0) ? ((int) $this->fk_project) : "null").", ";
$sql .= " '".$this->db->escape($this->note_private)."', ";
- $sql .= ((isset($this->contact_id) && $this->contact_id > 0) ? $this->contact_id : "null").", "; // deprecated, use ->socpeopleassigned
+ $sql .= ((isset($this->contact_id) && $this->contact_id > 0) ? ((int) $this->contact_id) : "null").", "; // deprecated, use ->socpeopleassigned
$sql .= (isset($user->id) && $user->id > 0 ? $user->id : "null").", ";
$sql .= ($userownerid > 0 ? $userownerid : "null").", ";
$sql .= ($userdoneid > 0 ? $userdoneid : "null").", ";
$sql .= "'".$this->db->escape($this->label)."','".$this->db->escape($this->percentage)."','".$this->db->escape($this->priority)."','".$this->db->escape($this->fulldayevent)."','".$this->db->escape($this->location)."', ";
$sql .= "'".$this->db->escape($this->transparency)."', ";
- $sql .= (!empty($this->fk_element) ? $this->fk_element : "null").", ";
+ $sql .= (!empty($this->fk_element) ? ((int) $this->fk_element) : "null").", ";
$sql .= (!empty($this->elementtype) ? "'".$this->db->escape($this->elementtype)."'" : "null").", ";
- $sql .= $conf->entity.",";
+ $sql .= ((int) $conf->entity).",";
$sql .= (!empty($this->extraparams) ? "'".$this->db->escape($this->extraparams)."'" : "null").", ";
// Fields emails
$sql .= (!empty($this->email_msgid) ? "'".$this->db->escape($this->email_msgid)."'" : "null").", ";
@@ -593,7 +593,7 @@ class ActionComm extends CommonObject
if (!empty($already_inserted[$val['id']])) continue;
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
- $sql .= " VALUES(".$this->id.", 'user', ".$val['id'].", ".(empty($val['mandatory']) ? '0' : $val['mandatory']).", ".(empty($val['transparency']) ? '0' : $val['transparency']).", ".(empty($val['answer_status']) ? '0' : $val['answer_status']).")";
+ $sql .= " VALUES(".((int) $this->id).", 'user', ".((int) $val['id']).", ".(empty($val['mandatory']) ? '0' : ((int) $val['mandatory'])).", ".(empty($val['transparency']) ? '0' : ((int) $val['transparency'])).", ".(empty($val['answer_status']) ? '0' : ((int) $val['answer_status'])).")";
$resql = $this->db->query($sql);
if (!$resql) {
@@ -615,7 +615,7 @@ class ActionComm extends CommonObject
if (!empty($already_inserted[$val['id']])) continue;
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
- $sql .= " VALUES(".$this->id.", 'socpeople', ".$id.", 0, 0, 0)";
+ $sql .= " VALUES(".((int) $this->id).", 'socpeople', ".((int) $id).", 0, 0, 0)";
$resql = $this->db->query($sql);
if (!$resql) {
@@ -1170,7 +1170,7 @@ class ActionComm extends CommonObject
if (!empty($already_inserted[$val['id']])) continue;
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
- $sql .= " VALUES(".$this->id.", 'user', ".$val['id'].", ".(empty($val['mandatory']) ? '0' : $val['mandatory']).", ".(empty($val['transparency']) ? '0' : $val['transparency']).", ".(empty($val['answer_status']) ? '0' : $val['answer_status']).")";
+ $sql .= " VALUES(".((int) $this->id).", 'user', ".((int) $val['id']).", ".(empty($val['mandatory']) ? '0' : ((int) $val['mandatory'])).", ".(empty($val['transparency']) ? '0' : ((int) $val['transparency'])).", ".(empty($val['answer_status']) ? '0' : ((int) $val['answer_status'])).")";
$resql = $this->db->query($sql);
if (!$resql) {
@@ -1193,7 +1193,7 @@ class ActionComm extends CommonObject
if (!empty($already_inserted[$val['id']])) continue;
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
- $sql .= " VALUES(".$this->id.", 'socpeople', ".$id.", 0, 0, 0)";
+ $sql .= " VALUES(".((int) $this->id).", 'socpeople', ".((int) $id).", 0, 0, 0)";
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php
index c682131e442..769a966eb8e 100644
--- a/htdocs/comm/action/index.php
+++ b/htdocs/comm/action/index.php
@@ -878,7 +878,7 @@ if ($showbirthday) {
// Add events in array
$sql = 'SELECT sp.rowid, sp.lastname, sp.firstname, sp.birthday';
$sql .= ' FROM '.MAIN_DB_PREFIX.'socpeople as sp';
- $sql .= ' WHERE (priv=0 OR (priv=1 AND fk_user_creat='.$user->id.'))';
+ $sql .= ' WHERE (priv=0 OR (priv=1 AND fk_user_creat='.((int) $user->id).'))';
$sql .= " AND sp.entity IN (".getEntity('socpeople').")";
if ($action == 'show_day') {
$sql .= ' AND MONTH(birthday) = '.((int) $month);
diff --git a/htdocs/comm/action/list.php b/htdocs/comm/action/list.php
index d467c10fd58..95d882f8076 100644
--- a/htdocs/comm/action/list.php
+++ b/htdocs/comm/action/list.php
@@ -381,7 +381,7 @@ $sql .= " sp.lastname, sp.firstname, sp.email, sp.phone, sp.address, sp.phone as
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
diff --git a/htdocs/comm/mailing/class/advtargetemailing.class.php b/htdocs/comm/mailing/class/advtargetemailing.class.php
index 9051ebfa921..79e25c83385 100644
--- a/htdocs/comm/mailing/class/advtargetemailing.class.php
+++ b/htdocs/comm/mailing/class/advtargetemailing.class.php
@@ -181,7 +181,7 @@ class AdvanceTargetingMailing extends CommonObject
$this->db->begin();
- dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::create", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
$error++; $this->errors[] = "Error ".$this->db->lasterror();
@@ -230,7 +230,7 @@ class AdvanceTargetingMailing extends CommonObject
$sql .= " FROM ".MAIN_DB_PREFIX."advtargetemailing as t";
$sql .= " WHERE t.rowid = ".((int) $id);
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
if ($this->db->num_rows($resql)) {
@@ -289,7 +289,7 @@ class AdvanceTargetingMailing extends CommonObject
$sql .= " WHERE t.fk_element = ".((int) $this->fk_element)." AND type_element = 'mailing'";
}
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
if ($this->db->num_rows($resql)) {
@@ -352,7 +352,7 @@ class AdvanceTargetingMailing extends CommonObject
$sql .= " WHERE t.fk_element = ".((int) $this->fk_element)." AND type_element = '".$this->db->escape($type_element)."'";
}
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
if ($this->db->num_rows($resql)) {
@@ -422,7 +422,7 @@ class AdvanceTargetingMailing extends CommonObject
$sql .= " WHERE rowid=".((int) $this->id);
$this->db->begin();
- dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::update", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
@@ -600,31 +600,31 @@ class AdvanceTargetingMailing extends CommonObject
if (($extrafields->attributes[$elementtype]['type'][$key] == 'varchar') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'text')) {
if (!empty($arrayquery['options_'.$key])) {
- $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key])."')";
+ $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery["options_".$key])."')";
}
} elseif (($extrafields->attributes[$elementtype]['type'][$key] == 'int') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'double')) {
if (!empty($arrayquery['options_'.$key.'_max'])) {
- $sqlwhere[] = " (te.".$key." >= ".$arrayquery['options_'.$key.'_max']." AND te.".$key." <= ".$arrayquery['options_'.$key.'_min'].")";
+ $sqlwhere[] = " (te.".$key." >= ".((float) $arrayquery["options_".$key."_max"])." AND te.".$key." <= ".((float) $arrayquery["options_".$key.'_min']).")";
}
} elseif (($extrafields->attributes[$elementtype]['type'][$key] == 'date') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'datetime')) {
if (!empty($arrayquery['options_'.$key.'_end_dt'])) {
- $sqlwhere[] = " (te.".$key." >= '".$this->db->idate($arrayquery['options_'.$key.'_st_dt'])."' AND te.".$key." <= '".$this->db->idate($arrayquery['options_'.$key.'_end_dt'])."')";
+ $sqlwhere[] = " (te.".$key." >= '".$this->db->idate($arrayquery["options_".$key."_st_dt"])."' AND te.".$key." <= '".$this->db->idate($arrayquery["options_".$key."_end_dt"])."')";
}
} elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'boolean') {
if ($arrayquery['options_'.$key] != '') {
- $sqlwhere[] = " (te.".$key." = ".((int) $arrayquery['options_'.$key]).")";
+ $sqlwhere[] = " (te.".$key." = ".((int) $arrayquery["options_".$key]).")";
}
} elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'link') {
if ($arrayquery['options_'.$key] > 0) {
- $sqlwhere[]= " (te.".$key." = ".((int) $arrayquery['options_'.$key]).")";
+ $sqlwhere[]= " (te.".$key." = ".((int) $arrayquery["options_".$key]).")";
}
} else {
if (is_array($arrayquery['options_'.$key])) {
- $sqlwhere[] = " (te.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery['options_'.$key])."'", 1)."))";
+ $sqlwhere[] = " (te.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery["options_".$key])."'", 1)."))";
} elseif (!empty($arrayquery['options_'.$key])) {
- $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key])."')";
+ $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery["options_".$key])."')";
}
}
}
@@ -636,7 +636,7 @@ class AdvanceTargetingMailing extends CommonObject
}
- dol_syslog(get_class($this)."::query_thirdparty sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::query_thirdparty", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$this->thirdparty_lines = array();
@@ -743,31 +743,31 @@ class AdvanceTargetingMailing extends CommonObject
if (($extrafields->attributes[$elementtype]['type'][$key] == 'varchar') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'text')) {
if (!empty($arrayquery['options_'.$key.'_cnct'])) {
- $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key.'_cnct'])."')";
+ $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery["options_".$key."_cnct"])."')";
}
} elseif (($extrafields->attributes[$elementtype]['type'][$key] == 'int') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'double')) {
if (!empty($arrayquery['options_'.$key.'_max_cnct'])) {
- $sqlwhere[] = " (te.".$key." >= ".$arrayquery['options_'.$key.'_max_cnct']." AND te.".$key." <= ".$arrayquery['options_'.$key.'_min_cnct'].")";
+ $sqlwhere[] = " (te.".$key." >= ".((float) $arrayquery["options_".$key."_max_cnct"])." AND te.".$key." <= ".((float) $arrayquery["options_".$key."_min_cnct"]).")";
}
} elseif (($extrafields->attributes[$elementtype]['type'][$key] == 'date') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'datetime')) {
if (!empty($arrayquery['options_'.$key.'_end_dt_cnct'])) {
- $sqlwhere[] = " (te.".$key." >= '".$this->db->idate($arrayquery['options_'.$key.'_st_dt_cnct'])."' AND te.".$key." <= '".$this->db->idate($arrayquery['options_'.$key.'_end_dt_cnct'])."')";
+ $sqlwhere[] = " (te.".$key." >= '".$this->db->idate($arrayquery["options_".$key."_st_dt_cnct"])."' AND te.".$key." <= '".$this->db->idate($arrayquery["options_".$key."_end_dt_cnct"])."')";
}
} elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'boolean') {
if ($arrayquery['options_'.$key.'_cnct'] != '') {
if ($arrayquery['options_'.$key.'_cnct'] == 0) {
- $sqlwhere[] = " (te.".$key." = ".$arrayquery['options_'.$key.'_cnct']." OR ((te.".$key." IS NULL) AND (te.fk_object IS NOT NULL)))";
+ $sqlwhere[] = " (te.".$key." = ".((int) $arrayquery["options_".$key."_cnct"])." OR ((te.".$key." IS NULL) AND (te.fk_object IS NOT NULL)))";
} else {
- $sqlwhere[] = " (te.".$key." = ".$arrayquery['options_'.$key.'_cnct'].")";
+ $sqlwhere[] = " (te.".$key." = ".((int) $arrayquery["options_".$key."_cnct"]).")";
}
}
} else {
if (is_array($arrayquery['options_'.$key.'_cnct'])) {
- $sqlwhere[] = " (te.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery['options_'.$key.'_cnct'])."'", 1)."))";
+ $sqlwhere[] = " (te.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery["options_".$key."_cnct"])."'", 1)."))";
} elseif (!empty($arrayquery['options_'.$key.'_cnct'])) {
- $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key.'_cnct'])."')";
+ $sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery["options_".$key."_cnct"])."')";
}
}
}
@@ -850,22 +850,22 @@ class AdvanceTargetingMailing extends CommonObject
} elseif (($extrafields->attributes[$elementtype]['type'][$key] == 'int') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'double')) {
if (!empty($arrayquery['options_'.$key.'_max'])) {
- $sqlwhere[] = " (tse.".$key." >= ".$arrayquery['options_'.$key.'_max']." AND tse.".$key." <= ".$arrayquery['options_'.$key.'_min'].")";
+ $sqlwhere[] = " (tse.".$key." >= ".((float) $arrayquery["options_".$key."_max"])." AND tse.".$key." <= ".((float) $arrayquery["options_".$key."_min"]).")";
}
} elseif (($extrafields->attributes[$elementtype]['type'][$key] == 'date') ||
($extrafields->attributes[$elementtype]['type'][$key] == 'datetime')) {
if (!empty($arrayquery['options_'.$key.'_end_dt'])) {
- $sqlwhere[] = " (tse.".$key." >= '".$this->db->idate($arrayquery['options_'.$key.'_st_dt'])."' AND tse.".$key." <= '".$this->db->idate($arrayquery['options_'.$key.'_end_dt'])."')";
+ $sqlwhere[] = " (tse.".$key." >= '".$this->db->idate($arrayquery["options_".$key."_st_dt"])."' AND tse.".$key." <= '".$this->db->idate($arrayquery["options_".$key."_end_dt"])."')";
}
} elseif ($extrafields->attributes[$elementtype]['type'][$key] == 'boolean') {
if ($arrayquery['options_'.$key] != '') {
- $sqlwhere[] = " (tse.".$key." = ".$arrayquery['options_'.$key].")";
+ $sqlwhere[] = " (tse.".$key." = ".((int) $arrayquery["options_".$key]).")";
}
} else {
if (is_array($arrayquery['options_'.$key])) {
- $sqlwhere[] = " (tse.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery['options_'.$key])."'", 1)."))";
+ $sqlwhere[] = " (tse.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery["options_".$key])."'", 1)."))";
} elseif (!empty($arrayquery['options_'.$key])) {
- $sqlwhere[] = " (tse.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key])."')";
+ $sqlwhere[] = " (tse.".$key." LIKE '".$this->db->escape($arrayquery["options_".$key])."')";
}
}
}
@@ -877,7 +877,7 @@ class AdvanceTargetingMailing extends CommonObject
}
}
- dol_syslog(get_class($this)."::query_contact sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::query_contact", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$this->contact_lines = array();
diff --git a/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php b/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php
index 12684e5f873..cfdca4a1fc2 100644
--- a/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php
+++ b/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php
@@ -237,22 +237,22 @@ class FormAdvTargetEmailing extends Form
$keyList = 'rowid';
if (count($InfoFieldList) >= 3) {
- if (strpos($InfoFieldList [3], 'extra.') !== false) {
- $keyList = 'main.'.$InfoFieldList [2].' as rowid';
+ if (strpos($InfoFieldList[3], 'extra.') !== false) {
+ $keyList = 'main.'.$InfoFieldList[2].' as rowid';
} else {
- $keyList = $InfoFieldList [2].' as rowid';
+ $keyList = $InfoFieldList[2].' as rowid';
}
}
- $sql = 'SELECT '.$keyList.', '.$InfoFieldList [1];
- $sql .= ' FROM '.MAIN_DB_PREFIX.$InfoFieldList [0];
- if (!empty($InfoFieldList [3])) {
+ $sql = "SELECT ".$keyList.", ".$InfoFieldList[1];
+ $sql .= " FROM ".MAIN_DB_PREFIX.$InfoFieldList[0];
+ if (!empty($InfoFieldList[3])) {
// We have to join on extrafield table
- if (strpos($InfoFieldList [3], 'extra') !== false) {
- $sql .= ' as main, '.MAIN_DB_PREFIX.$InfoFieldList [0].'_extrafields as extra';
- $sql .= ' WHERE extra.fk_object=main.'.$InfoFieldList [2].' AND '.$InfoFieldList [3];
+ if (strpos($InfoFieldList[3], 'extra') !== false) {
+ $sql .= ' as main, '.MAIN_DB_PREFIX.$InfoFieldList[0].'_extrafields as extra';
+ $sql .= " WHERE extra.fk_object=main.".$InfoFieldList[2]." AND ".$InfoFieldList[3];
} else {
- $sql .= ' WHERE '.$InfoFieldList [3];
+ $sql .= " WHERE ".$InfoFieldList[3];
}
}
if (!empty($InfoFieldList[1])) {
@@ -267,7 +267,7 @@ class FormAdvTargetEmailing extends Form
if ($num) {
while ($i < $num) {
$obj = $this->db->fetch_object($resql);
- $labeltoshow = dol_trunc($obj->$InfoFieldList [1], 90);
+ $labeltoshow = dol_trunc($obj->$InfoFieldList[1], 90);
$options_array[$obj->rowid] = $labeltoshow;
$i++;
}
diff --git a/htdocs/comm/mailing/class/mailing.class.php b/htdocs/comm/mailing/class/mailing.class.php
index 2d33d4219d8..2f9ef25af31 100644
--- a/htdocs/comm/mailing/class/mailing.class.php
+++ b/htdocs/comm/mailing/class/mailing.class.php
@@ -228,7 +228,7 @@ class Mailing extends CommonObject
$sql = "INSERT INTO ".MAIN_DB_PREFIX."mailing";
$sql .= " (date_creat, fk_user_creat, entity)";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$user->id.", ".$conf->entity.")";
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".((int) $user->id).", ".((int) $conf->entity).")";
if (!$this->title) {
$this->title = $langs->trans("NoTitle");
@@ -647,7 +647,7 @@ class Mailing extends CommonObject
$nbforupdate = $obj->nb;
$sql = 'UPDATE '.MAIN_DB_PREFIX.'mailing SET nbemail = '.((int) $nbforupdate);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= ' WHERE rowid = '.((int) $this->id);
$resqlupdate = $this->db->query($sql);
if (! $resqlupdate) {
diff --git a/htdocs/comm/propal/class/propal.class.php b/htdocs/comm/propal/class/propal.class.php
index 6e3f60a7cf5..2d304f9b1a8 100644
--- a/htdocs/comm/propal/class/propal.class.php
+++ b/htdocs/comm/propal/class/propal.class.php
@@ -1727,7 +1727,7 @@ class Propal extends CommonObject
$sql .= ' d.fk_multicurrency, d.multicurrency_code, d.multicurrency_subprice, d.multicurrency_total_ht, d.multicurrency_total_tva, d.multicurrency_total_ttc';
$sql .= ' FROM '.MAIN_DB_PREFIX.'propaldet as d';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON (d.fk_product = p.rowid)';
- $sql .= ' WHERE d.fk_propal = '.$this->id;
+ $sql .= ' WHERE d.fk_propal = '.((int) $this->id);
if ($only_product) {
$sql .= ' AND p.fk_product_type = 0';
}
diff --git a/htdocs/comm/propal/list.php b/htdocs/comm/propal/list.php
index 23a16e2cfe7..bf06a27e620 100644
--- a/htdocs/comm/propal/list.php
+++ b/htdocs/comm/propal/list.php
@@ -481,7 +481,7 @@ if ($search_categ_cus) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php
index 050b7251898..837683c3800 100644
--- a/htdocs/commande/class/commande.class.php
+++ b/htdocs/commande/class/commande.class.php
@@ -934,8 +934,8 @@ class Commande extends CommonOrder
$sql .= ", multicurrency_code";
$sql .= ", multicurrency_tx";
$sql .= ")";
- $sql .= " VALUES ('(PROV)', ".$this->socid.", '".$this->db->idate($now)."', ".$user->id;
- $sql .= ", ".($this->fk_project > 0 ? $this->fk_project : "null");
+ $sql .= " VALUES ('(PROV)', ".((int) $this->socid).", '".$this->db->idate($now)."', ".((int) $user->id);
+ $sql .= ", ".($this->fk_project > 0 ? ((int) $this->fk_project) : "null");
$sql .= ", '".$this->db->idate($date)."'";
$sql .= ", ".($this->source >= 0 && $this->source != '' ? $this->db->escape($this->source) : 'null');
$sql .= ", '".$this->db->escape($this->note_private)."'";
@@ -944,15 +944,15 @@ class Commande extends CommonOrder
$sql .= ", ".($this->ref_client ? "'".$this->db->escape($this->ref_client)."'" : "null");
$sql .= ", ".($this->ref_int ? "'".$this->db->escape($this->ref_int)."'" : "null");
$sql .= ", '".$this->db->escape($this->model_pdf)."'";
- $sql .= ", ".($this->cond_reglement_id > 0 ? $this->cond_reglement_id : "null");
- $sql .= ", ".($this->mode_reglement_id > 0 ? $this->mode_reglement_id : "null");
- $sql .= ", ".($this->fk_account > 0 ? $this->fk_account : 'NULL');
- $sql .= ", ".($this->availability_id > 0 ? $this->availability_id : "null");
- $sql .= ", ".($this->demand_reason_id > 0 ? $this->demand_reason_id : "null");
+ $sql .= ", ".($this->cond_reglement_id > 0 ? ((int) $this->cond_reglement_id) : "null");
+ $sql .= ", ".($this->mode_reglement_id > 0 ? ((int) $this->mode_reglement_id) : "null");
+ $sql .= ", ".($this->fk_account > 0 ? ((int) $this->fk_account) : 'NULL');
+ $sql .= ", ".($this->availability_id > 0 ? ((int) $this->availability_id) : "null");
+ $sql .= ", ".($this->demand_reason_id > 0 ? ((int) $this->demand_reason_id) : "null");
$sql .= ", ".($delivery_date ? "'".$this->db->idate($delivery_date)."'" : "null");
- $sql .= ", ".($this->fk_delivery_address > 0 ? $this->fk_delivery_address : 'NULL');
- $sql .= ", ".(!empty($this->shipping_method_id) && $this->shipping_method_id > 0 ? $this->shipping_method_id : 'NULL');
- $sql .= ", ".(!empty($this->warehouse_id) && $this->warehouse_id > 0 ? $this->warehouse_id : 'NULL');
+ $sql .= ", ".($this->fk_delivery_address > 0 ? ((int) $this->fk_delivery_address) : 'NULL');
+ $sql .= ", ".(!empty($this->shipping_method_id) && $this->shipping_method_id > 0 ? ((int) $this->shipping_method_id) : 'NULL');
+ $sql .= ", ".(!empty($this->warehouse_id) && $this->warehouse_id > 0 ? ((int) $this->warehouse_id) : 'NULL');
$sql .= ", ".($this->remise_absolue > 0 ? $this->db->escape($this->remise_absolue) : 'NULL');
$sql .= ", ".($this->remise_percent > 0 ? $this->db->escape($this->remise_percent) : 0);
$sql .= ", ".(int) $this->fk_incoterms;
@@ -962,7 +962,7 @@ class Commande extends CommonOrder
$sql .= ", ".($this->pos_source != '' ? "'".$this->db->escape($this->pos_source)."'" : "null");
$sql .= ", ".(int) $this->fk_multicurrency;
$sql .= ", '".$this->db->escape($this->multicurrency_code)."'";
- $sql .= ", ".(double) $this->multicurrency_tx;
+ $sql .= ", ".(float) $this->multicurrency_tx;
$sql .= ")";
dol_syslog(get_class($this)."::create", LOG_DEBUG);
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index b11d97811c8..6f6643336f6 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -436,7 +436,7 @@ if ($search_categ_cus) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php
index 14aeee29d69..51ff5a5b5c4 100644
--- a/htdocs/compta/bank/bankentries_list.php
+++ b/htdocs/compta/bank/bankentries_list.php
@@ -561,7 +561,7 @@ $sql .= " ba.rowid as bankid, ba.ref as bankref";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/compta/bank/list.php b/htdocs/compta/bank/list.php
index 657b1cb8577..cd6e6cfd365 100644
--- a/htdocs/compta/bank/list.php
+++ b/htdocs/compta/bank/list.php
@@ -185,7 +185,7 @@ $sql = "SELECT b.rowid, b.label, b.courant, b.rappro, b.account_number, b.fk_acc
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/compta/cashcontrol/cashcontrol_list.php b/htdocs/compta/cashcontrol/cashcontrol_list.php
index 407e8b3cf73..dbaaf882bfb 100644
--- a/htdocs/compta/cashcontrol/cashcontrol_list.php
+++ b/htdocs/compta/cashcontrol/cashcontrol_list.php
@@ -223,7 +223,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -287,7 +287,7 @@ $sql .= $hookmanager->resPrint;
/* If a group by is required
$sql.= " GROUP BY ";
foreach($object->fields as $key => $val) {
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/compta/facture/invoicetemplate_list.php b/htdocs/compta/facture/invoicetemplate_list.php
index d099bfd57bc..660c7d7c4e4 100644
--- a/htdocs/compta/facture/invoicetemplate_list.php
+++ b/htdocs/compta/facture/invoicetemplate_list.php
@@ -260,7 +260,7 @@ $sql .= " f.fk_cond_reglement, f.fk_mode_reglement";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/compta/facture/list.php b/htdocs/compta/facture/list.php
index cd274c686a9..76cddb2d909 100644
--- a/htdocs/compta/facture/list.php
+++ b/htdocs/compta/facture/list.php
@@ -561,7 +561,7 @@ if ($search_categ_cus && $search_categ_cus!=-1) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/compta/paiement/class/paiement.class.php b/htdocs/compta/paiement/class/paiement.class.php
index 94264d0f9f6..8c8a563f418 100644
--- a/htdocs/compta/paiement/class/paiement.class.php
+++ b/htdocs/compta/paiement/class/paiement.class.php
@@ -292,8 +292,8 @@ class Paiement extends CommonObject
$note = ($this->note_private ? $this->note_private : $this->note);
$sql = "INSERT INTO ".MAIN_DB_PREFIX."paiement (entity, ref, ref_ext, datec, datep, amount, multicurrency_amount, fk_paiement, num_paiement, note, ext_payment_id, ext_payment_site, fk_user_creat, pos_change)";
- $sql .= " VALUES (".$conf->entity.", '".$this->db->escape($this->ref)."', '".$this->db->escape($this->ref_ext)."', '".$this->db->idate($now)."', '".$this->db->idate($this->datepaye)."', ".$total.", ".$mtotal.", ".$this->paiementid.", ";
- $sql .= "'".$this->db->escape($num_payment)."', '".$this->db->escape($note)."', ".($this->ext_payment_id ? "'".$this->db->escape($this->ext_payment_id)."'" : "null").", ".($this->ext_payment_site ? "'".$this->db->escape($this->ext_payment_site)."'" : "null").", ".$user->id.", ".((float) $this->pos_change).")";
+ $sql .= " VALUES (".((int) $conf->entity).", '".$this->db->escape($this->ref)."', '".$this->db->escape($this->ref_ext)."', '".$this->db->idate($now)."', '".$this->db->idate($this->datepaye)."', ".((float) $total).", ".((float) $mtotal).", ".((int) $this->paiementid).", ";
+ $sql .= "'".$this->db->escape($num_payment)."', '".$this->db->escape($note)."', ".($this->ext_payment_id ? "'".$this->db->escape($this->ext_payment_id)."'" : "null").", ".($this->ext_payment_site ? "'".$this->db->escape($this->ext_payment_site)."'" : "null").", ".((int) $user->id).", ".((float) $this->pos_change).")";
$resql = $this->db->query($sql);
if ($resql) {
@@ -305,7 +305,7 @@ class Paiement extends CommonObject
if (is_numeric($amount) && $amount <> 0) {
$amount = price2num($amount);
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'paiement_facture (fk_facture, fk_paiement, amount, multicurrency_amount)';
- $sql .= ' VALUES ('.$facid.', '.$this->id.', \''.$amount.'\', \''.$this->multicurrency_amounts[$key].'\')';
+ $sql .= ' VALUES ('.((int) $facid).', '.((int) $this->id).", ".((float) $amount).", ".((float) $this->multicurrency_amounts[$key]).')';
dol_syslog(get_class($this).'::create Amount line '.$key.' insert paiement_facture', LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php
index a97facc592c..ed7ecae5cf9 100644
--- a/htdocs/compta/prelevement/class/bonprelevement.class.php
+++ b/htdocs/compta/prelevement/class/bonprelevement.class.php
@@ -868,7 +868,7 @@ class BonPrelevement extends CommonObject
$sql .= " AND f.total_ttc > 0";
$sql .= " AND pfd.ext_payment_id IS NULL";
- dol_syslog(__METHOD__."::Read invoices, sql=".$sql, LOG_DEBUG);
+ dol_syslog(__METHOD__."::Read invoices,", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
@@ -992,7 +992,7 @@ class BonPrelevement extends CommonObject
$sql .= " AND entity = ".((int) $conf->entity);
$sql .= " ORDER BY ref DESC LIMIT 1";
- dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::create", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
@@ -1408,7 +1408,7 @@ class BonPrelevement extends CommonObject
$now = dol_now();
$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec,fk_user, fk_soc, fk_contact, fk_action)";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$userid.", 'NULL', 'NULL', '".$this->db->escape($action)."')";
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".((int) $userid).", 'NULL', 'NULL', '".$this->db->escape($action)."')";
dol_syslog("adnotiff: ".$sql);
if ($this->db->query($sql)) {
diff --git a/htdocs/compta/stats/byratecountry.php b/htdocs/compta/stats/byratecountry.php
index d65bed019fc..9a9ba40b56a 100644
--- a/htdocs/compta/stats/byratecountry.php
+++ b/htdocs/compta/stats/byratecountry.php
@@ -325,7 +325,7 @@ if ($modecompta == 'CREANCES-DETTES') {
$sql .= " GROUP BY fd.tva_tx,fd.product_type, cc.label, cc.code ";
$sql .= " ORDER BY country, product_type, vatrate";
- dol_syslog("htdocs/compta/tva/index.php sql=".$sql, LOG_DEBUG);
+ dol_syslog("htdocs/compta/tva/index.php", LOG_DEBUG);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
@@ -413,7 +413,7 @@ if ($modecompta == 'CREANCES-DETTES') {
$sql2 .= " ORDER BY country, product_type, vatrate";
//print $sql2;
- dol_syslog("htdocs/compta/tva/index.php sql=".$sql, LOG_DEBUG);
+ dol_syslog("htdocs/compta/tva/index.php", LOG_DEBUG);
$resql2 = $db->query($sql2);
if ($resql2) {
$num = $db->num_rows($resql2);
diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index a63a1bf7e49..3f98f556cb7 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -361,7 +361,7 @@ $sql .= " co.label as country, co.code as country_code";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php
index 65ffcb7e99a..1ce51af2d90 100644
--- a/htdocs/contrat/class/contrat.class.php
+++ b/htdocs/contrat/class/contrat.class.php
@@ -957,13 +957,13 @@ class Contrat extends CommonObject
$sql = "INSERT INTO ".MAIN_DB_PREFIX."contrat (datec, fk_soc, fk_user_author, date_contrat,";
$sql .= " fk_commercial_signature, fk_commercial_suivi, fk_projet,";
$sql .= " ref, entity, note_private, note_public, ref_customer, ref_supplier, ref_ext)";
- $sql .= " VALUES ('".$this->db->idate($now)."',".$this->socid.",".$user->id;
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".((int) $this->socid).", ".((int) $user->id);
$sql .= ", ".(dol_strlen($this->date_contrat) != 0 ? "'".$this->db->idate($this->date_contrat)."'" : "NULL");
- $sql .= ",".($this->commercial_signature_id > 0 ? $this->commercial_signature_id : "NULL");
- $sql .= ",".($this->commercial_suivi_id > 0 ? $this->commercial_suivi_id : "NULL");
- $sql .= ",".($this->fk_project > 0 ? $this->fk_project : "NULL");
+ $sql .= ",".($this->commercial_signature_id > 0 ? ((int) $this->commercial_signature_id) : "NULL");
+ $sql .= ",".($this->commercial_suivi_id > 0 ? ((int) $this->commercial_suivi_id) : "NULL");
+ $sql .= ",".($this->fk_project > 0 ? ((int) $this->fk_project) : "NULL");
$sql .= ", ".(dol_strlen($this->ref) <= 0 ? "null" : "'".$this->db->escape($this->ref)."'");
- $sql .= ", ".$conf->entity;
+ $sql .= ", ".((int) $conf->entity);
$sql .= ", ".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
$sql .= ", ".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
$sql .= ", ".(!empty($this->ref_customer) ? ("'".$this->db->escape($this->ref_customer)."'") : "NULL");
diff --git a/htdocs/contrat/list.php b/htdocs/contrat/list.php
index 9062bb9fd9c..596e86df53e 100644
--- a/htdocs/contrat/list.php
+++ b/htdocs/contrat/list.php
@@ -244,7 +244,7 @@ $sql .= ' SUM('.$db->ifsql("cd.statut=5", 1, 0).') as nb_closed';
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/contrat/services_list.php b/htdocs/contrat/services_list.php
index d98aca0927d..0c06a194fd4 100644
--- a/htdocs/contrat/services_list.php
+++ b/htdocs/contrat/services_list.php
@@ -235,7 +235,7 @@ $sql .= " cd.tms as date_update";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/core/class/cproductnature.class.php b/htdocs/core/class/cproductnature.class.php
index 6c3a1f7bb9d..cd2114d4929 100644
--- a/htdocs/core/class/cproductnature.class.php
+++ b/htdocs/core/class/cproductnature.class.php
@@ -226,7 +226,7 @@ class CProductNature // extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/core/class/ctyperesource.class.php b/htdocs/core/class/ctyperesource.class.php
index b0a604e9e28..c286418caab 100644
--- a/htdocs/core/class/ctyperesource.class.php
+++ b/htdocs/core/class/ctyperesource.class.php
@@ -253,7 +253,7 @@ class Ctyperesource
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/core/class/cunits.class.php b/htdocs/core/class/cunits.class.php
index 364565af3aa..536a596d2f1 100644
--- a/htdocs/core/class/cunits.class.php
+++ b/htdocs/core/class/cunits.class.php
@@ -269,7 +269,7 @@ class CUnits // extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/core/class/defaultvalues.class.php b/htdocs/core/class/defaultvalues.class.php
index 5b49254b275..165ba87c45d 100644
--- a/htdocs/core/class/defaultvalues.class.php
+++ b/htdocs/core/class/defaultvalues.class.php
@@ -286,7 +286,7 @@ class DefaultValues extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/core/class/notify.class.php b/htdocs/core/class/notify.class.php
index 2f160457ba1..019618366d1 100644
--- a/htdocs/core/class/notify.class.php
+++ b/htdocs/core/class/notify.class.php
@@ -622,10 +622,10 @@ class Notify
if ($mailfile->sendfile()) {
if ($obj->type_target == 'touserid') {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify (daten, fk_action, fk_soc, fk_user, type, objet_type, type_target, objet_id, email)";
- $sql .= " VALUES ('".$this->db->idate(dol_now())."', ".$notifcodedefid.", ".($object->socid ? $object->socid : 'null').", ".$obj->cid.", '".$obj->type."', '".$object_type."', '".$obj->type_target."', ".$object->id.", '".$this->db->escape($obj->email)."')";
+ $sql .= " VALUES ('".$this->db->idate(dol_now())."', ".((int) $notifcodedefid).", ".($object->socid > 0 ? ((int) $object->socid) : 'null').", ".((int) $obj->cid).", '".$this->db->escape($obj->type)."', '".$this->db->escape($object_type)."', '".$this->db->escape($obj->type_target)."', ".((int) $object->id).", '".$this->db->escape($obj->email)."')";
} else {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify (daten, fk_action, fk_soc, fk_contact, type, objet_type, type_target, objet_id, email)";
- $sql .= " VALUES ('".$this->db->idate(dol_now())."', ".$notifcodedefid.", ".($object->socid ? $object->socid : 'null').", ".$obj->cid.", '".$obj->type."', '".$object_type."', '".$obj->type_target."', ".$object->id.", '".$this->db->escape($obj->email)."')";
+ $sql .= " VALUES ('".$this->db->idate(dol_now())."', ".((int) $notifcodedefid).", ".($object->socid > 0 ? ((int) $object->socid) : 'null').", ".((int) $obj->cid).", '".$this->db->escape($obj->type)."', '".$this->db->escape($object_type)."', '".$this->db->escape($obj->type_target)."', ".((int) $object->id).", '".$this->db->escape($obj->email)."')";
}
if (!$this->db->query($sql)) {
dol_print_error($this->db);
@@ -857,7 +857,7 @@ class Notify
if ($mailfile->sendfile()) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify (daten, fk_action, fk_soc, fk_contact, type, type_target, objet_type, objet_id, email)";
- $sql .= " VALUES ('".$this->db->idate(dol_now())."', ".$notifcodedefid.", ".($object->socid ? $object->socid : 'null').", null, 'email', 'tofixedemail', '".$object_type."', ".$object->id.", '".$this->db->escape($conf->global->$param)."')";
+ $sql .= " VALUES ('".$this->db->idate(dol_now())."', ".((int) $notifcodedefid).", ".($object->socid > 0 ? ((int) $object->socid) : 'null').", null, 'email', 'tofixedemail', '".$this->db->escape($object_type)."', ".((int) $object->id).", '".$this->db->escape($conf->global->$param)."')";
if (!$this->db->query($sql)) {
dol_print_error($this->db);
}
diff --git a/htdocs/core/db/DoliDB.class.php b/htdocs/core/db/DoliDB.class.php
index 8c62390f447..29ced10dc35 100644
--- a/htdocs/core/db/DoliDB.class.php
+++ b/htdocs/core/db/DoliDB.class.php
@@ -203,9 +203,9 @@ abstract class DoliDB implements Database
$limit = $conf->liste_limit;
}
if ($offset > 0) {
- return " LIMIT $offset,$limit ";
+ return " LIMIT ".((int) $offset).",".((int) $limit)." ";
} else {
- return " LIMIT $limit ";
+ return " LIMIT ".((int) $limit)." ";
}
}
diff --git a/htdocs/core/lib/admin.lib.php b/htdocs/core/lib/admin.lib.php
index 6361860e392..3df3e7ee182 100644
--- a/htdocs/core/lib/admin.lib.php
+++ b/htdocs/core/lib/admin.lib.php
@@ -1806,7 +1806,7 @@ function addDocumentModel($name, $type, $label = '', $description = '')
$db->begin();
$sql = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity, libelle, description)";
- $sql .= " VALUES ('".$db->escape($name)."','".$db->escape($type)."',".$conf->entity.", ";
+ $sql .= " VALUES ('".$db->escape($name)."','".$db->escape($type)."',".((int) $conf->entity).", ";
$sql .= ($label ? "'".$db->escape($label)."'" : 'null').", ";
$sql .= (!empty($description) ? "'".$db->escape($description)."'" : "null");
$sql .= ")";
diff --git a/htdocs/core/lib/functions2.lib.php b/htdocs/core/lib/functions2.lib.php
index ae7acf44861..f89156b24e1 100644
--- a/htdocs/core/lib/functions2.lib.php
+++ b/htdocs/core/lib/functions2.lib.php
@@ -1815,7 +1815,7 @@ function dol_set_user_param($db, $conf, &$user, $tab)
// Set new parameters
if ($value) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."user_param(fk_user,entity,param,value)";
- $sql .= " VALUES (".((int) $user->id).",".$conf->entity.",";
+ $sql .= " VALUES (".((int) $user->id).",".((int) $conf->entity).",";
$sql .= " '".$db->escape($key)."','".$db->escape($value)."')";
dol_syslog("functions2.lib::dol_set_user_param", LOG_DEBUG);
diff --git a/htdocs/core/modules/DolibarrModules.class.php b/htdocs/core/modules/DolibarrModules.class.php
index 2e21e2c7ef1..e9688daf28e 100644
--- a/htdocs/core/modules/DolibarrModules.class.php
+++ b/htdocs/core/modules/DolibarrModules.class.php
@@ -1222,8 +1222,8 @@ class DolibarrModules // Can not be abstract, because we need to instantiate it
continue; // Not enabled by default onto this page.
}
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."boxes (box_id,position,box_order,fk_user,entity)";
- $sql .= " VALUES (".$lastid.", ".$key2.", '0', 0, ".$conf->entity.")";
+ $sql = "INSERT INTO ".MAIN_DB_PREFIX."boxes (box_id, position, box_order, fk_user, entity)";
+ $sql .= " VALUES (".((int) $lastid).", ".((int) $key2).", '0', 0, ".((int) $conf->entity).")";
dol_syslog(get_class($this)."::insert_boxes onto page ".$key2."=".$val2."", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2065,7 +2065,7 @@ class DolibarrModules // Can not be abstract, because we need to instantiate it
if ($row[0] == 0) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."const (name,type,value,note,visible,entity)";
- $sql .= " VALUES (".$this->db->encrypt($name, 1).",'chaine',".$this->db->encrypt($dir, 1).",'Directory for module ".$this->name."','0',".$conf->entity.")";
+ $sql .= " VALUES ('".$this->db->escape($this->db->encrypt($name))."', 'chaine', '".$this->db->escape($this->db->encrypt($dir))."', 'Directory for module ".$this->name."', '0', ".((int) $conf->entity).")";
dol_syslog(get_class($this)."::insert_dirs", LOG_DEBUG);
$this->db->query($sql);
@@ -2156,12 +2156,12 @@ class DolibarrModules // Can not be abstract, because we need to instantiate it
$sql .= ", entity";
$sql .= ")";
$sql .= " VALUES (";
- $sql .= $this->db->encrypt($this->const_name."_".strtoupper($key), 1);
+ $sql .= "'".$this->db->escape($this->db->encrypt($this->const_name."_".strtoupper($key)))."'";
$sql .= ", 'chaine'";
- $sql .= ", ".$this->db->encrypt($newvalue, 1);
+ $sql .= ", '".$this->db->escape($this->db->encrypt($newvalue))."'";
$sql .= ", null";
$sql .= ", '0'";
- $sql .= ", ".$entity;
+ $sql .= ", ".((int) $entity);
$sql .= ")";
dol_syslog(get_class($this)."::insert_module_parts for key=".$this->const_name."_".strtoupper($key), LOG_DEBUG);
diff --git a/htdocs/core/modules/modAdherent.class.php b/htdocs/core/modules/modAdherent.class.php
index d620c6244b7..ff0c67408c5 100644
--- a/htdocs/core/modules/modAdherent.class.php
+++ b/htdocs/core/modules/modAdherent.class.php
@@ -431,8 +431,8 @@ class modAdherent extends DolibarrModules
}*/
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type='member' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','member',".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type='member' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','member',".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modBom.class.php b/htdocs/core/modules/modBom.class.php
index 18f46fda70f..71b40d5f19c 100644
--- a/htdocs/core/modules/modBom.class.php
+++ b/htdocs/core/modules/modBom.class.php
@@ -503,8 +503,8 @@ class modBom extends DolibarrModules
}
$sql = array(
- //"DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape('standard')."' AND type = 'bom' AND entity = ".$conf->entity,
- //"INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape('standard')."', 'bom', ".$conf->entity.")"
+ //"DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape('standard')."' AND type = 'bom' AND entity = ".((int) $conf->entity),
+ //"INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape('standard')."', 'bom', ".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modCommande.class.php b/htdocs/core/modules/modCommande.class.php
index 4275d806d40..d9d30e8b7a1 100644
--- a/htdocs/core/modules/modCommande.class.php
+++ b/htdocs/core/modules/modCommande.class.php
@@ -466,8 +466,8 @@ class modCommande extends DolibarrModules
}
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'order' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','order',".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'order' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."', 'order', ".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modContrat.class.php b/htdocs/core/modules/modContrat.class.php
index f91e54039f4..2fc0c7f1e0d 100644
--- a/htdocs/core/modules/modContrat.class.php
+++ b/htdocs/core/modules/modContrat.class.php
@@ -33,7 +33,6 @@ include_once DOL_DOCUMENT_ROOT.'/core/modules/DolibarrModules.class.php';
*/
class modContrat extends DolibarrModules
{
-
/**
* Constructor. Define names, constants, directories, boxes, permissions
*
@@ -246,8 +245,8 @@ class modContrat extends DolibarrModules
}
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[1][2])."' AND type = 'contract' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[1][2])."','contract',".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[1][2])."' AND type = 'contract' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[1][2])."', 'contract', ".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modDon.class.php b/htdocs/core/modules/modDon.class.php
index 7d8a8fc9455..da7ee6c5e82 100644
--- a/htdocs/core/modules/modDon.class.php
+++ b/htdocs/core/modules/modDon.class.php
@@ -156,8 +156,8 @@ class modDon extends DolibarrModules
global $conf;
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'donation' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','donation',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'donation' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','donation',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modEmailCollector.class.php b/htdocs/core/modules/modEmailCollector.class.php
index 53223ecd705..566d050aacd 100644
--- a/htdocs/core/modules/modEmailCollector.class.php
+++ b/htdocs/core/modules/modEmailCollector.class.php
@@ -264,16 +264,6 @@ class modEmailCollector extends DolibarrModules
public function init($options = '')
{
global $conf, $user;
- //$this->_load_tables('/dav/sql/');
-
- // Create extrafields
- //include_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php';
- //$extrafields = new ExtraFields($this->db);
- //$result1=$extrafields->addExtraField('myattr1', "New Attr 1 label", 'boolean', 1, 3, 'thirdparty', 0, 0, '', '', 1, '', 0, 0, '', '', 'dav@dav', '$conf->dav->enabled');
- //$result2=$extrafields->addExtraField('myattr2', "New Attr 2 label", 'varchar', 1, 10, 'project', 0, 0, '', '', 1, '', 0, 0, '', '', 'dav@dav', '$conf->dav->enabled');
- //$result3=$extrafields->addExtraField('myattr3', "New Attr 3 label", 'varchar', 1, 10, 'bank_account', 0, 0, '', '', 1, '', 0, 0, '', '', 'dav@dav', '$conf->dav->enabled');
- //$result4=$extrafields->addExtraField('myattr4', "New Attr 4 label", 'select', 1, 3, 'thirdparty', 0, 1, '', array('options'=>array('code1'=>'Val1','code2'=>'Val2','code3'=>'Val3')), 1 '', 0, 0, '', '', 'dav@dav', '$conf->dav->enabled');
- //$result5=$extrafields->addExtraField('myattr5', "New Attr 5 label", 'text', 1, 10, 'user', 0, 0, '', '', 1, '', 0, 0, '', '', 'dav@dav', '$conf->dav->enabled');
$sql = array();
@@ -285,17 +275,17 @@ class modEmailCollector extends DolibarrModules
$descriptionA1 .= ' If the collector Collect_Responses is also enabled, when you send an email from the ticket, you may also see answers of your customers or partners directly on the ticket view.';
$sqlforexampleA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollector (entity, ref, label, description, source_directory, date_creation, fk_user_creat, status)";
- $sqlforexampleA1 .= " VALUES (".$conf->entity.", 'Collect_Ticket_Requets', 'Example to collect ticket requests', '".$this->db->escape($descriptionA1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
+ $sqlforexampleA1 .= " VALUES (".$conf->entity.", 'Collect_Ticket_Requets', 'Example to collect ticket requests', '".$this->db->escape($descriptionA1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 0)";
$sqlforexampleFilterA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'isnotanswer', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'isnotanswer', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleFilterA2 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterA2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'withouttrackingid', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterA2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'withouttrackingid', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleFilterA3 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, rulevalue, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterA3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'to', 'support@example.com', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterA3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'to', 'support@example.com', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleA4 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectoraction (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleA4 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'ticket', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleA4 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'ticket', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sql[] = $sqlforexampleA1;
$sql[] = $sqlforexampleFilterA1;
@@ -314,14 +304,14 @@ class modEmailCollector extends DolibarrModules
$descriptionA1 = 'This collector will scan your mailbox "Sent" directory to find emails that was sent as an answer of another email directly from your email software and not from Dolibarr. If such an email is found, the event of answer is recorded into Dolibarr.';
$sqlforexampleA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollector (entity, ref, label, description, source_directory, date_creation, fk_user_creat, status)";
- $sqlforexampleA1 .= " VALUES (".$conf->entity.", 'Collect_Responses_Out', 'Example to collect answers to emails done from your external email software', '".$this->db->escape($descriptionA1)."', 'Sent', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
+ $sqlforexampleA1 .= " VALUES (".$conf->entity.", 'Collect_Responses_Out', 'Example to collect answers to emails done from your external email software', '".$this->db->escape($descriptionA1)."', 'Sent', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 0)";
$sqlforexampleFilterA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".$conf->entity."), 'isanswer', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".((int) $conf->entity)."), 'isanswer', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleFilterA2 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterA2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".$conf->entity."), 'withouttrackingidinmsgid', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterA2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".((int) $conf->entity)."), 'withouttrackingidinmsgid', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleActionA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectoraction (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleActionA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".$conf->entity."), 'recordevent', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleActionA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".((int) $conf->entity)."), 'recordevent', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sql[] = $sqlforexampleA1;
$sql[] = $sqlforexampleFilterA1;
@@ -330,18 +320,18 @@ class modEmailCollector extends DolibarrModules
}
}
- $tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_In' and entity = ".$conf->entity;
+ $tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_In' and entity = ".((int) $conf->entity);
$tmpresql = $this->db->query($tmpsql);
if ($tmpresql) {
if ($this->db->num_rows($tmpresql) == 0) {
$descriptionB1 = 'This collector will scan your mailbox to find all emails that are an answer of an email sent from your application. An event (Module Agenda must be enabled) with the email response will be recorded at the good place. For example, if your send a commercial proposal, order, invoice or message for a ticket by email from the application, and your customer answers your email, the system will automatically catch the answer and add it into your ERP.';
$sqlforexampleB1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollector (entity, ref, label, description, source_directory, date_creation, fk_user_creat, status)";
- $sqlforexampleB1 .= " VALUES (".$conf->entity.", 'Collect_Responses_In', 'Example to collect any received email that is a response of an email sent from Dolibarr', '".$this->db->escape($descriptionB1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
+ $sqlforexampleB1 .= " VALUES (".$conf->entity.", 'Collect_Responses_In', 'Example to collect any received email that is a response of an email sent from Dolibarr', '".$this->db->escape($descriptionB1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 0)";
$sqlforexampleB2 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleB2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_In' and entity = ".$conf->entity."), 'isanswer', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleB2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_In' and entity = ".((int) $conf->entity)."), 'isanswer', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleB3 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectoraction (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleB3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_In' and entity = ".$conf->entity."), 'recordevent', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleB3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_In' and entity = ".((int) $conf->entity)."), 'recordevent', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sql[] = $sqlforexampleB1;
$sql[] = $sqlforexampleB2;
@@ -351,7 +341,7 @@ class modEmailCollector extends DolibarrModules
dol_print_error($this->db);
}
- $tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".$conf->entity;
+ $tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".((int) $conf->entity);
$tmpresql = $this->db->query($tmpsql);
if ($tmpresql) {
if ($this->db->num_rows($tmpresql) == 0) {
@@ -360,17 +350,17 @@ class modEmailCollector extends DolibarrModules
$descriptionC1 .= "Note: With this initial example, the title of the lead is generated including the email. If the thirdparty can't be found in database (new customer), the lead will be attached to the thirdparty with ID 1.";
$sqlforexampleC1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollector (entity, ref, label, description, source_directory, date_creation, fk_user_creat, status)";
- $sqlforexampleC1 .= " VALUES (".$conf->entity.", 'Collect_Leads', 'Example to collect leads', '".$this->db->escape($descriptionC1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
+ $sqlforexampleC1 .= " VALUES (".$conf->entity.", 'Collect_Leads', 'Example to collect leads', '".$this->db->escape($descriptionC1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 0)";
$sqlforexampleFilterC1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterC1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".$conf->entity."), 'isnotanswer', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterC1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".((int) $conf->entity)."), 'isnotanswer', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleFilterC2 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterC2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".$conf->entity."), 'withouttrackingid', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterC2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".((int) $conf->entity)."), 'withouttrackingid', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleFilterC3 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, rulevalue, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterC3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".$conf->entity."), 'to', 'sales@example.com', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterC3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".((int) $conf->entity)."), 'to', 'sales@example.com', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleC4 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectoraction (fk_emailcollector, type, actionparam, date_creation, fk_user_creat, status)";
- $sqlforexampleC4 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".$conf->entity."), 'project', 'tmp_from=EXTRACT:HEADER:^From:(.*);socid=SETIFEMPTY:1;usage_opportunity=SET:1;description=EXTRACT:BODY:(.*);title=SET:Lead or message from __tmp_from__ received by email', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleC4 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Leads' and entity = ".((int) $conf->entity)."), 'project', 'tmp_from=EXTRACT:HEADER:^From:(.*);socid=SETIFEMPTY:1;usage_opportunity=SET:1;description=EXTRACT:BODY:(.*);title=SET:Lead or message from __tmp_from__ received by email', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sql[] = $sqlforexampleC1;
$sql[] = $sqlforexampleFilterC1;
@@ -382,7 +372,7 @@ class modEmailCollector extends DolibarrModules
dol_print_error($this->db);
}
- $tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".$conf->entity;
+ $tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".((int) $conf->entity);
$tmpresql = $this->db->query($tmpsql);
if ($tmpresql) {
if ($this->db->num_rows($tmpresql) == 0) {
@@ -390,17 +380,17 @@ class modEmailCollector extends DolibarrModules
$descriptionC1 .= "Note: With this initial example, the title of the candidature is generated including the email.";
$sqlforexampleC1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollector (entity, ref, label, description, source_directory, date_creation, fk_user_creat, status)";
- $sqlforexampleC1 .= " VALUES (".$conf->entity.", 'Collect_Candidatures', 'Example to collect email for job candidatures', '".$this->db->escape($descriptionC1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
+ $sqlforexampleC1 .= " VALUES (".$conf->entity.", 'Collect_Candidatures', 'Example to collect email for job candidatures', '".$this->db->escape($descriptionC1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 0)";
$sqlforexampleFilterC1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterC1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".$conf->entity."), 'isnotanswer', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterC1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".((int) $conf->entity)."), 'isnotanswer', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleFilterC2 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterC2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".$conf->entity."), 'withouttrackingid', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterC2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".((int) $conf->entity)."), 'withouttrackingid', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleFilterC3 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, rulevalue, date_creation, fk_user_creat, status)";
- $sqlforexampleFilterC3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".$conf->entity."), 'to', 'jobs@example.com', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleFilterC3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".((int) $conf->entity)."), 'to', 'jobs@example.com', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sqlforexampleC4 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectoraction (fk_emailcollector, type, actionparam, date_creation, fk_user_creat, status)";
- $sqlforexampleC4 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".$conf->entity."), 'candidature', 'tmp_from=EXTRACT:HEADER:^From:(.*)(<.*>)?;fk_recruitmentjobposition=EXTRACT:HEADER:^To:[^\n]*\+([^\n]*);description=EXTRACT:BODY:(.*);lastname=SET:__tmp_from__', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+ $sqlforexampleC4 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Candidatures' and entity = ".((int) $conf->entity)."), 'candidature', 'tmp_from=EXTRACT:HEADER:^From:(.*)(<.*>)?;fk_recruitmentjobposition=EXTRACT:HEADER:^To:[^\n]*\+([^\n]*);description=EXTRACT:BODY:(.*);lastname=SET:__tmp_from__', '".$this->db->idate(dol_now())."', ".((int) $user->id).", 1)";
$sql[] = $sqlforexampleC1;
$sql[] = $sqlforexampleFilterC1;
diff --git a/htdocs/core/modules/modEventOrganization.class.php b/htdocs/core/modules/modEventOrganization.class.php
index 4ba73d4fe2c..8a3fb3d80cf 100644
--- a/htdocs/core/modules/modEventOrganization.class.php
+++ b/htdocs/core/modules/modEventOrganization.class.php
@@ -387,10 +387,10 @@ class modEventOrganization extends DolibarrModules
}
$sql = array_merge($sql, array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".$this->db->escape(strtolower($myTmpObjectKey))."',".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".$this->db->escape(strtolower($myTmpObjectKey))."', ".((int) $conf->entity).")"
));
}
}
diff --git a/htdocs/core/modules/modExpedition.class.php b/htdocs/core/modules/modExpedition.class.php
index 238eef2d6fe..c10e13a46d8 100644
--- a/htdocs/core/modules/modExpedition.class.php
+++ b/htdocs/core/modules/modExpedition.class.php
@@ -359,10 +359,10 @@ class modExpedition extends DolibarrModules
$sql = array();
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'shipping' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','shipping',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[3][2])."' AND type = 'delivery' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[3][2])."','delivery',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'shipping' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','shipping',".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[3][2])."' AND type = 'delivery' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[3][2])."','delivery',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modExpenseReport.class.php b/htdocs/core/modules/modExpenseReport.class.php
index 63bc99f41ee..53708ece3dd 100644
--- a/htdocs/core/modules/modExpenseReport.class.php
+++ b/htdocs/core/modules/modExpenseReport.class.php
@@ -249,8 +249,8 @@ class modExpenseReport extends DolibarrModules
$this->remove($options);
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard' AND type='expensereport' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard','expensereport',".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard' AND type='expensereport' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard','expensereport',".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modFacture.class.php b/htdocs/core/modules/modFacture.class.php
index bb044900acd..2fadb5d86ae 100644
--- a/htdocs/core/modules/modFacture.class.php
+++ b/htdocs/core/modules/modFacture.class.php
@@ -458,8 +458,8 @@ class modFacture extends DolibarrModules
}
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[1][2])."' AND type = 'invoice' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[1][2])."','invoice',".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[1][2])."' AND type = 'invoice' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[1][2])."','invoice',".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modFicheinter.class.php b/htdocs/core/modules/modFicheinter.class.php
index af99e6f646f..784eeb006c3 100644
--- a/htdocs/core/modules/modFicheinter.class.php
+++ b/htdocs/core/modules/modFicheinter.class.php
@@ -231,8 +231,8 @@ class modFicheinter extends DolibarrModules
$this->remove($options);
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'ficheinter' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','ficheinter',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'ficheinter' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','ficheinter',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modFournisseur.class.php b/htdocs/core/modules/modFournisseur.class.php
index 5d71a5abdc8..baa983fc7cf 100644
--- a/htdocs/core/modules/modFournisseur.class.php
+++ b/htdocs/core/modules/modFournisseur.class.php
@@ -857,8 +857,8 @@ class modFournisseur extends DolibarrModules
}
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'order_supplier' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','order_supplier',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'order_supplier' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."', 'order_supplier', ".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modHoliday.class.php b/htdocs/core/modules/modHoliday.class.php
index be0b39ecc7e..63c76e24548 100644
--- a/htdocs/core/modules/modHoliday.class.php
+++ b/htdocs/core/modules/modHoliday.class.php
@@ -336,8 +336,8 @@ class modHoliday extends DolibarrModules
*/
$sql = array(
- // "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'holiday' AND entity = ".$conf->entity,
- // "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','holiday',".$conf->entity.")"
+ // "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'holiday' AND entity = ".((int) $conf->entity),
+ // "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','holiday',".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modKnowledgeManagement.class.php b/htdocs/core/modules/modKnowledgeManagement.class.php
index 6d9bef40232..5957158e893 100644
--- a/htdocs/core/modules/modKnowledgeManagement.class.php
+++ b/htdocs/core/modules/modKnowledgeManagement.class.php
@@ -474,10 +474,10 @@ class modKnowledgeManagement extends DolibarrModules
}
$sql = array_merge($sql, array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".((int) $conf->entity).")"
));
}
}
diff --git a/htdocs/core/modules/modMrp.class.php b/htdocs/core/modules/modMrp.class.php
index eb3baae78cd..1cfbd76caf7 100644
--- a/htdocs/core/modules/modMrp.class.php
+++ b/htdocs/core/modules/modMrp.class.php
@@ -352,8 +352,8 @@ class modMrp extends DolibarrModules
}
$sql = array(
- //"DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape('standard')."' AND type = 'mo' AND entity = ".$conf->entity,
- //"INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape('standard')."', 'mo', ".$conf->entity.")"
+ //"DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape('standard')."' AND type = 'mo' AND entity = ".((int) $conf->entity),
+ //"INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape('standard')."', 'mo', ".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modPartnership.class.php b/htdocs/core/modules/modPartnership.class.php
index d7041eca754..a036613fcec 100644
--- a/htdocs/core/modules/modPartnership.class.php
+++ b/htdocs/core/modules/modPartnership.class.php
@@ -453,10 +453,10 @@ class modPartnership extends DolibarrModules
}
$sql = array_merge($sql, array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".((int) $conf->entity).")"
));
}
}
diff --git a/htdocs/core/modules/modPrelevement.class.php b/htdocs/core/modules/modPrelevement.class.php
index 8d68b372e91..a42d3c8b5a0 100644
--- a/htdocs/core/modules/modPrelevement.class.php
+++ b/htdocs/core/modules/modPrelevement.class.php
@@ -145,8 +145,8 @@ class modPrelevement extends DolibarrModules
$this->remove($options);
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'bankaccount' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','bankaccount',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'bankaccount' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','bankaccount',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modProjet.class.php b/htdocs/core/modules/modProjet.class.php
index 25448f239e6..66138c584b5 100644
--- a/htdocs/core/modules/modProjet.class.php
+++ b/htdocs/core/modules/modProjet.class.php
@@ -366,12 +366,12 @@ class modProjet extends DolibarrModules
}
$sql = array();
- $sql[] = "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[3][2])."' AND type = 'task' AND entity = ".$conf->entity;
- $sql[] = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[3][2])."','task',".$conf->entity.")";
- $sql[] = "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'beluga' AND type = 'project' AND entity = ".$conf->entity;
- $sql[] = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('beluga','project',".$conf->entity.")";
- $sql[] = "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'baleine' AND type = 'project' AND entity = ".$conf->entity;
- $sql[] = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('baleine','project',".$conf->entity.")";
+ $sql[] = "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[3][2])."' AND type = 'task' AND entity = ".((int) $conf->entity);
+ $sql[] = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[3][2])."','task',".((int) $conf->entity).")";
+ $sql[] = "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'beluga' AND type = 'project' AND entity = ".((int) $conf->entity);
+ $sql[] = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('beluga','project',".((int) $conf->entity).")";
+ $sql[] = "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'baleine' AND type = 'project' AND entity = ".((int) $conf->entity);
+ $sql[] = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('baleine','project',".((int) $conf->entity).")";
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modPropale.class.php b/htdocs/core/modules/modPropale.class.php
index 83e2b5a0402..33a28c9ec11 100644
--- a/htdocs/core/modules/modPropale.class.php
+++ b/htdocs/core/modules/modPropale.class.php
@@ -470,8 +470,8 @@ class modPropale extends DolibarrModules
}
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'propal' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','propal',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'propal' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','propal',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modReception.class.php b/htdocs/core/modules/modReception.class.php
index 02f17cf0fbe..4696f15019a 100644
--- a/htdocs/core/modules/modReception.class.php
+++ b/htdocs/core/modules/modReception.class.php
@@ -282,8 +282,8 @@ class modReception extends DolibarrModules
$sql = array();
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'reception' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','reception',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'reception' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','reception',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modRecruitment.class.php b/htdocs/core/modules/modRecruitment.class.php
index 3d4e88872ef..02e7cdfbf4c 100644
--- a/htdocs/core/modules/modRecruitment.class.php
+++ b/htdocs/core/modules/modRecruitment.class.php
@@ -448,10 +448,10 @@ class modRecruitment extends DolibarrModules
}
$sql = array_merge($sql, array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".$this->db->escape(strtolower($myTmpObjectKey))."',".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".$this->db->escape(strtolower($myTmpObjectKey))."', ".((int) $conf->entity).")"
));
}
}
diff --git a/htdocs/core/modules/modStock.class.php b/htdocs/core/modules/modStock.class.php
index 3494cb684dc..d0cfa64c884 100644
--- a/htdocs/core/modules/modStock.class.php
+++ b/htdocs/core/modules/modStock.class.php
@@ -35,7 +35,6 @@ include_once DOL_DOCUMENT_ROOT.'/core/modules/DolibarrModules.class.php';
*/
class modStock extends DolibarrModules
{
-
/**
* Constructor. Define names, constants, directories, boxes, permissions
*
@@ -454,10 +453,10 @@ class modStock extends DolibarrModules
$sql = array();
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[1][2])."' AND type = 'stock' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[1][2])."','stock',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[2][2])."' AND type = 'mouvement' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[2][2])."','mouvement',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[1][2])."' AND type = 'stock' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[1][2])."','stock',".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[2][2])."' AND type = 'mouvement' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[2][2])."','mouvement',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modSupplierProposal.class.php b/htdocs/core/modules/modSupplierProposal.class.php
index 4a0fc21fa44..36df0dd27bd 100644
--- a/htdocs/core/modules/modSupplierProposal.class.php
+++ b/htdocs/core/modules/modSupplierProposal.class.php
@@ -179,8 +179,8 @@ class modSupplierProposal extends DolibarrModules
}
$sql = array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'supplier_proposal' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','supplier_proposal',".$conf->entity.")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = '".$this->db->escape($this->const[0][2])."' AND type = 'supplier_proposal' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('".$this->db->escape($this->const[0][2])."','supplier_proposal',".((int) $conf->entity).")",
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modTicket.class.php b/htdocs/core/modules/modTicket.class.php
index 78bcb9901af..01561b40b01 100644
--- a/htdocs/core/modules/modTicket.class.php
+++ b/htdocs/core/modules/modTicket.class.php
@@ -344,8 +344,8 @@ class modTicket extends DolibarrModules
array("sql" => "insert into llx_c_type_contact(rowid, element, source, code, libelle, active ) values (110121, 'ticket', 'internal', 'CONTRIBUTOR', 'Intervenant', 1);", "ignoreerror" => 1),
array("sql" => "insert into llx_c_type_contact(rowid, element, source, code, libelle, active ) values (110122, 'ticket', 'external', 'SUPPORTCLI', 'Contact client suivi incident', 1);", "ignoreerror" => 1),
array("sql" => "insert into llx_c_type_contact(rowid, element, source, code, libelle, active ) values (110123, 'ticket', 'external', 'CONTRIBUTOR', 'Intervenant', 1);", "ignoreerror" => 1),
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'TICKET_ADDON_PDF_ODT_PATH' AND type = 'ticket' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('TICKET_ADDON_PDF_ODT_PATH','ticket',".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'TICKET_ADDON_PDF_ODT_PATH' AND type = 'ticket' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('TICKET_ADDON_PDF_ODT_PATH','ticket',".((int) $conf->entity).")"
);
return $this->_init($sql, $options);
diff --git a/htdocs/core/modules/modWorkstation.class.php b/htdocs/core/modules/modWorkstation.class.php
index 8e2d676bf27..3069be8ced5 100755
--- a/htdocs/core/modules/modWorkstation.class.php
+++ b/htdocs/core/modules/modWorkstation.class.php
@@ -435,10 +435,10 @@ class modWorkstation extends DolibarrModules
}
$sql = array_merge($sql, array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".$this->db->escape(strtolower($myTmpObjectKey))."',".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".$this->db->escape(strtolower($myTmpObjectKey))."', ".((int) $conf->entity).")"
));
}
}
diff --git a/htdocs/core/modules/movement/doc/pdf_standard.modules.php b/htdocs/core/modules/movement/doc/pdf_standard.modules.php
index e029c4d5d66..528f45ee962 100644
--- a/htdocs/core/modules/movement/doc/pdf_standard.modules.php
+++ b/htdocs/core/modules/movement/doc/pdf_standard.modules.php
@@ -278,7 +278,7 @@ class pdf_stdandard extends ModelePDFMovement
// Add fields from extrafields
if (!empty($extrafields->attributes[$element]['label'])) {
foreach ($extrafields->attributes[$element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/ecm/class/ecmfiles.class.php b/htdocs/ecm/class/ecmfiles.class.php
index 035a7aee9c6..049ba50bfbe 100644
--- a/htdocs/ecm/class/ecmfiles.class.php
+++ b/htdocs/ecm/class/ecmfiles.class.php
@@ -548,7 +548,7 @@ class EcmFiles extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$this->lines = array();
diff --git a/htdocs/eventorganization/class/conferenceorbooth.class.php b/htdocs/eventorganization/class/conferenceorbooth.class.php
index bb84bbe37bd..09997716c01 100644
--- a/htdocs/eventorganization/class/conferenceorbooth.class.php
+++ b/htdocs/eventorganization/class/conferenceorbooth.class.php
@@ -313,7 +313,7 @@ class ConferenceOrBooth extends ActionComm
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/eventorganization/class/conferenceorboothattendee.class.php b/htdocs/eventorganization/class/conferenceorboothattendee.class.php
index cdc350480c5..825451e9868 100644
--- a/htdocs/eventorganization/class/conferenceorboothattendee.class.php
+++ b/htdocs/eventorganization/class/conferenceorboothattendee.class.php
@@ -434,7 +434,7 @@ class ConferenceOrBoothAttendee extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/eventorganization/conferenceorbooth_list.php b/htdocs/eventorganization/conferenceorbooth_list.php
index 9430d2c52ad..d3bbd835367 100644
--- a/htdocs/eventorganization/conferenceorbooth_list.php
+++ b/htdocs/eventorganization/conferenceorbooth_list.php
@@ -449,7 +449,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
diff --git a/htdocs/eventorganization/conferenceorboothattendee_list.php b/htdocs/eventorganization/conferenceorboothattendee_list.php
index 72d66b7fb87..9184d9ae771 100644
--- a/htdocs/eventorganization/conferenceorboothattendee_list.php
+++ b/htdocs/eventorganization/conferenceorboothattendee_list.php
@@ -225,7 +225,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
diff --git a/htdocs/expedition/list.php b/htdocs/expedition/list.php
index d28435092b2..2c0239d44e2 100644
--- a/htdocs/expedition/list.php
+++ b/htdocs/expedition/list.php
@@ -245,7 +245,7 @@ if ($search_categ_cus) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index a83ef94e520..c2b63f9393e 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -497,7 +497,7 @@ class ExpenseReport extends CommonObject
$sql .= " , detail_refuse = ".(!empty($this->detail_refuse) ? "'".$this->db->escape($this->detail_refuse)."'" : "''");
$sql .= " WHERE rowid = ".((int) $this->id);
- dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::update", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
if (!$notrigger) {
@@ -552,7 +552,7 @@ class ExpenseReport extends CommonObject
}
//$sql.= $restrict;
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$obj = $this->db->fetch_object($resql);
@@ -665,7 +665,7 @@ class ExpenseReport extends CommonObject
$sql .= " SET fk_statut = ".self::STATUS_CLOSED.", paid=1";
$sql .= " WHERE rowid = ".((int) $id)." AND fk_statut = ".self::STATUS_APPROVED;
- dol_syslog(get_class($this)."::set_paid sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::set_paid", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
if ($this->db->affected_rows($resql)) {
@@ -882,7 +882,7 @@ class ExpenseReport extends CommonObject
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport_det as de";
$sql .= " WHERE de.fk_projet = ".((int) $projectid);
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
$num = $this->db->num_rows($result);
@@ -1353,7 +1353,7 @@ class ExpenseReport extends CommonObject
$sql .= " SET fk_statut = ".self::STATUS_VALIDATED;
$sql .= ' WHERE rowid = '.$this->id;
- dol_syslog(get_class($this)."::set_save_from_refuse sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::set_save_from_refuse", LOG_DEBUG);
if ($this->db->query($sql)) {
return 1;
@@ -1509,7 +1509,7 @@ class ExpenseReport extends CommonObject
$sql .= " SET paid = 0, fk_statut = ".self::STATUS_APPROVED;
$sql .= ' WHERE rowid = '.$this->id;
- dol_syslog(get_class($this)."::set_unpaid sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::set_unpaid", LOG_DEBUG);
if ($this->db->query($sql)) {
if (!$notrigger) {
@@ -1563,7 +1563,7 @@ class ExpenseReport extends CommonObject
$sql .= " ,detail_cancel='".$this->db->escape($detail)."'";
$sql .= ' WHERE rowid = '.$this->id;
- dol_syslog(get_class($this)."::set_cancel sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::set_cancel", LOG_DEBUG);
if ($this->db->query($sql)) {
if (!$notrigger) {
diff --git a/htdocs/expensereport/list.php b/htdocs/expensereport/list.php
index 610713d6f48..760c25e4db8 100644
--- a/htdocs/expensereport/list.php
+++ b/htdocs/expensereport/list.php
@@ -277,7 +277,7 @@ $sql .= " u.rowid as id_user, u.firstname, u.lastname, u.login, u.email, u.statu
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/fichinter/list.php b/htdocs/fichinter/list.php
index 508eb984307..6f4dccd878d 100644
--- a/htdocs/fichinter/list.php
+++ b/htdocs/fichinter/list.php
@@ -231,7 +231,7 @@ if (!empty($conf->contrat->enabled)) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php
index d248ed44321..4b74b596be5 100644
--- a/htdocs/fourn/class/fournisseur.commande.class.php
+++ b/htdocs/fourn/class/fournisseur.commande.class.php
@@ -2537,10 +2537,10 @@ class CommandeFournisseur extends CommonOrder
$sql = "INSERT INTO ".MAIN_DB_PREFIX."commande_fournisseurdet";
$sql .= " (fk_commande, label, description, fk_product, price, qty, tva_tx, localtax1_tx, localtax2_tx, remise_percent, subprice, remise, ref)";
- $sql .= " VALUES (".$idc.", '".$this->db->escape($label)."', ".$this->db->escape($comclient->lines[$i]->desc);
- $sql .= ",".$comclient->lines[$i]->fk_product.", ".price2num($comclient->lines[$i]->price);
- $sql .= ", ".$comclient->lines[$i]->qty.", ".$comclient->lines[$i]->tva_tx.", ".$comclient->lines[$i]->localtax1_tx.", ".$comclient->lines[$i]->localtax2_tx.", ".$comclient->lines[$i]->remise_percent;
- $sql .= ", '".price2num($comclient->lines[$i]->subprice)."','0', '".$this->db->escape($ref)."');";
+ $sql .= " VALUES (".((int) $idc).", '".$this->db->escape($label)."', '".$this->db->escape($comclient->lines[$i]->desc)."'";
+ $sql .= ",".$comclient->lines[$i]->fk_product.", ".price2num($comclient->lines[$i]->price, 'MU');
+ $sql .= ", ".price2num($comclient->lines[$i]->qty, 'MS').", ".price2num($comclient->lines[$i]->tva_tx, 5).", ".price2num($comclient->lines[$i]->localtax1_tx, 5).", ".price2num($comclient->lines[$i]->localtax2_tx, 5).", ".price2num($comclient->lines[$i]->remise_percent, 3);
+ $sql .= ", '".price2num($comclient->lines[$i]->subprice, 'MT')."','0', '".$this->db->escape($ref)."');";
if ($this->db->query($sql)) {
$this->update_price();
}
@@ -2564,8 +2564,8 @@ class CommandeFournisseur extends CommonOrder
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande_fournisseur';
- $sql .= ' SET fk_statut='.$status;
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " SET fk_statut = ".$status;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setStatus", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/fourn/class/fournisseur.commande.dispatch.class.php b/htdocs/fourn/class/fournisseur.commande.dispatch.class.php
index cd1ff267fb7..39aaea1bbfe 100644
--- a/htdocs/fourn/class/fournisseur.commande.dispatch.class.php
+++ b/htdocs/fourn/class/fournisseur.commande.dispatch.class.php
@@ -684,7 +684,7 @@ class CommandeFournisseurDispatch extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$this->lines = array();
diff --git a/htdocs/fourn/commande/list.php b/htdocs/fourn/commande/list.php
index a5d0382dbdc..e4d10cbb23d 100644
--- a/htdocs/fourn/commande/list.php
+++ b/htdocs/fourn/commande/list.php
@@ -653,7 +653,7 @@ $sql .= " u.firstname, u.lastname, u.photo, u.login, u.email as user_email, u.st
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php
index 8f2aaadb8ea..d6f07426a04 100644
--- a/htdocs/fourn/facture/list.php
+++ b/htdocs/fourn/facture/list.php
@@ -430,7 +430,7 @@ if (!$search_all) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/holiday/list.php b/htdocs/holiday/list.php
index 334f68da404..6aecff5eac0 100644
--- a/htdocs/holiday/list.php
+++ b/htdocs/holiday/list.php
@@ -296,7 +296,7 @@ $sql .= " ua.photo as validator_photo";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/hrm/class/establishment.class.php b/htdocs/hrm/class/establishment.class.php
index cbbe1670a09..d26a10a923a 100644
--- a/htdocs/hrm/class/establishment.class.php
+++ b/htdocs/hrm/class/establishment.class.php
@@ -269,7 +269,7 @@ class Establishment extends CommonObject
$sql .= ", entity = ".((int) $this->entity);
$sql .= " WHERE rowid = ".((int) $this->id);
- dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::update", LOG_DEBUG);
$result = $this->db->query($sql);
if ($result) {
$this->db->commit();
diff --git a/htdocs/intracommreport/list.php b/htdocs/intracommreport/list.php
index 686bd16d5de..a4fed4def2d 100644
--- a/htdocs/intracommreport/list.php
+++ b/htdocs/intracommreport/list.php
@@ -207,7 +207,7 @@ $sql = 'SELECT DISTINCT i.rowid, i.type_declaration, i.type_export, i.periods, i
/*
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
- foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql.=($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql.=($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
*/
// Add fields from hooks
diff --git a/htdocs/knowledgemanagement/class/knowledgerecord.class.php b/htdocs/knowledgemanagement/class/knowledgerecord.class.php
index f85e795326e..559e6f21cf0 100644
--- a/htdocs/knowledgemanagement/class/knowledgerecord.class.php
+++ b/htdocs/knowledgemanagement/class/knowledgerecord.class.php
@@ -387,15 +387,15 @@ class KnowledgeRecord extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
$sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -407,7 +407,7 @@ class KnowledgeRecord extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/knowledgemanagement/knowledgerecord_list.php b/htdocs/knowledgemanagement/knowledgerecord_list.php
index 828137556ce..868c64e8786 100644
--- a/htdocs/knowledgemanagement/knowledgerecord_list.php
+++ b/htdocs/knowledgemanagement/knowledgerecord_list.php
@@ -220,7 +220,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ",ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ",ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -284,7 +284,7 @@ $sql .= $hookmanager->resPrint;
/* If a group by is required
$sql.= " GROUP BY ";
foreach($object->fields as $key => $val) {
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/modulebuilder/template/class/myobject.class.php b/htdocs/modulebuilder/template/class/myobject.class.php
index 243567082fa..dc72b81a96a 100644
--- a/htdocs/modulebuilder/template/class/myobject.class.php
+++ b/htdocs/modulebuilder/template/class/myobject.class.php
@@ -443,27 +443,27 @@ class MyObject extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
- $sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
+ $sqlwhere[] = $key." IN (".$this->db->sanitize($this->db->escape($value)).")";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
if (count($sqlwhere) > 0) {
- $sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
+ $sql .= " AND (".implode(" ".$filtermode." ", $sqlwhere).")";
}
if (!empty($sortfield)) {
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/modulebuilder/template/myobject_list.php b/htdocs/modulebuilder/template/myobject_list.php
index 3656531809a..2eee13fd879 100644
--- a/htdocs/modulebuilder/template/myobject_list.php
+++ b/htdocs/modulebuilder/template/myobject_list.php
@@ -266,7 +266,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -330,7 +330,7 @@ $sql .= $hookmanager->resPrint;
/* If a group by is required
$sql .= " GROUP BY ";
foreach($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/mrp/class/mo.class.php b/htdocs/mrp/class/mo.class.php
index a0bc74bc4ad..bc5e8eca58a 100644
--- a/htdocs/mrp/class/mo.class.php
+++ b/htdocs/mrp/class/mo.class.php
@@ -437,13 +437,13 @@ class Mo extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -455,7 +455,7 @@ class Mo extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
@@ -1546,13 +1546,13 @@ class MoLine extends CommonObjectLine
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -1564,7 +1564,7 @@ class MoLine extends CommonObjectLine
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/mrp/mo_list.php b/htdocs/mrp/mo_list.php
index 012b43ff61a..5b4215f91db 100644
--- a/htdocs/mrp/mo_list.php
+++ b/htdocs/mrp/mo_list.php
@@ -207,7 +207,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -272,7 +272,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY ";
foreach($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/mrp/mo_movements.php b/htdocs/mrp/mo_movements.php
index 803fb3bf5b7..bab57db22ea 100644
--- a/htdocs/mrp/mo_movements.php
+++ b/htdocs/mrp/mo_movements.php
@@ -423,7 +423,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
// Add fields from extrafields
if (!empty($extrafields->attributes[$objectlist->table_element]['label'])) {
foreach ($extrafields->attributes[$objectlist->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$objectlist->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$objectlist->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/partnership/class/partnership.class.php b/htdocs/partnership/class/partnership.class.php
index 6de34719f77..121b53007df 100644
--- a/htdocs/partnership/class/partnership.class.php
+++ b/htdocs/partnership/class/partnership.class.php
@@ -483,15 +483,15 @@ class Partnership extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
- $sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
+ $sqlwhere[] = $key." IN (".$this->db->sanitize($this->db->escape($value)).")";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -503,7 +503,7 @@ class Partnership extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/partnership/partnership_list.php b/htdocs/partnership/partnership_list.php
index e36e94d39c7..e9c577213d6 100644
--- a/htdocs/partnership/partnership_list.php
+++ b/htdocs/partnership/partnership_list.php
@@ -260,7 +260,7 @@ if ($managedfor == 'member') {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
@@ -342,7 +342,7 @@ $sql .= $hookmanager->resPrint;
/* If a group by is required
$sql.= " GROUP BY ";
foreach($object->fields as $key => $val) {
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index ae2aca9fbc9..4dcdb0df538 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -1605,7 +1605,7 @@ class Product extends CommonObject
$sql .= "$field = '".$this->db->escape($value)."'";
$sql .= " WHERE rowid = ".((int) $this->id);
- dol_syslog(__METHOD__." sql=".$sql, LOG_DEBUG);
+ dol_syslog(__METHOD__."", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/product/class/productcustomerprice.class.php b/htdocs/product/class/productcustomerprice.class.php
index 07590099571..701b10093af 100644
--- a/htdocs/product/class/productcustomerprice.class.php
+++ b/htdocs/product/class/productcustomerprice.class.php
@@ -418,7 +418,7 @@ class Productcustomerprice extends CommonObject
}
$sql .= $this->db->order($sortfield, $sortorder);
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
dol_syslog(get_class($this)."::fetch_all", LOG_DEBUG);
@@ -531,7 +531,7 @@ class Productcustomerprice extends CommonObject
}
$sql .= $this->db->order($sortfield, $sortorder);
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
dol_syslog(get_class($this)."::fetch_all_log", LOG_DEBUG);
diff --git a/htdocs/product/class/productfournisseurprice.class.php b/htdocs/product/class/productfournisseurprice.class.php
index 41e1d2d0f6b..7597b32f21a 100644
--- a/htdocs/product/class/productfournisseurprice.class.php
+++ b/htdocs/product/class/productfournisseurprice.class.php
@@ -326,15 +326,15 @@ class ProductFournisseurPrice extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
$sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -346,7 +346,7 @@ class ProductFournisseurPrice extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/product/inventory/list.php b/htdocs/product/inventory/list.php
index 2d6b5374caa..36910c75fb2 100644
--- a/htdocs/product/inventory/list.php
+++ b/htdocs/product/inventory/list.php
@@ -205,7 +205,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -271,7 +271,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY ";
foreach($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/product/list.php b/htdocs/product/list.php
index ff21caf96f9..4d208133759 100644
--- a/htdocs/product/list.php
+++ b/htdocs/product/list.php
@@ -394,7 +394,7 @@ if (!empty($conf->variants->enabled) && (!empty($conf->global->PRODUIT_ATTRIBUTE
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/product/stock/class/productstockentrepot.class.php b/htdocs/product/stock/class/productstockentrepot.class.php
index d8138c7f149..0fdbba51041 100644
--- a/htdocs/product/stock/class/productstockentrepot.class.php
+++ b/htdocs/product/stock/class/productstockentrepot.class.php
@@ -291,7 +291,7 @@ class ProductStockEntrepot extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$lines = array();
diff --git a/htdocs/product/stock/list.php b/htdocs/product/stock/list.php
index b8f998c0ec0..cba4c43bce1 100644
--- a/htdocs/product/stock/list.php
+++ b/htdocs/product/stock/list.php
@@ -200,12 +200,12 @@ $title = $langs->trans("ListOfWarehouses");
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
@@ -273,7 +273,7 @@ $reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters, $objec
$sql .= $hookmanager->resPrint;
$sql .= " GROUP BY ";
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/product/stock/movement_card.php b/htdocs/product/stock/movement_card.php
index b6d5ae78407..24e5ae2b689 100644
--- a/htdocs/product/stock/movement_card.php
+++ b/htdocs/product/stock/movement_card.php
@@ -439,7 +439,7 @@ $sql .= " u.login, u.photo, u.lastname, u.firstname";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/product/stock/movement_list.php b/htdocs/product/stock/movement_list.php
index 1096d8b9e09..3a162cc640f 100644
--- a/htdocs/product/stock/movement_list.php
+++ b/htdocs/product/stock/movement_list.php
@@ -488,7 +488,7 @@ $sql .= " u.login, u.photo, u.lastname, u.firstname, u.email as user_email, u.st
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/product/stock/productlot_list.php b/htdocs/product/stock/productlot_list.php
index 78a18ca960b..25c9921ce18 100644
--- a/htdocs/product/stock/productlot_list.php
+++ b/htdocs/product/stock/productlot_list.php
@@ -201,12 +201,12 @@ $title = $langs->trans('LotSerialList');
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -253,7 +253,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY ";
foreach($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/projet/class/task.class.php b/htdocs/projet/class/task.class.php
index 53973f7672e..c05f726031c 100644
--- a/htdocs/projet/class/task.class.php
+++ b/htdocs/projet/class/task.class.php
@@ -795,12 +795,12 @@ class Task extends CommonObject
$sql .= " p.fk_opp_status, p.opp_amount, p.opp_percent, p.budget_amount";
if (!empty($extrafields->attributes['projet']['label'])) {
foreach ($extrafields->attributes['projet']['label'] as $key => $val) {
- $sql .= ($extrafields->attributes['projet']['type'][$key] != 'separate' ? ",efp.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes['projet']['type'][$key] != 'separate' ? ",efp.".$key." as options_".$key : '');
}
}
if (!empty($extrafields->attributes['projet_task']['label'])) {
foreach ($extrafields->attributes['projet_task']['label'] as $key => $val) {
- $sql .= ($extrafields->attributes['projet_task']['type'][$key] != 'separate' ? ",efpt.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes['projet_task']['type'][$key] != 'separate' ? ",efpt.".$key." as options_".$key : '');
}
}
if ($includebilltime) {
diff --git a/htdocs/projet/list.php b/htdocs/projet/list.php
index 43f5bd6ff2f..f9910813720 100644
--- a/htdocs/projet/list.php
+++ b/htdocs/projet/list.php
@@ -353,7 +353,7 @@ $sql .= " cls.code as opp_status_code";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/projet/tasks/list.php b/htdocs/projet/tasks/list.php
index 8dc369b6a0a..36c4a22d763 100644
--- a/htdocs/projet/tasks/list.php
+++ b/htdocs/projet/tasks/list.php
@@ -304,7 +304,7 @@ if (!empty($arrayfields['t.tobill']['checked']) || !empty($arrayfields['t.billed
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/public/recruitment/index.php b/htdocs/public/recruitment/index.php
index f3d84ec996f..f6fdd94b6f1 100644
--- a/htdocs/public/recruitment/index.php
+++ b/htdocs/public/recruitment/index.php
@@ -247,7 +247,7 @@ if ($display_ticket_list) {
// Add fields for extrafields
if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
$sql .= " FROM ".MAIN_DB_PREFIX."recruitment_recruitmentjobposition as t";
diff --git a/htdocs/public/ticket/list.php b/htdocs/public/ticket/list.php
index 3c5dfffba17..2249dcaa930 100644
--- a/htdocs/public/ticket/list.php
+++ b/htdocs/public/ticket/list.php
@@ -332,7 +332,7 @@ if ($action == "view_ticketlist") {
// Add fields for extrafields
if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
$sql .= " FROM ".MAIN_DB_PREFIX."ticket as t";
diff --git a/htdocs/reception/list.php b/htdocs/reception/list.php
index dd9f365c39a..3541a1b8065 100644
--- a/htdocs/reception/list.php
+++ b/htdocs/reception/list.php
@@ -428,7 +428,7 @@ $sql .= ' e.date_creation as date_creation, e.tms as date_update';
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/recruitment/class/recruitmentcandidature.class.php b/htdocs/recruitment/class/recruitmentcandidature.class.php
index 3c5cf401a92..e0008d1a694 100644
--- a/htdocs/recruitment/class/recruitmentcandidature.class.php
+++ b/htdocs/recruitment/class/recruitmentcandidature.class.php
@@ -375,15 +375,15 @@ class RecruitmentCandidature extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
- $sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
+ $sqlwhere[] = $key." IN (".$this->db->sanitize($this->db->escape($value)).")";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -395,7 +395,7 @@ class RecruitmentCandidature extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/recruitment/class/recruitmentjobposition.class.php b/htdocs/recruitment/class/recruitmentjobposition.class.php
index 7e44aad7b64..94ce1f8683d 100644
--- a/htdocs/recruitment/class/recruitmentjobposition.class.php
+++ b/htdocs/recruitment/class/recruitmentjobposition.class.php
@@ -384,15 +384,15 @@ class RecruitmentJobPosition extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
- $sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
+ $sqlwhere[] = $key." IN (".$this->db->sanitize($this->db->escape($value)).")";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -404,7 +404,7 @@ class RecruitmentJobPosition extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/recruitment/recruitmentcandidature_list.php b/htdocs/recruitment/recruitmentcandidature_list.php
index 7a5a88bc6c4..70b5366aec7 100644
--- a/htdocs/recruitment/recruitmentcandidature_list.php
+++ b/htdocs/recruitment/recruitmentcandidature_list.php
@@ -238,12 +238,12 @@ $title = $langs->trans('ListOfCandidatures');
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -290,7 +290,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY ";
foreach ($object->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/recruitment/recruitmentjobposition_list.php b/htdocs/recruitment/recruitmentjobposition_list.php
index c82c8312b40..8f45caed040 100644
--- a/htdocs/recruitment/recruitmentjobposition_list.php
+++ b/htdocs/recruitment/recruitmentjobposition_list.php
@@ -246,7 +246,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -312,7 +312,7 @@ $sql .= $hookmanager->resPrint;
/* If a group by is required */
$sql .= " GROUP BY ";
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/resource/class/dolresource.class.php b/htdocs/resource/class/dolresource.class.php
index b7f16a9ff9d..db70bc571bf 100644
--- a/htdocs/resource/class/dolresource.class.php
+++ b/htdocs/resource/class/dolresource.class.php
@@ -499,7 +499,7 @@ class Dolresource extends CommonObject
// Add fields from extrafields
if (!empty($extrafields->attributes[$this->table_element]['label'])) {
foreach ($extrafields->attributes[$this->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$this->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$this->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
$sql .= " ty.label as type_label";
diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php
index 555fa3b05e1..d7dde07af5f 100644
--- a/htdocs/societe/class/societe.class.php
+++ b/htdocs/societe/class/societe.class.php
@@ -4774,7 +4774,7 @@ class Societe extends CommonObject
$sql.= $field." = '".$this->db->escape($value)."'";
$sql.= " WHERE rowid = ".((int) $this->id);
- dol_syslog(get_class($this)."::".__FUNCTION__." sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::".__FUNCTION__."", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/societe/list.php b/htdocs/societe/list.php
index 3105700ff65..66d045e1210 100644
--- a/htdocs/societe/list.php
+++ b/htdocs/societe/list.php
@@ -476,7 +476,7 @@ if ($search_categ_sup && $search_categ_sup!=-1) {
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/societe/website.php b/htdocs/societe/website.php
index 0740200867d..0ea53355629 100644
--- a/htdocs/societe/website.php
+++ b/htdocs/societe/website.php
@@ -261,12 +261,12 @@ print ' ';
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($objectwebsiteaccount->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -304,7 +304,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY "
foreach($objectwebsiteaccount->fields as $key => $val)
{
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/supplier_proposal/list.php b/htdocs/supplier_proposal/list.php
index 2529e594f2d..a3ab70c8c5a 100644
--- a/htdocs/supplier_proposal/list.php
+++ b/htdocs/supplier_proposal/list.php
@@ -306,7 +306,7 @@ $sql .= " u.firstname, u.lastname, u.photo, u.login";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : '');
}
}
// Add fields from hooks
diff --git a/htdocs/ticket/class/cticketcategory.class.php b/htdocs/ticket/class/cticketcategory.class.php
index 4e3e6311354..34321b5b898 100644
--- a/htdocs/ticket/class/cticketcategory.class.php
+++ b/htdocs/ticket/class/cticketcategory.class.php
@@ -395,15 +395,15 @@ class CTicketCategory extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
- $sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
+ $sqlwhere[] = $key." IN (".$this->db->sanitize($this->db->escape($value)).")";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -415,7 +415,7 @@ class CTicketCategory extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php
index bf08e2fdf01..e2860d240d7 100644
--- a/htdocs/ticket/class/ticket.class.php
+++ b/htdocs/ticket/class/ticket.class.php
@@ -472,7 +472,7 @@ class Ticket extends CommonObject
$this->db->begin();
- dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::create", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
@@ -582,7 +582,7 @@ class Ticket extends CommonObject
}
}
- dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
if ($this->db->num_rows($resql)) {
@@ -692,7 +692,7 @@ class Ticket extends CommonObject
$sql .= ", type.label as type_label, category.label as category_label, severity.label as severity_label";
// Add fields for extrafields
foreach ($extrafields->attributes[$this->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$this->table_element]['type'][$key] != 'separate' ? ",ef.".$key.' as options_'.$key : '');
+ $sql .= ($extrafields->attributes[$this->table_element]['type'][$key] != 'separate' ? ",ef.".$key." as options_".$key : '');
}
$sql .= " FROM ".MAIN_DB_PREFIX."ticket as t";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_ticket_type as type ON type.code=t.type_code";
@@ -736,10 +736,10 @@ class Ticket extends CommonObject
$sql .= " ORDER BY ".$sortfield.' '.$sortorder;
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
- dol_syslog(get_class($this)."::fetch_all sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch_all", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
@@ -1143,7 +1143,7 @@ class Ticket extends CommonObject
$sql .= " FROM ".MAIN_DB_PREFIX."c_ticket_type";
$sql .= " WHERE active > 0";
$sql .= " ORDER BY pos";
- dol_syslog(get_class($this)."::load_cache_type_tickets sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::load_cache_type_tickets", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$num = $this->db->num_rows($resql);
@@ -1183,7 +1183,7 @@ class Ticket extends CommonObject
$sql .= " FROM ".MAIN_DB_PREFIX."c_ticket_category";
$sql .= " WHERE active > 0";
$sql .= " ORDER BY pos";
- dol_syslog(get_class($this)."::load_cache_categories_tickets sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::load_cache_categories_tickets", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$num = $this->db->num_rows($resql);
@@ -1227,7 +1227,7 @@ class Ticket extends CommonObject
$sql .= " FROM ".MAIN_DB_PREFIX."c_ticket_severity";
$sql .= " WHERE active > 0";
$sql .= " ORDER BY pos";
- dol_syslog(get_class($this)."::loadCacheSeveritiesTickets sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::loadCacheSeveritiesTickets", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$num = $this->db->num_rows($resql);
@@ -1725,7 +1725,7 @@ class Ticket extends CommonObject
$sql .= " AND elementtype = 'ticket'";
$sql .= " ORDER BY datec DESC";
- dol_syslog(get_class($this)."::load_cache_actions_ticket sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::load_cache_actions_ticket", LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
$num = $this->db->num_rows($resql);
diff --git a/htdocs/ticket/list.php b/htdocs/ticket/list.php
index c79a75e851c..625503538b5 100644
--- a/htdocs/ticket/list.php
+++ b/htdocs/ticket/list.php
@@ -335,12 +335,12 @@ $title = $langs->trans('TicketList');
// --------------------------------------------------------------------
$sql = 'SELECT ';
foreach ($object->fields as $key => $val) {
- $sql .= 't.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php
index 325db34141d..f22882b1852 100644
--- a/htdocs/user/class/user.class.php
+++ b/htdocs/user/class/user.class.php
@@ -3125,7 +3125,7 @@ class User extends CommonObject
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."user";
$sql .= " WHERE fk_user = ".((int) $this->id);
- dol_syslog(get_class($this)."::get_children sql=".$sql, LOG_DEBUG);
+ dol_syslog(get_class($this)."::get_children", LOG_DEBUG);
$res = $this->db->query($sql);
if ($res) {
$users = array();
@@ -3515,13 +3515,13 @@ class User extends CommonObject
if (!empty($filter)) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
- } elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = ".((int) $value);
+ } elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/user/list.php b/htdocs/user/list.php
index a3b69d1dff8..69e94e1cfdc 100644
--- a/htdocs/user/list.php
+++ b/htdocs/user/list.php
@@ -336,7 +336,7 @@ $sql .= " s.nom as name, s.canvas,";
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
diff --git a/htdocs/user/notify/card.php b/htdocs/user/notify/card.php
index 05b45ebf829..a0cc0128b4c 100644
--- a/htdocs/user/notify/card.php
+++ b/htdocs/user/notify/card.php
@@ -38,7 +38,7 @@ $id = GETPOST("id", 'int');
$ref = GETPOST('ref', 'alpha');
$action = GETPOST('action', 'aZ09');
-$actionid = GETPOST('actionid');
+$actionid = GETPOST('actionid', 'int');
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST("sortfield", 'alpha');
@@ -99,8 +99,8 @@ if ($action == 'add') {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."notify_def";
$sql .= " WHERE fk_user=".((int) $id)." AND fk_action=".((int) $actionid);
if ($db->query($sql)) {
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec,fk_user, fk_action)";
- $sql .= " VALUES ('".$db->idate($now)."',".$id.",".$actionid.")";
+ $sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec, fk_user, fk_action)";
+ $sql .= " VALUES ('".$db->idate($now)."', ".((int) $id).", ".$actionid.")";
if (!$db->query($sql)) {
$error++;
diff --git a/htdocs/variants/class/ProductAttributeValue.class.php b/htdocs/variants/class/ProductAttributeValue.class.php
index e91542f90c5..5ee341526bb 100644
--- a/htdocs/variants/class/ProductAttributeValue.class.php
+++ b/htdocs/variants/class/ProductAttributeValue.class.php
@@ -160,8 +160,7 @@ class ProductAttributeValue extends CommonObject
$this->value = $this->db->escape($this->value);
$sql = "INSERT INTO ".MAIN_DB_PREFIX."product_attribute_value (fk_product_attribute, ref, value, entity)
- VALUES ('".(int) $this->fk_product_attribute."', '".$this->db->escape($this->ref)."',
- '".$this->value."', ".(int) $this->entity.")";
+ VALUES (".(int) $this->fk_product_attribute.", '".$this->db->escape($this->ref)."', '".$this->db->escape($this->value)."', ".(int) $this->entity.")";
$query = $this->db->query($sql);
diff --git a/htdocs/website/class/website.class.php b/htdocs/website/class/website.class.php
index 7e70bfddc6d..4e19c057fd0 100644
--- a/htdocs/website/class/website.class.php
+++ b/htdocs/website/class/website.class.php
@@ -426,7 +426,7 @@ class Website extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$this->records = array();
diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php
index 16053069d30..f255b4e92e5 100644
--- a/htdocs/website/class/websitepage.class.php
+++ b/htdocs/website/class/websitepage.class.php
@@ -448,7 +448,7 @@ class WebsitePage extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/workstation/class/workstation.class.php b/htdocs/workstation/class/workstation.class.php
index 03d1e6e3dd4..8b550add124 100755
--- a/htdocs/workstation/class/workstation.class.php
+++ b/htdocs/workstation/class/workstation.class.php
@@ -427,15 +427,15 @@ class Workstation extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
- $sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
+ $sqlwhere[] = $key." IN (".$this->db->sanitize($this->db->escape($value)).")";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -447,7 +447,7 @@ class Workstation extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/workstation/workstation_list.php b/htdocs/workstation/workstation_list.php
index d305e0c2c33..b395c5e5a1b 100755
--- a/htdocs/workstation/workstation_list.php
+++ b/htdocs/workstation/workstation_list.php
@@ -220,7 +220,7 @@ $sql .= $object->getFieldList('t');
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
- $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
+ $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key.', ' : '');
}
}
// Add fields from hooks
@@ -300,7 +300,7 @@ $sql .= $hookmanager->resPrint;
$sql.= " GROUP BY ";
foreach ($object->fields as $key => $val) {
- $sql.='t.'.$key.', ';
+ $sql .= "t.".$key.", ";
}
// Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) {
diff --git a/htdocs/zapier/class/hook.class.php b/htdocs/zapier/class/hook.class.php
index ba04f504da6..fc03942d978 100644
--- a/htdocs/zapier/class/hook.class.php
+++ b/htdocs/zapier/class/hook.class.php
@@ -419,13 +419,13 @@ class Hook extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sqlwhere[] = $key.' = '.((int) $value);
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -437,7 +437,7 @@ class Hook extends CommonObject
$sql .= $this->db->order($sortfield, $sortorder);
}
if (!empty($limit)) {
- $sql .= ' '.$this->db->plimit($limit, $offset);
+ $sql .= $this->db->plimit($limit, $offset);
}
$resql = $this->db->query($sql);
diff --git a/test/phpunit/CodingPhpTest.php b/test/phpunit/CodingPhpTest.php
index e4a0e015fe8..a9f6221ea58 100644
--- a/test/phpunit/CodingPhpTest.php
+++ b/test/phpunit/CodingPhpTest.php
@@ -143,6 +143,7 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$user=$this->savuser;
$langs=$this->savlangs;
$db=$this->savdb;
+
print __METHOD__."\n";
}
@@ -286,7 +287,7 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$matches=array();
// Check sql string DELETE|OR|AND|WHERE|INSERT ... yyy = ".$xxx
- // with xxx that is not 'thi' (for $this->db->sanitize) and 'db-' (for $db->sanitize). It means we forget a ' if string or an (int) if int when forging sql request.
+ // with xxx that is not 'thi' (for $this->db->sanitize) and 'db-' (for $db->sanitize). It means we forget a ' if string, or an (int) if int, when forging sql request.
preg_match_all('/(DELETE|OR|AND|WHERE|INSERT)\s.*([^\s][^\s][^\s])\s*=\s*"\s*\.\s*\$(...)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
if ($val[2] == 'ity' && $val[3] == 'con') { // exclude entity = $conf->entity
@@ -300,6 +301,22 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$this->assertTrue($ok, 'Found non quoted or not casted var into sql request '.$file['relativename'].' - Bad.');
//exit;
+ // Check sql string VALUES ... , ".$xxx
+ // with xxx that is not 'db-' (for $db->escape). It means we forget a ' if string, or an (int) if int, when forging sql request.
+ preg_match_all('/(VALUES).*,\s*"\s*\.\s*\$(...)/', $filecontent, $matches, PREG_SET_ORDER);
+ foreach ($matches as $key => $val) {
+ if ($val[2] == 'VALUES' && $val[3] == 'db-') { // exclude $db->escape(
+ continue;
+ }
+ var_dump($matches);
+ $ok=false;
+ break;
+ }
+ //print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
+ $this->assertTrue($ok, 'Found non quoted or not casted var into sql request '.$file['relativename'].' - Bad.');
+ //exit;
+
+ // Check '".$xxx non escaped
// Check string ='".$this->xxx with xxx that is not 'escape'. It means we forget a db->escape when forging sql request.
preg_match_all('/=\s*\'"\s*\.\s*\$this->(....)/', $filecontent, $matches, PREG_SET_ORDER);
@@ -310,10 +327,10 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
}
}
//print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
- $this->assertTrue($ok, 'Found non escaped string in building of a sql request '.$file['relativename'].' - Bad.');
+ $this->assertTrue($ok, 'Found non escaped string in building of a sql request (case 1) in '.$file['relativename'].' - Bad.');
// Check string sql|set...'".$yyy->xxx with xxx that is not 'escape', 'idate', .... It means we forget a db->escape when forging sql request.
- preg_match_all('/(sql|SET|WHERE).+\s*\'"\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
+ preg_match_all('/(sql|SET|WHERE|INSERT|VALUES).+\s*\'"\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
if (! in_array($val[2], array('this->db-', 'this->esc', 'db->escap', 'mydb->esc', 'dbsession', 'db->idate', 'escapedli', 'excludeGr', 'includeGr'))) {
$ok=false;
@@ -322,9 +339,25 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
//if ($reg[0] != 'db') $ok=false;
}
//print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
- $this->assertTrue($ok, 'Found non escaped string in building of a sql request '.$file['relativename'].': '.$val[0].' - Bad.');
+ $this->assertTrue($ok, 'Found non escaped string in building of a sql request (case 2) in '.$file['relativename'].': '.$val[0].' - Bad.');
//exit;
+ // Check string sql|set...'.$yyy->xxx with xxx that is not 'escape', 'idate', .... It means we forget a db->escape when forging sql request.
+ preg_match_all('/(\$sql|SET\s|WHERE\s|INSERT\s|VALUES\s|VALUES\().+\s*\'\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
+ foreach ($matches as $key => $val) {
+ if (! in_array($val[2], array('this->db-', 'db->sanit', 'conf->ent', 'key : \'\')', 'key])."\')', 'excludefi', 'regexstri', 'filtermod'))) {
+ $ok=false;
+ var_dump($matches);
+ break;
+ }
+ //if ($reg[0] != 'db') $ok=false;
+ }
+ //print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
+ $this->assertTrue($ok, 'Found non escaped string in building of a sql request (case 3) in '.$file['relativename'].': '.$val[0].' - Bad.');
+ //exit;
+
+ // Checks with IN
+
// Check string 'IN (".xxx' or 'IN (\'.xxx' with xxx that is not '$this->db->sanitize' and not '$db->sanitize'. It means we forget a db->sanitize when forging sql request.
preg_match_all('/ IN \([\'"]\s*\.\s*(.........)/i', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
From 2dd91bf31294dbde5b3c9fdf7ca68c73e9fdbadb Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Fri, 27 Aug 2021 23:36:06 +0200
Subject: [PATCH 102/953] Clean code
---
htdocs/accountancy/admin/accountmodel.php | 8 ++--
htdocs/accountancy/admin/categories_list.php | 2 +-
htdocs/accountancy/admin/journals_list.php | 2 +-
htdocs/accountancy/bookkeeping/balance.php | 9 ++--
htdocs/adherents/ldap.php | 2 +-
htdocs/adherents/type_ldap.php | 2 +-
htdocs/admin/modules.php | 8 ++--
htdocs/comm/propal/class/propal.class.php | 18 ++++----
htdocs/comm/propal/list.php | 2 +-
htdocs/commande/class/commande.class.php | 32 ++++++-------
htdocs/commande/list.php | 4 +-
htdocs/compta/bank/bankentries_list.php | 2 +-
.../bank/class/paymentvarious.class.php | 2 +-
htdocs/compta/facture/card.php | 12 ++---
.../facture/class/api_invoices.class.php | 2 +-
.../facture/class/facture-rec.class.php | 16 +++----
htdocs/compta/facture/class/facture.class.php | 45 ++++++++++---------
htdocs/compta/facture/list.php | 4 +-
htdocs/compta/paiement.php | 8 ++--
htdocs/compta/paiement/card.php | 4 +-
.../compta/paiement/class/cpaiement.class.php | 4 +-
.../compta/paiement/class/paiement.class.php | 10 ++---
htdocs/compta/payment_sc/card.php | 2 +-
htdocs/compta/payment_vat/card.php | 2 +-
.../sociales/class/cchargesociales.class.php | 2 +-
.../sociales/class/chargesociales.class.php | 2 +-
htdocs/compta/sociales/list.php | 4 +-
htdocs/compta/tva/class/tva.class.php | 2 +-
htdocs/contact/ldap.php | 2 +-
htdocs/core/ajax/ajaxdirpreview.php | 2 +-
htdocs/core/class/commoninvoice.class.php | 36 +++++++--------
htdocs/core/class/commonobject.class.php | 38 ++++++++--------
htdocs/core/class/coreobject.class.php | 2 +-
htdocs/core/lib/functions.lib.php | 5 ++-
htdocs/core/lib/ticket.lib.php | 2 +-
htdocs/don/class/don.class.php | 2 +-
.../class/emailcollector.class.php | 4 +-
htdocs/expedition/class/expedition.class.php | 6 +--
.../class/expensereport.class.php | 22 ++++-----
htdocs/fichinter/card.php | 2 +-
htdocs/fichinter/class/fichinterrec.class.php | 8 ++--
htdocs/fourn/card.php | 6 +--
.../class/fournisseur.commande.class.php | 8 ++--
.../fourn/class/fournisseur.facture.class.php | 8 ++--
htdocs/fourn/class/paiementfourn.class.php | 10 ++---
htdocs/fourn/commande/card.php | 4 +-
htdocs/fourn/facture/card.php | 4 +-
htdocs/fourn/facture/list.php | 2 +-
htdocs/fourn/paiement/card.php | 2 +-
htdocs/loan/class/loan.class.php | 2 +-
.../modulebuilder/template/myobject_list.php | 7 +++
htdocs/mrp/class/mo.class.php | 4 +-
.../class/multicurrency.class.php | 6 +--
.../inventory/class/inventory.class.php | 4 +-
htdocs/product/inventory/inventory.php | 4 +-
htdocs/projet/activity/perday.php | 2 +-
htdocs/projet/activity/permonth.php | 12 ++---
htdocs/reception/class/reception.class.php | 8 ++--
htdocs/salaries/class/salary.class.php | 4 +-
htdocs/salaries/payment_salary/card.php | 2 +-
htdocs/stripe/class/actions_stripe.class.php | 2 +-
.../class/supplier_proposal.class.php | 6 +--
htdocs/user/group/ldap.php | 2 +-
htdocs/user/ldap.php | 2 +-
htdocs/website/class/website.class.php | 2 +-
htdocs/website/index.php | 4 +-
66 files changed, 235 insertions(+), 225 deletions(-)
diff --git a/htdocs/accountancy/admin/accountmodel.php b/htdocs/accountancy/admin/accountmodel.php
index 0f4d538cfac..6aacda28677 100644
--- a/htdocs/accountancy/admin/accountmodel.php
+++ b/htdocs/accountancy/admin/accountmodel.php
@@ -553,16 +553,16 @@ if ($id) {
$num = $db->num_rows($resql);
$i = 0;
- $param = '&id='.$id;
+ $param = '&id='.urlencode($id);
if ($search_country_id > 0) {
- $param .= '&search_country_id='.$search_country_id;
+ $param .= '&search_country_id='.urlencode($search_country_id);
}
$paramwithsearch = $param;
if ($sortorder) {
- $paramwithsearch .= '&sortorder='.$sortorder;
+ $paramwithsearch .= '&sortorder='.urlencode($sortorder);
}
if ($sortfield) {
- $paramwithsearch .= '&sortfield='.$sortfield;
+ $paramwithsearch .= '&sortfield='.urlencode($sortfield);
}
// There is several pages
diff --git a/htdocs/accountancy/admin/categories_list.php b/htdocs/accountancy/admin/categories_list.php
index 9a8a84893fe..53a1d75129b 100644
--- a/htdocs/accountancy/admin/categories_list.php
+++ b/htdocs/accountancy/admin/categories_list.php
@@ -580,7 +580,7 @@ if ($resql) {
$param = '&id='.$id;
if ($search_country_id > 0) {
- $param .= '&search_country_id='.$search_country_id;
+ $param .= '&search_country_id='.urlencode($search_country_id);
}
$paramwithsearch = $param;
if ($sortorder) {
diff --git a/htdocs/accountancy/admin/journals_list.php b/htdocs/accountancy/admin/journals_list.php
index 9ba9d8a6e20..49103716387 100644
--- a/htdocs/accountancy/admin/journals_list.php
+++ b/htdocs/accountancy/admin/journals_list.php
@@ -512,7 +512,7 @@ if ($id) {
$param = '&id='.$id;
if ($search_country_id > 0) {
- $param .= '&search_country_id='.$search_country_id;
+ $param .= '&search_country_id='.urlencode($search_country_id);
}
$paramwithsearch = $param;
if ($sortorder) {
diff --git a/htdocs/accountancy/bookkeeping/balance.php b/htdocs/accountancy/bookkeeping/balance.php
index b84fe255760..126f61e272c 100644
--- a/htdocs/accountancy/bookkeeping/balance.php
+++ b/htdocs/accountancy/bookkeeping/balance.php
@@ -40,6 +40,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
$langs->loadLangs(array("accountancy", "compta"));
$action = GETPOST('action', 'aZ09');
+$contextpage = GETPOST('contextpage', 'aZ09');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
@@ -120,19 +121,19 @@ if ($limit > 0 && $limit != $conf->liste_limit) {
$filter = array();
if (!empty($search_date_start)) {
$filter['t.doc_date>='] = $search_date_start;
- $param .= '&date_startmonth='.GETPOST('date_startmonth', 'int').'&date_startday='.GETPOST('date_startday', 'int').'&date_startyear='.GETPOST('date_startyear', 'int');
+ $param .= '&date_startmonth='.GETPOST('date_startmonth', 'int').'&date_startday='.GETPOST('date_startday', 'int').'&date_startyear='.GETPOST('date_startyear', 'int');
}
if (!empty($search_date_end)) {
$filter['t.doc_date<='] = $search_date_end;
- $param .= '&date_endmonth='.GETPOST('date_endmonth', 'int').'&date_endday='.GETPOST('date_endday', 'int').'&date_endyear='.GETPOST('date_endyear', 'int');
+ $param .= '&date_endmonth='.GETPOST('date_endmonth', 'int').'&date_endday='.GETPOST('date_endday', 'int').'&date_endyear='.GETPOST('date_endyear', 'int');
}
if (!empty($search_accountancy_code_start)) {
$filter['t.numero_compte>='] = $search_accountancy_code_start;
- $param .= '&search_accountancy_code_start='.$search_accountancy_code_start;
+ $param .= '&search_accountancy_code_start='.urlencode($search_accountancy_code_start);
}
if (!empty($search_accountancy_code_end)) {
$filter['t.numero_compte<='] = $search_accountancy_code_end;
- $param .= '&search_accountancy_code_end='.$search_accountancy_code_end;
+ $param .= '&search_accountancy_code_end='.urlencode($search_accountancy_code_end);
}
if (!empty($search_ledger_code)) {
$filter['t.code_journal'] = $search_ledger_code;
diff --git a/htdocs/adherents/ldap.php b/htdocs/adherents/ldap.php
index 44d5ee5399b..d714e3d9a32 100644
--- a/htdocs/adherents/ldap.php
+++ b/htdocs/adherents/ldap.php
@@ -204,7 +204,7 @@ if ($result > 0) {
$result = show_ldap_content($records, 0, $records['count'], true);
}
} else {
- print ''.$langs->trans("LDAPRecordNotFound").' (dn='.$dn.' - search='.$search.') ';
+ print ''.$langs->trans("LDAPRecordNotFound").' (dn='.dol_escape_htmltag($dn).' - search='.dol_escape_htmltag($search).') ';
}
}
diff --git a/htdocs/adherents/type_ldap.php b/htdocs/adherents/type_ldap.php
index 87a952a68b4..a695f84bb81 100644
--- a/htdocs/adherents/type_ldap.php
+++ b/htdocs/adherents/type_ldap.php
@@ -166,7 +166,7 @@ if ($result > 0) {
$result = show_ldap_content($records, 0, $records['count'], true);
}
} else {
- print ''.$langs->trans("LDAPRecordNotFound").' (dn='.$dn.' - search='.$search.') ';
+ print ''.$langs->trans("LDAPRecordNotFound").' (dn='.dol_escape_htmltag($dn).' - search='.dol_escape_htmltag($search).') ';
}
$ldap->unbind();
diff --git a/htdocs/admin/modules.php b/htdocs/admin/modules.php
index 77c070ad573..e3448d19702 100644
--- a/htdocs/admin/modules.php
+++ b/htdocs/admin/modules.php
@@ -789,16 +789,16 @@ if ($mode == 'common' || $mode == 'commonkanban') {
if (!empty($objMod->config_page_url) && !$disableSetup) {
$backtourlparam = '';
if ($search_keyword != '') {
- $backtourlparam .= ($backtourlparam ? '&' : '?').'search_keyword='.$search_keyword; // No urlencode here, done later
+ $backtourlparam .= ($backtourlparam ? '&' : '?').'search_keyword='.urlencode($search_keyword); // No urlencode here, done later
}
if ($search_nature > -1) {
- $backtourlparam .= ($backtourlparam ? '&' : '?').'search_nature='.$search_nature; // No urlencode here, done later
+ $backtourlparam .= ($backtourlparam ? '&' : '?').'search_nature='.urlencode($search_nature); // No urlencode here, done later
}
if ($search_version > -1) {
- $backtourlparam .= ($backtourlparam ? '&' : '?').'search_version='.$search_version; // No urlencode here, done later
+ $backtourlparam .= ($backtourlparam ? '&' : '?').'search_version='.urlencode($search_version); // No urlencode here, done later
}
if ($search_status > -1) {
- $backtourlparam .= ($backtourlparam ? '&' : '?').'search_status='.$search_status; // No urlencode here, done later
+ $backtourlparam .= ($backtourlparam ? '&' : '?').'search_status='.urlencode($search_status); // No urlencode here, done later
}
$backtourl = $_SERVER["PHP_SELF"].$backtourlparam;
diff --git a/htdocs/comm/propal/class/propal.class.php b/htdocs/comm/propal/class/propal.class.php
index 2d304f9b1a8..d92638d7347 100644
--- a/htdocs/comm/propal/class/propal.class.php
+++ b/htdocs/comm/propal/class/propal.class.php
@@ -2284,8 +2284,8 @@ class Propal extends CommonObject
$this->db->begin();
- $sql = 'UPDATE '.MAIN_DB_PREFIX.'propal SET ref_client = '.(empty($ref_client) ? 'NULL' : '\''.$this->db->escape($ref_client).'\'');
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql = "UPDATE ".MAIN_DB_PREFIX."propal SET ref_client = ".(empty($ref_client) ? 'NULL' : "'".$this->db->escape($ref_client)."'");
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(__METHOD__.' $this->id='.$this->id.', ref_client='.$ref_client, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2627,8 +2627,8 @@ class Propal extends CommonObject
$newprivatenote = dol_concatdesc($this->note_private, $note);
$sql = 'UPDATE '.MAIN_DB_PREFIX.'propal SET fk_statut = '.self::STATUS_BILLED.", ";
- $sql .= " note_private = '".$this->db->escape($newprivatenote)."', date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id;
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut = '.self::STATUS_SIGNED;
+ $sql .= " note_private = '".$this->db->escape($newprivatenote)."', date_cloture='".$this->db->idate($now)."', fk_user_cloture=".((int) $user->id);
+ $sql .= ' WHERE rowid = '.((int) $this->id).' AND fk_statut = '.((int) self::STATUS_SIGNED);
dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -4087,7 +4087,7 @@ class PropaleLigne extends CommonObjectLine
$sql .= " ".price2num($this->localtax2_tx).",";
$sql .= " '".$this->db->escape($this->localtax1_type)."',";
$sql .= " '".$this->db->escape($this->localtax2_type)."',";
- $sql .= " ".(price2num($this->subprice) !== '' ?price2num($this->subprice) : "null").",";
+ $sql .= " ".(price2num($this->subprice) !== '' ? price2num($this->subprice) : "null").",";
$sql .= " ".price2num($this->remise_percent).",";
$sql .= " ".(isset($this->info_bits) ? "'".$this->db->escape($this->info_bits)."'" : "null").",";
$sql .= " ".price2num($this->total_ht).",";
@@ -4097,12 +4097,12 @@ class PropaleLigne extends CommonObjectLine
$sql .= " ".price2num($this->total_ttc).",";
$sql .= " ".(!empty($this->fk_fournprice) ? "'".$this->db->escape($this->fk_fournprice)."'" : "null").",";
$sql .= " ".(isset($this->pa_ht) ? "'".price2num($this->pa_ht)."'" : "null").",";
- $sql .= ' '.$this->special_code.',';
- $sql .= ' '.$this->rang.',';
- $sql .= ' '.(!$this->fk_unit ? 'NULL' : $this->fk_unit).',';
+ $sql .= ' '.((int) $this->special_code).',';
+ $sql .= ' '.((int) $this->rang).',';
+ $sql .= ' '.(empty($this->fk_unit) ? 'NULL' : ((int) $this->fk_unit)).',';
$sql .= " ".(!empty($this->date_start) ? "'".$this->db->idate($this->date_start)."'" : "null").',';
$sql .= " ".(!empty($this->date_end) ? "'".$this->db->idate($this->date_end)."'" : "null");
- $sql .= ", ".($this->fk_multicurrency > 0 ? $this->fk_multicurrency : 'null');
+ $sql .= ", ".($this->fk_multicurrency > 0 ? ((int) $this->fk_multicurrency) : 'null');
$sql .= ", '".$this->db->escape($this->multicurrency_code)."'";
$sql .= ", ".$this->multicurrency_subprice;
$sql .= ", ".$this->multicurrency_total_ht;
diff --git a/htdocs/comm/propal/list.php b/htdocs/comm/propal/list.php
index bf06a27e620..095b6770fe7 100644
--- a/htdocs/comm/propal/list.php
+++ b/htdocs/comm/propal/list.php
@@ -581,7 +581,7 @@ if ($search_warehouse != '' && $search_warehouse > 0) {
$sql .= natural_search("p.fk_warehouse", $search_warehouse, 1);
}
if ($search_multicurrency_code != '') {
- $sql .= ' AND p.multicurrency_code = "'.$db->escape($search_multicurrency_code).'"';
+ $sql .= " AND p.multicurrency_code = '".$db->escape($search_multicurrency_code)."'";
}
if ($search_multicurrency_tx != '') {
$sql .= natural_search('p.multicurrency_tx', $search_multicurrency_tx, 1);
diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php
index 837683c3800..daf55e81605 100644
--- a/htdocs/commande/class/commande.class.php
+++ b/htdocs/commande/class/commande.class.php
@@ -698,7 +698,7 @@ class Commande extends CommonOrder
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande';
$sql .= ' SET fk_statut='.self::STATUS_VALIDATED.', facture=0';
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::set_reopen", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -757,9 +757,9 @@ class Commande extends CommonOrder
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= ' SET fk_statut = '.self::STATUS_CLOSED.',';
- $sql .= ' fk_user_cloture = '.$user->id.',';
+ $sql .= ' fk_user_cloture = '.((int) $user->id).',';
$sql .= " date_cloture = '".$this->db->idate($now)."'";
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > '.self::STATUS_DRAFT;
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > '.self::STATUS_DRAFT;
if ($this->db->query($sql)) {
if (!$notrigger) {
@@ -2026,7 +2026,7 @@ class Commande extends CommonOrder
$sql .= ' p.weight, p.weight_units, p.volume, p.volume_units';
$sql .= ' FROM '.MAIN_DB_PREFIX.'commandedet as l';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON (p.rowid = l.fk_product)';
- $sql .= ' WHERE l.fk_commande = '.$this->id;
+ $sql .= ' WHERE l.fk_commande = '.((int) $this->id);
if ($only_product) {
$sql .= ' AND p.fk_product_type = 0';
}
@@ -2180,7 +2180,7 @@ class Commande extends CommonOrder
$sql .= ' '.MAIN_DB_PREFIX.'commandedet as cd';
$sql .= ' WHERE';
$sql .= ' ed.fk_origin_line = cd.rowid';
- $sql .= ' AND cd.fk_commande ='.$this->id;
+ $sql .= ' AND cd.fk_commande = '.((int) $this->id);
//print $sql;
dol_syslog(get_class($this)."::getNbOfShipments", LOG_DEBUG);
@@ -2222,12 +2222,12 @@ class Commande extends CommonOrder
$sql .= ' ed.fk_expedition = e.rowid AND';
}
$sql .= ' ed.fk_origin_line = cd.rowid';
- $sql .= ' AND cd.fk_commande ='.$this->id;
+ $sql .= ' AND cd.fk_commande = '.((int) $this->id);
if ($this->fk_product > 0) {
- $sql .= ' AND cd.fk_product = '.$this->fk_product;
+ $sql .= ' AND cd.fk_product = '.((int) $this->fk_product);
}
if ($filtre_statut >= 0) {
- $sql .= ' AND e.fk_statut >= '.$filtre_statut;
+ $sql .= ' AND e.fk_statut >= '.((int) $filtre_statut);
}
$sql .= ' GROUP BY cd.rowid, cd.fk_product';
//print $sql;
@@ -2264,7 +2264,7 @@ class Commande extends CommonOrder
$sql = 'SELECT count(*)';
$sql .= ' FROM '.MAIN_DB_PREFIX.'expedition as e';
$sql .= ', '.MAIN_DB_PREFIX.'element_element as el';
- $sql .= ' WHERE el.fk_source = '.$this->id;
+ $sql .= ' WHERE el.fk_source = '.((int) $this->id);
$sql .= " AND el.sourcetype = 'commande'";
$sql .= " AND el.fk_target = e.rowid";
$sql .= " AND el.targettype = 'shipping'";
@@ -2421,7 +2421,7 @@ class Commande extends CommonOrder
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande';
$sql .= ' SET remise_percent = '.((float) $remise);
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut = '.self::STATUS_DRAFT;
+ $sql .= ' WHERE rowid = '.((int) $this->id).' AND fk_statut = '.((int) self::STATUS_DRAFT);
dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2485,7 +2485,7 @@ class Commande extends CommonOrder
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande';
$sql .= ' SET remise_absolue = '.((float) $remise);
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut = '.self::STATUS_DRAFT;
+ $sql .= ' WHERE rowid = '.((int) $this->id).' AND fk_statut = '.self::STATUS_DRAFT;
dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2874,7 +2874,7 @@ class Commande extends CommonOrder
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande SET';
$sql .= ' ref_client = '.(empty($ref_client) ? 'NULL' : "'".$this->db->escape($ref_client)."'");
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= ' WHERE rowid = '.((int) $this->id);
dol_syslog(__METHOD__.' this->id='.$this->id.', ref_client='.$ref_client, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2930,7 +2930,7 @@ class Commande extends CommonOrder
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande SET facture = 1';
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > '.self::STATUS_DRAFT;
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > '.self::STATUS_DRAFT;
dol_syslog(get_class($this)."::classifyBilled", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -2980,7 +2980,7 @@ class Commande extends CommonOrder
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande SET facture = 0';
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > '.self::STATUS_DRAFT;
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > '.self::STATUS_DRAFT;
dol_syslog(get_class($this)."::classifyUnBilled", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -4396,8 +4396,8 @@ class OrderLine extends CommonOrderLine
$sql .= " ".($this->price != '' ? "'".price2num($this->price)."'" : "null").",";
$sql .= " '".price2num($this->remise)."',";
$sql .= ' '.(!empty($this->fk_remise_except) ? $this->fk_remise_except : "null").',';
- $sql .= ' '.$this->special_code.',';
- $sql .= ' '.$this->rang.',';
+ $sql .= ' '.((int) $this->special_code).',';
+ $sql .= ' '.((int) $this->rang).',';
$sql .= ' '.(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null").',';
$sql .= ' '.price2num($this->pa_ht).',';
$sql .= " '".$this->db->escape($this->info_bits)."',";
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index 6f6643336f6..5f3568701e5 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -505,7 +505,7 @@ if ($search_status <> '') {
if ($search_status == 1 && empty($conf->expedition->enabled)) {
$sql .= ' AND c.fk_statut IN (1,2)'; // If module expedition disabled, we include order with status 'sending in process' into 'validated'
} else {
- $sql .= ' AND c.fk_statut = '.$search_status; // brouillon, validee, en cours, annulee
+ $sql .= ' AND c.fk_statut = '.((int) $search_status); // brouillon, validee, en cours, annulee
}
}
if ($search_status == 4) {
@@ -585,7 +585,7 @@ if ($search_warehouse != '' && $search_warehouse > 0) {
$sql .= natural_search('c.fk_warehouse', $search_warehouse, 1);
}
if ($search_multicurrency_code != '') {
- $sql .= ' AND c.multicurrency_code = "'.$db->escape($search_multicurrency_code).'"';
+ $sql .= " AND c.multicurrency_code = '".$db->escape($search_multicurrency_code)."'";
}
if ($search_multicurrency_tx != '') {
$sql .= natural_search('c.multicurrency_tx', $search_multicurrency_tx, 1);
diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php
index 51ff5a5b5c4..e5e264a12f5 100644
--- a/htdocs/compta/bank/bankentries_list.php
+++ b/htdocs/compta/bank/bankentries_list.php
@@ -929,7 +929,7 @@ if ($resql) {
if ($action != 'addline' && $action != 'reconcile') {
if (empty($conf->global->BANK_DISABLE_DIRECT_INPUT)) {
if (empty($conf->global->BANK_USE_OLD_VARIOUS_PAYMENT)) { // Default is to record miscellaneous direct entries using miscellaneous payments
- $newcardbutton = dolGetButtonTitle($langs->trans('AddBankRecord'), '', 'fa fa-plus-circle', DOL_URL_ROOT.'/compta/bank/various_payment/card.php?action=create&accountid='.$search_account.'&backtopage='.urlencode($_SERVER['PHP_SELF'].'?id='.urlencode($search_account)), '', $user->rights->banque->modifier);
+ $newcardbutton = dolGetButtonTitle($langs->trans('AddBankRecord'), '', 'fa fa-plus-circle', DOL_URL_ROOT.'/compta/bank/various_payment/card.php?action=create&accountid='.urlencode($search_account).'&backtopage='.urlencode($_SERVER['PHP_SELF'].'?id='.urlencode($search_account)), '', $user->rights->banque->modifier);
} else // If direct entries is not done using miscellaneous payments
{
$newcardbutton = dolGetButtonTitle($langs->trans('AddBankRecord'), '', 'fa fa-plus-circle', $_SERVER["PHP_SELF"].'?action=addline&page='.$page.$param, '', $user->rights->banque->modifier);
diff --git a/htdocs/compta/bank/class/paymentvarious.class.php b/htdocs/compta/bank/class/paymentvarious.class.php
index cdb2c0596f5..5a6aa81d663 100644
--- a/htdocs/compta/bank/class/paymentvarious.class.php
+++ b/htdocs/compta/bank/class/paymentvarious.class.php
@@ -573,7 +573,7 @@ class PaymentVarious extends CommonObject
{
// phpcs:enable
$sql = 'UPDATE '.MAIN_DB_PREFIX.'payment_various SET fk_bank = '.((int) $id_bank);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
return 1;
diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
index 374de5cca4d..4a693977263 100644
--- a/htdocs/compta/facture/card.php
+++ b/htdocs/compta/facture/card.php
@@ -708,7 +708,7 @@ if (empty($reshook)) {
// On verifie si la facture a des paiements
$sql = 'SELECT pf.amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf';
- $sql .= ' WHERE pf.fk_facture = '.$object->id;
+ $sql .= ' WHERE pf.fk_facture = '.((int) $object->id);
$result = $db->query($sql);
if ($result) {
@@ -873,7 +873,7 @@ if (empty($reshook)) {
$sql = 'SELECT SUM(pf.amount) as total_paiements';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf, '.MAIN_DB_PREFIX.'paiement as p';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_paiement as c ON p.fk_paiement = c.id';
- $sql .= ' WHERE pf.fk_facture = '.$object->id;
+ $sql .= ' WHERE pf.fk_facture = '.((int) $object->id);
$sql .= ' AND pf.fk_paiement = p.rowid';
$sql .= ' AND p.entity IN ('.getEntity('invoice').')';
$resql = $db->query($sql);
@@ -2596,10 +2596,10 @@ if (empty($reshook)) {
$errors = 0;
if (count($linkedCreditNotesList) > 0) {
// now, credit note must follow
- $sql = 'UPDATE '.MAIN_DB_PREFIX.'facture ';
- $sql .= ' SET situation_cycle_ref='.$newCycle;
+ $sql = 'UPDATE '.MAIN_DB_PREFIX.'facture';
+ $sql .= ' SET situation_cycle_ref = '.((int) $newCycle);
$sql .= ' , situation_final=0';
- $sql .= ' , situation_counter='.$object->situation_counter;
+ $sql .= ' , situation_counter='.((int) $object->situation_counter);
$sql .= ' WHERE rowid IN ('.$db->sanitize(implode(',', $linkedCreditNotesList)).')';
$resql = $db->query($sql);
@@ -4884,7 +4884,7 @@ if ($action == 'create') {
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_paiement as c ON p.fk_paiement = c.id';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'bank as b ON p.fk_bank = b.rowid';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'bank_account as ba ON b.fk_account = ba.rowid';
- $sql .= ' WHERE pf.fk_facture = '.$object->id.' AND pf.fk_paiement = p.rowid';
+ $sql .= ' WHERE pf.fk_facture = '.((int) $object->id).' AND pf.fk_paiement = p.rowid';
$sql .= ' AND p.entity IN ('.getEntity('invoice').')';
$sql .= ' ORDER BY p.datep, p.tms';
diff --git a/htdocs/compta/facture/class/api_invoices.class.php b/htdocs/compta/facture/class/api_invoices.class.php
index 3dfa5f70603..2708c9e8386 100644
--- a/htdocs/compta/facture/class/api_invoices.class.php
+++ b/htdocs/compta/facture/class/api_invoices.class.php
@@ -1138,7 +1138,7 @@ class Invoices extends DolibarrApi
$sql = 'SELECT SUM(pf.amount) as total_payments';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf, '.MAIN_DB_PREFIX.'paiement as p';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_paiement as c ON p.fk_paiement = c.id';
- $sql .= ' WHERE pf.fk_facture = '.$this->invoice->id;
+ $sql .= ' WHERE pf.fk_facture = '.((int) $this->invoice->id);
$sql .= ' AND pf.fk_paiement = p.rowid';
$sql .= ' AND p.entity IN ('.getEntity('invoice').')';
$resql = $this->db->query($sql);
diff --git a/htdocs/compta/facture/class/facture-rec.class.php b/htdocs/compta/facture/class/facture-rec.class.php
index 6b9837e77bd..a0509774998 100644
--- a/htdocs/compta/facture/class/facture-rec.class.php
+++ b/htdocs/compta/facture/class/facture-rec.class.php
@@ -665,7 +665,7 @@ class FactureRec extends CommonInvoice
$sql .= ' p.ref as product_ref, p.fk_product_type as fk_product_type, p.label as product_label, p.description as product_desc';
$sql .= ' FROM '.MAIN_DB_PREFIX.'facturedet_rec as l';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON l.fk_product = p.rowid';
- $sql .= ' WHERE l.fk_facture = '.$this->id;
+ $sql .= ' WHERE l.fk_facture = '.((int) $this->id);
$sql .= ' ORDER BY l.rang';
dol_syslog('FactureRec::fetch_lines', LOG_DEBUG);
@@ -1752,7 +1752,7 @@ class FactureRec extends CommonInvoice
if (!empty($unit)) {
$sql .= ', unit_frequency = \''.$this->db->escape($unit).'\'';
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setFrequencyAndUnit", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -1785,7 +1785,7 @@ class FactureRec extends CommonInvoice
if ($increment_nb_gen_done > 0) {
$sql .= ', nb_gen_done = nb_gen_done + 1';
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setNextDate", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -1819,7 +1819,7 @@ class FactureRec extends CommonInvoice
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= ' SET nb_gen_max = '.((int) $nb);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setMaxPeriod", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -1846,7 +1846,7 @@ class FactureRec extends CommonInvoice
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= ' SET auto_validate = '.((int) $validate);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setAutoValidate", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -1873,7 +1873,7 @@ class FactureRec extends CommonInvoice
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= ' SET generate_pdf = '.((int) $validate);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setGeneratePdf", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -1899,8 +1899,8 @@ class FactureRec extends CommonInvoice
}
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET modelpdf = "'.$model.'"';
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " SET modelpdf = '".$this->db->escape($model)."'";
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setModelPdf", LOG_DEBUG);
if ($this->db->query($sql)) {
diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php
index 67d59ceb531..abb52560d24 100644
--- a/htdocs/compta/facture/class/facture.class.php
+++ b/htdocs/compta/facture/class/facture.class.php
@@ -1769,7 +1769,7 @@ class Facture extends CommonInvoice
$sql .= ' p.ref as product_ref, p.fk_product_type as fk_product_type, p.label as product_label, p.description as product_desc';
$sql .= ' FROM '.MAIN_DB_PREFIX.'facturedet as l';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON l.fk_product = p.rowid';
- $sql .= ' WHERE l.fk_facture = '.$this->id;
+ $sql .= ' WHERE l.fk_facture = '.((int) $this->id);
$sql .= ' ORDER BY l.rang, l.rowid';
dol_syslog(get_class($this).'::fetch_lines', LOG_DEBUG);
@@ -1876,8 +1876,8 @@ class Facture extends CommonInvoice
$this->tab_next_situation_invoice = array();
$sql = 'SELECT rowid, type, situation_cycle_ref, situation_counter FROM '.MAIN_DB_PREFIX.'facture';
- $sql .= ' WHERE rowid <> '.$this->id;
- $sql .= ' AND entity = '.$this->entity;
+ $sql .= " WHERE rowid <> ".((int) $this->id);
+ $sql .= ' AND entity = '.((int) $this->entity);
$sql .= ' AND situation_cycle_ref = '.(int) $this->situation_cycle_ref;
$sql .= ' ORDER BY situation_counter ASC';
@@ -2152,7 +2152,7 @@ class Facture extends CommonInvoice
} else {
$sql .= ' SET ref_client = \''.$this->db->escape($ref_client).'\'';
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(__METHOD__.' this->id='.$this->id.', ref_client='.$ref_client, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2408,9 +2408,9 @@ class Facture extends CommonInvoice
if ($close_note) {
$sql .= ", close_note='".$this->db->escape($close_note)."'";
}
- $sql .= ', fk_user_closing = '.$user->id;
+ $sql .= ', fk_user_closing = '.((int) $user->id);
$sql .= ", date_closing = '".$this->db->idate($now)."'";
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -2474,7 +2474,7 @@ class Facture extends CommonInvoice
$sql .= ' SET paye=0, fk_statut='.self::STATUS_VALIDATED.', close_code=null, close_note=null,';
$sql .= ' date_closing=null,';
$sql .= ' fk_user_closing=null';
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::set_unpaid", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2545,7 +2545,7 @@ class Facture extends CommonInvoice
if ($close_note) {
$sql .= ", close_note='".$this->db->escape($close_note)."'";
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -2553,7 +2553,7 @@ class Facture extends CommonInvoice
// as they have not been used since the invoice is abandoned.
$sql = 'UPDATE '.MAIN_DB_PREFIX.'societe_remise_except';
$sql .= ' SET fk_facture = NULL';
- $sql .= ' WHERE fk_facture = '.$this->id;
+ $sql .= ' WHERE fk_facture = '.((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -2693,7 +2693,7 @@ class Facture extends CommonInvoice
$sql .= ", datef='".$this->db->idate($this->date)."'";
$sql .= ", date_lim_reglement='".$this->db->idate($this->date_lim_reglement)."'";
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::validate", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -3755,7 +3755,7 @@ class Facture extends CommonInvoice
$sql = 'UPDATE '.MAIN_DB_PREFIX.'facture';
$sql .= ' SET remise_percent = '.((float) $remise);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$sql .= ' AND fk_statut = '.self::STATUS_DRAFT;
dol_syslog(__METHOD__, LOG_DEBUG);
@@ -3817,7 +3817,7 @@ class Facture extends CommonInvoice
$sql = 'UPDATE '.MAIN_DB_PREFIX.'facture';
$sql .= ' SET remise_absolue = '.((float) $remise);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$sql .= ' AND fk_statut = '.self::STATUS_DRAFT;
dol_syslog(__METHOD__, LOG_DEBUG);
@@ -4598,7 +4598,7 @@ class Facture extends CommonInvoice
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.'facture';
$sql .= ' WHERE situation_cycle_ref = '.((int) $this->situation_cycle_ref);
- $sql .= ' AND situation_counter < '.$this->situation_counter;
+ $sql .= ' AND situation_counter < '.((int) $this->situation_counter);
$sql .= ' AND entity = '.($this->entity > 0 ? $this->entity : $conf->entity);
$resql = $this->db->query($sql);
$res = array();
@@ -4631,7 +4631,7 @@ class Facture extends CommonInvoice
$this->db->begin();
- $sql = 'UPDATE '.MAIN_DB_PREFIX.'facture SET situation_final = '.$this->situation_final.' where rowid = '.((int) $this->id);
+ $sql = 'UPDATE '.MAIN_DB_PREFIX.'facture SET situation_final = '.((int) $this->situation_final).' WHERE rowid = '.((int) $this->id);
dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -4849,10 +4849,11 @@ class Facture extends CommonInvoice
public function setRetainedWarranty($value)
{
dol_syslog(get_class($this).'::setRetainedWarranty('.$value.')');
+
if ($this->statut >= 0) {
$fieldname = 'retained_warranty';
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname.' = '.floatval($value);
+ $sql .= " SET ".$fieldname." = ".((float) $value);
$sql .= ' WHERE rowid='.((int) $this->id);
if ($this->db->query($sql)) {
@@ -5385,9 +5386,9 @@ class FactureLigne extends CommonInvoiceLine
$sql .= ' '.(!empty($this->fk_remise_except) ? $this->fk_remise_except : "null").',';
$sql .= " ".(!empty($this->date_start) ? "'".$this->db->idate($this->date_start)."'" : "null").",";
$sql .= " ".(!empty($this->date_end) ? "'".$this->db->idate($this->date_end)."'" : "null").",";
- $sql .= ' '.$this->fk_code_ventilation.',';
- $sql .= ' '.$this->rang.',';
- $sql .= ' '.$this->special_code.',';
+ $sql .= ' '.((int) $this->fk_code_ventilation).',';
+ $sql .= ' '.((int) $this->rang).',';
+ $sql .= ' '.((int) $this->special_code).',';
$sql .= ' '.(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null").',';
$sql .= ' '.price2num($this->pa_ht).',';
$sql .= " '".$this->db->escape($this->info_bits)."',";
@@ -5396,11 +5397,11 @@ class FactureLigne extends CommonInvoiceLine
$sql .= " ".price2num($this->total_ttc).",";
$sql .= " ".price2num($this->total_localtax1).",";
$sql .= " ".price2num($this->total_localtax2);
- $sql .= ", ".$this->situation_percent;
+ $sql .= ", ".((float) $this->situation_percent);
$sql .= ", ".(!empty($this->fk_prev_id) ? $this->fk_prev_id : "null");
$sql .= ", ".(!$this->fk_unit ? 'NULL' : $this->fk_unit);
- $sql .= ", ".$user->id;
- $sql .= ", ".$user->id;
+ $sql .= ", ".((int) $user->id);
+ $sql .= ", ".((int) $user->id);
$sql .= ", ".(int) $this->fk_multicurrency;
$sql .= ", '".$this->db->escape($this->multicurrency_code)."'";
$sql .= ", ".price2num($this->multicurrency_subprice);
@@ -5759,7 +5760,7 @@ class FactureLigne extends CommonInvoiceLine
return 0;
}
- $sql = 'SELECT situation_percent FROM '.MAIN_DB_PREFIX.'facturedet WHERE rowid='.$this->fk_prev_id;
+ $sql = 'SELECT situation_percent FROM '.MAIN_DB_PREFIX.'facturedet WHERE rowid='.((int) $this->fk_prev_id);
$resql = $this->db->query($sql);
if ($resql && $resql->num_rows > 0) {
$res = $this->db->fetch_array($resql);
diff --git a/htdocs/compta/facture/list.php b/htdocs/compta/facture/list.php
index 76cddb2d909..2b8a65445ba 100644
--- a/htdocs/compta/facture/list.php
+++ b/htdocs/compta/facture/list.php
@@ -680,7 +680,7 @@ if ($search_montant_ttc != '') {
$sql .= natural_search('f.total_ttc', $search_montant_ttc, 1);
}
if ($search_multicurrency_code != '') {
- $sql .= ' AND f.multicurrency_code = "'.$db->escape($search_multicurrency_code).'"';
+ $sql .= " AND f.multicurrency_code = '".$db->escape($search_multicurrency_code)."'";
}
if ($search_multicurrency_tx != '') {
$sql .= natural_search('f.multicurrency_tx', $search_multicurrency_tx, 1);
@@ -803,7 +803,7 @@ if (!$sall) {
// Add HAVING from hooks
$parameters = array();
$reshook = $hookmanager->executeHooks('printFieldListHaving', $parameters, $object); // Note that $action and $object may have been modified by hook
-$sql .= !empty($hookmanager->resPrint) ? (' HAVING 1=1 ' . $hookmanager->resPrint) : '';
+$sql .= !empty($hookmanager->resPrint) ? (" HAVING 1=1 " . $hookmanager->resPrint) : "";
$sql .= ' ORDER BY ';
$listfield = explode(',', $sortfield);
diff --git a/htdocs/compta/paiement.php b/htdocs/compta/paiement.php
index 03acd9d88eb..0f49b8d5823 100644
--- a/htdocs/compta/paiement.php
+++ b/htdocs/compta/paiement.php
@@ -529,14 +529,14 @@ if ($action == 'create' || $action == 'confirm_paiement' || $action == 'add_paie
$sql .= ' f.datef as df, f.fk_soc as socid, f.date_lim_reglement as dlr';
$sql .= ' FROM '.MAIN_DB_PREFIX.'facture as f';
$sql .= ' WHERE f.entity IN ('.getEntity('facture').')';
- $sql .= ' AND (f.fk_soc = '.$facture->socid;
+ $sql .= ' AND (f.fk_soc = '.((int) $facture->socid);
// Can pay invoices of all child of parent company
if (!empty($conf->global->FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS) && !empty($facture->thirdparty->parent)) {
- $sql .= ' OR f.fk_soc IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'societe WHERE parent = '.$facture->thirdparty->parent.')';
+ $sql .= ' OR f.fk_soc IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'societe WHERE parent = '.((int) $facture->thirdparty->parent).')';
}
// Can pay invoices of all child of myself
if (!empty($conf->global->FACTURE_PAYMENTS_ON_SUBSIDIARY_COMPANIES)) {
- $sql .= ' OR f.fk_soc IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'societe WHERE parent = '.$facture->thirdparty->id.')';
+ $sql .= ' OR f.fk_soc IN (SELECT rowid FROM '.MAIN_DB_PREFIX.'societe WHERE parent = '.((int) $facture->thirdparty->id).')';
}
$sql .= ') AND f.paye = 0';
$sql .= ' AND f.fk_statut = 1'; // Statut=0 => not validated, Statut=2 => canceled
@@ -875,7 +875,7 @@ if (!GETPOST('action', 'aZ09')) {
$sql .= ' AND f.fk_soc = '.((int) $socid);
}
- $sql .= ' ORDER BY '.$sortfield.' '.$sortorder;
+ $sql .= $db->order($sortfield, $sortorder);
$sql .= $db->plimit($limit + 1, $offset);
$resql = $db->query($sql);
diff --git a/htdocs/compta/paiement/card.php b/htdocs/compta/paiement/card.php
index 2b65ad4a84a..ed8ec522aea 100644
--- a/htdocs/compta/paiement/card.php
+++ b/htdocs/compta/paiement/card.php
@@ -126,7 +126,7 @@ if ($action == 'confirm_validate' && $confirm == 'yes' && $user->rights->facture
$sql .= ' WHERE pf.fk_facture = f.rowid';
$sql .= ' AND f.fk_soc = s.rowid';
$sql .= ' AND f.entity IN ('.getEntity('invoice').')';
- $sql .= ' AND pf.fk_paiement = '.$object->id;
+ $sql .= ' AND pf.fk_paiement = '.((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$i = 0;
@@ -342,7 +342,7 @@ $sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf,'.MAIN_DB_PREFIX.'factur
$sql .= ' WHERE pf.fk_facture = f.rowid';
$sql .= ' AND f.fk_soc = s.rowid';
$sql .= ' AND f.entity IN ('.getEntity('invoice').')';
-$sql .= ' AND pf.fk_paiement = '.$object->id;
+$sql .= ' AND pf.fk_paiement = '.((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
diff --git a/htdocs/compta/paiement/class/cpaiement.class.php b/htdocs/compta/paiement/class/cpaiement.class.php
index e9623f55c11..1c7abf71c3b 100644
--- a/htdocs/compta/paiement/class/cpaiement.class.php
+++ b/htdocs/compta/paiement/class/cpaiement.class.php
@@ -273,7 +273,7 @@ class Cpaiement
$sql .= ' active = '.(isset($this->active) ? $this->active : "null").',';
$sql .= ' accountancy_code = '.(isset($this->accountancy_code) ? "'".$this->db->escape($this->accountancy_code)."'" : "null").',';
$sql .= ' module = '.(isset($this->module) ? "'".$this->db->escape($this->module)."'" : "null");
- $sql .= ' WHERE id='.$this->id;
+ $sql .= ' WHERE id = '.((int) $this->id);
$this->db->begin();
@@ -334,7 +334,7 @@ class Cpaiement
if (!$error) {
$sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' WHERE id='.$this->id;
+ $sql .= ' WHERE id = '.((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/compta/paiement/class/paiement.class.php b/htdocs/compta/paiement/class/paiement.class.php
index 8c8a563f418..3e1dc59a52e 100644
--- a/htdocs/compta/paiement/class/paiement.class.php
+++ b/htdocs/compta/paiement/class/paiement.class.php
@@ -533,12 +533,12 @@ class Paiement extends CommonObject
// Delete payment (into paiement_facture and paiement)
$sql = 'DELETE FROM '.MAIN_DB_PREFIX.'paiement_facture';
- $sql .= ' WHERE fk_paiement = '.$this->id;
+ $sql .= ' WHERE fk_paiement = '.((int) $this->id);
dol_syslog($sql);
$result = $this->db->query($sql);
if ($result) {
$sql = 'DELETE FROM '.MAIN_DB_PREFIX.'paiement';
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog($sql);
$result = $this->db->query($sql);
if (!$result) {
@@ -756,7 +756,7 @@ class Paiement extends CommonObject
{
// phpcs:enable
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element.' set fk_bank = '.((int) $id_bank);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this).'::update_fk_bank', LOG_DEBUG);
$result = $this->db->query($sql);
@@ -956,7 +956,7 @@ class Paiement extends CommonObject
{
$sql = 'SELECT pf.fk_facture';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf, '.MAIN_DB_PREFIX.'facture as f'; // We keep link on invoice to allow use of some filters on invoice
- $sql .= ' WHERE pf.fk_facture = f.rowid AND pf.fk_paiement = '.$this->id;
+ $sql .= ' WHERE pf.fk_facture = f.rowid AND pf.fk_paiement = '.((int) $this->id);
if ($filter) {
$sql .= ' AND '.$filter;
}
@@ -989,7 +989,7 @@ class Paiement extends CommonObject
{
$sql = 'SELECT pf.fk_facture, pf.amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf';
- $sql .= ' WHERE pf.fk_paiement = '.$this->id;
+ $sql .= ' WHERE pf.fk_paiement = '.((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
$i = 0;
diff --git a/htdocs/compta/payment_sc/card.php b/htdocs/compta/payment_sc/card.php
index c75974077c3..27a35e83352 100644
--- a/htdocs/compta/payment_sc/card.php
+++ b/htdocs/compta/payment_sc/card.php
@@ -170,7 +170,7 @@ $sql = 'SELECT f.rowid as scid, f.libelle as label, f.paye, f.amount as sc_amoun
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiementcharge as pf,'.MAIN_DB_PREFIX.'chargesociales as f, '.MAIN_DB_PREFIX.'c_chargesociales as pc';
$sql .= ' WHERE pf.fk_charge = f.rowid AND f.fk_type = pc.id';
$sql .= ' AND f.entity = '.$conf->entity;
-$sql .= ' AND pf.rowid = '.$object->id;
+$sql .= ' AND pf.rowid = '.((int) $object->id);
dol_syslog("compta/payment_sc/card.php", LOG_DEBUG);
$resql = $db->query($sql);
diff --git a/htdocs/compta/payment_vat/card.php b/htdocs/compta/payment_vat/card.php
index 1b615bcbb8d..bfa14009380 100644
--- a/htdocs/compta/payment_vat/card.php
+++ b/htdocs/compta/payment_vat/card.php
@@ -227,7 +227,7 @@ $sql .= ' FROM '.MAIN_DB_PREFIX.'payment_vat as pf,'.MAIN_DB_PREFIX.'tva as f';
$sql .= ' WHERE pf.fk_tva = f.rowid';
//$sql .= ' AND f.fk_type = pc.id';
$sql .= ' AND f.entity = '.$conf->entity;
-$sql .= ' AND pf.rowid = '.$object->id;
+$sql .= ' AND pf.rowid = '.((int) $object->id);
dol_syslog("compta/payment_vat/card.php", LOG_DEBUG);
$resql = $db->query($sql);
diff --git a/htdocs/compta/sociales/class/cchargesociales.class.php b/htdocs/compta/sociales/class/cchargesociales.class.php
index ee9a270b283..d03132b04f7 100644
--- a/htdocs/compta/sociales/class/cchargesociales.class.php
+++ b/htdocs/compta/sociales/class/cchargesociales.class.php
@@ -329,7 +329,7 @@ class Cchargesociales
if (!$error) {
$sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' WHERE id='.$this->id;
+ $sql .= ' WHERE id = '.((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/compta/sociales/class/chargesociales.class.php b/htdocs/compta/sociales/class/chargesociales.class.php
index 2b80e1bb4f4..a7c6ab2c593 100644
--- a/htdocs/compta/sociales/class/chargesociales.class.php
+++ b/htdocs/compta/sociales/class/chargesociales.class.php
@@ -642,7 +642,7 @@ class ChargeSociales extends CommonObject
$sql = 'SELECT sum(amount) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.$this->id;
+ $sql .= " WHERE ".$field." = ".((int) $this->id);
dol_syslog(get_class($this)."::getSommePaiement", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/compta/sociales/list.php b/htdocs/compta/sociales/list.php
index a4deec56715..388d0f5a7bf 100644
--- a/htdocs/compta/sociales/list.php
+++ b/htdocs/compta/sociales/list.php
@@ -209,10 +209,10 @@ if (!empty($search_users)) {
$sql .= ' AND cs.fk_user IN('.implode(', ', $search_users).')';
}
if (!empty($search_type) && $search_type > 0) {
- $sql .= ' AND cs.fk_mode_reglement='.$search_type;
+ $sql .= ' AND cs.fk_mode_reglement='.((int) $search_type);
}
if (!empty($search_account) && $search_account > 0) {
- $sql .= ' AND cs.fk_account='.$search_account;
+ $sql .= ' AND cs.fk_account='.((int) $search_account);
}
if ($search_amount) {
$sql .= natural_search("cs.amount", $search_amount, 1);
diff --git a/htdocs/compta/tva/class/tva.class.php b/htdocs/compta/tva/class/tva.class.php
index c412072ec89..25fcee08e57 100644
--- a/htdocs/compta/tva/class/tva.class.php
+++ b/htdocs/compta/tva/class/tva.class.php
@@ -768,7 +768,7 @@ class Tva extends CommonObject
$sql = 'SELECT sum(amount) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.$this->id;
+ $sql .= ' WHERE '.$field.' = '.((int) $this->id);
dol_syslog(get_class($this)."::getSommePaiement", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/contact/ldap.php b/htdocs/contact/ldap.php
index 6677a7b17d7..79696d12997 100644
--- a/htdocs/contact/ldap.php
+++ b/htdocs/contact/ldap.php
@@ -178,7 +178,7 @@ if ($result > 0) {
$result = show_ldap_content($records, 0, $records['count'], true);
}
} else {
- print ''.$langs->trans("LDAPRecordNotFound").' (dn='.$dn.' - search='.$search.') ';
+ print ''.$langs->trans("LDAPRecordNotFound").' (dn='.dol_escape_htmltag($dn).' - search='.dol_escape_htmltag($search).') ';
}
$ldap->unbind();
diff --git a/htdocs/core/ajax/ajaxdirpreview.php b/htdocs/core/ajax/ajaxdirpreview.php
index 09292dd4991..810a23957fd 100644
--- a/htdocs/core/ajax/ajaxdirpreview.php
+++ b/htdocs/core/ajax/ajaxdirpreview.php
@@ -328,7 +328,7 @@ if ($type == 'directory') {
if ($section) {
$param .= '§ion='.$section;
if (isset($search_doc_ref) && $search_doc_ref != '') {
- $param .= '&search_doc_ref='.$search_doc_ref;
+ $param .= '&search_doc_ref='.urlencode($search_doc_ref);
}
$textifempty = $langs->trans('NoFileFound');
diff --git a/htdocs/core/class/commoninvoice.class.php b/htdocs/core/class/commoninvoice.class.php
index 605ffec63bd..65988c9cdf0 100644
--- a/htdocs/core/class/commoninvoice.class.php
+++ b/htdocs/core/class/commoninvoice.class.php
@@ -132,7 +132,7 @@ abstract class CommonInvoice extends CommonObject
$sql = 'SELECT sum(amount) as amount, sum(multicurrency_amount) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.$this->id;
+ $sql .= ' WHERE '.$field.' = '.((int) $this->id);
dol_syslog(get_class($this)."::getSommePaiement", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -227,7 +227,7 @@ abstract class CommonInvoice extends CommonObject
$sql = 'SELECT rowid';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' WHERE fk_facture_source = '.$this->id;
+ $sql .= ' WHERE fk_facture_source = '.((int) $this->id);
$sql .= ' AND type = 2';
$resql = $this->db->query($sql);
if ($resql) {
@@ -254,7 +254,7 @@ abstract class CommonInvoice extends CommonObject
{
$sql = 'SELECT rowid';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' WHERE fk_facture_source = '.$this->id;
+ $sql .= ' WHERE fk_facture_source = '.((int) $this->id);
$sql .= ' AND type < 2';
if ($option == 'validated') {
$sql .= ' AND fk_statut = 1';
@@ -308,7 +308,7 @@ abstract class CommonInvoice extends CommonObject
$sql = 'SELECT p.ref, pf.amount, pf.multicurrency_amount, p.fk_paiement, p.datep, p.num_paiement as num, t.code'.$field3;
$sql .= ' FROM '.MAIN_DB_PREFIX.$table.' as pf, '.MAIN_DB_PREFIX.$table2.' as p, '.MAIN_DB_PREFIX.'c_paiement as t';
- $sql .= ' WHERE pf.'.$field.' = '.$this->id;
+ $sql .= ' WHERE pf.'.$field.' = '.((int) $this->id);
//$sql.= ' WHERE pf.'.$field.' = 1';
$sql .= ' AND pf.'.$field2.' = p.rowid';
$sql .= ' AND p.fk_paiement = t.id';
@@ -338,12 +338,12 @@ abstract class CommonInvoice extends CommonObject
if ($this->element == 'facture' || $this->element == 'invoice') {
$sql = 'SELECT rc.amount_ttc as amount, rc.multicurrency_amount_ttc as multicurrency_amount, rc.datec as date, f.ref as ref, rc.description as type';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc, '.MAIN_DB_PREFIX.'facture as f';
- $sql .= ' WHERE rc.fk_facture_source=f.rowid AND rc.fk_facture = '.$this->id;
+ $sql .= ' WHERE rc.fk_facture_source=f.rowid AND rc.fk_facture = '.((int) $this->id);
$sql .= ' AND (f.type = 2 OR f.type = 0 OR f.type = 3)'; // Find discount coming from credit note or excess received or deposits (payments from deposits are always null except if FACTURE_DEPOSITS_ARE_JUST_PAYMENTS is set)
} elseif ($this->element == 'facture_fourn' || $this->element == 'invoice_supplier') {
$sql = 'SELECT rc.amount_ttc as amount, rc.multicurrency_amount_ttc as multicurrency_amount, rc.datec as date, f.ref as ref, rc.description as type';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc, '.MAIN_DB_PREFIX.'facture_fourn as f';
- $sql .= ' WHERE rc.fk_invoice_supplier_source=f.rowid AND rc.fk_invoice_supplier = '.$this->id;
+ $sql .= ' WHERE rc.fk_invoice_supplier_source=f.rowid AND rc.fk_invoice_supplier = '.((int) $this->id);
$sql .= ' AND (f.type = 2 OR f.type = 0 OR f.type = 3)'; // Find discount coming from credit note or excess received or deposits (payments from deposits are always null except if FACTURE_DEPOSITS_ARE_JUST_PAYMENTS is set)
}
@@ -700,9 +700,9 @@ abstract class CommonInvoice extends CommonObject
$sql = 'SELECT count(*)';
$sql .= ' FROM '.MAIN_DB_PREFIX.'prelevement_facture_demande';
if ($type == 'bank-transfer') {
- $sql .= ' WHERE fk_facture_fourn = '.$this->id;
+ $sql .= ' WHERE fk_facture_fourn = '.((int) $this->id);
} else {
- $sql .= ' WHERE fk_facture = '.$this->id;
+ $sql .= ' WHERE fk_facture = '.((int) $this->id);
}
$sql .= ' AND ext_payment_id IS NULL'; // To exclude record done for some online payments
$sql .= ' AND traite = 0';
@@ -735,16 +735,16 @@ abstract class CommonInvoice extends CommonObject
$sql .= 'fk_facture, ';
}
$sql .= ' amount, date_demande, fk_user_demande, code_banque, code_guichet, number, cle_rib, sourcetype, entity)';
- $sql .= ' VALUES ('.$this->id;
- $sql .= ",'".price2num($amount)."'";
- $sql .= ",'".$this->db->idate($now)."'";
- $sql .= ",".$fuser->id;
- $sql .= ",'".$this->db->escape($bac->code_banque)."'";
- $sql .= ",'".$this->db->escape($bac->code_guichet)."'";
- $sql .= ",'".$this->db->escape($bac->number)."'";
- $sql .= ",'".$this->db->escape($bac->cle_rib)."'";
- $sql .= ",'".$this->db->escape($sourcetype)."'";
- $sql .= ",".$conf->entity;
+ $sql .= ' VALUES ('.((int) $this->id);
+ $sql .= ", ".((float) price2num($amount));
+ $sql .= ", '".$this->db->idate($now)."'";
+ $sql .= ", ".((int) $fuser->id);
+ $sql .= ", '".$this->db->escape($bac->code_banque)."'";
+ $sql .= ", '".$this->db->escape($bac->code_guichet)."'";
+ $sql .= ", '".$this->db->escape($bac->number)."'";
+ $sql .= ", '".$this->db->escape($bac->cle_rib)."'";
+ $sql .= ", '".$this->db->escape($sourcetype)."'";
+ $sql .= ", ".((int) $conf->entity);
$sql .= ")";
dol_syslog(get_class($this)."::demande_prelevement", LOG_DEBUG);
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index a60e0680536..a4a98da9690 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -2228,7 +2228,7 @@ abstract class CommonObject
} else {
$sql .= ' SET fk_projet = NULL';
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
}
dol_syslog(get_class($this)."::setProject", LOG_DEBUG);
@@ -2884,7 +2884,7 @@ abstract class CommonObject
// Count number of lines to reorder (according to choice $renum)
$nl = 0;
$sql = 'SELECT count(rowid) FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.'='.$this->id;
+ $sql .= ' WHERE '.$this->fk_element.'='.((int) $this->id);
if (!$renum) {
$sql .= ' AND rang = 0';
}
@@ -2906,11 +2906,11 @@ abstract class CommonObject
// We first search all lines that are parent lines (for multilevel details lines)
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
if ($fk_parent_line) {
$sql .= ' AND fk_parent_line IS NULL';
}
- $sql .= ' ORDER BY rang ASC, rowid '.$rowidorder;
+ $sql .= " ORDER BY rang ASC, rowid ".$rowidorder;
dol_syslog(get_class($this)."::line_order search all parent lines", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2954,11 +2954,11 @@ abstract class CommonObject
$rows = array();
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
- $sql .= ' AND fk_parent_line = '.$id;
+ $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql .= ' AND fk_parent_line = '.((int) $id);
$sql .= ' ORDER BY rang ASC';
- dol_syslog(get_class($this)."::getChildrenOfLine search children lines for line ".$id."", LOG_DEBUG);
+ dol_syslog(get_class($this)."::getChildrenOfLine search children lines for line ".$id, LOG_DEBUG);
$resql = $this->db->query($sql);
if ($resql) {
if ($this->db->num_rows($resql) > 0) {
@@ -3075,8 +3075,8 @@ abstract class CommonObject
}
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) $rang);
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
- $sql .= ' AND rang = '.($rang - 1);
+ $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql .= ' AND rang = '.((int) ($rang - 1));
if ($this->db->query($sql)) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) ($rang - 1));
$sql .= ' WHERE rowid = '.((int) $rowid);
@@ -3106,7 +3106,7 @@ abstract class CommonObject
}
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) $rang);
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
$sql .= ' AND rang = '.((int) ($rang + 1));
if ($this->db->query($sql)) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) ($rang + 1));
@@ -3148,7 +3148,7 @@ abstract class CommonObject
public function getIdOfLine($rang)
{
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
$sql .= ' AND rang = '.((int) $rang);
$resql = $this->db->query($sql);
if ($resql) {
@@ -3175,8 +3175,8 @@ abstract class CommonObject
// Search the last rang with fk_parent_line
if ($fk_parent_line) {
$sql = 'SELECT max('.$positionfield.') FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
- $sql .= ' AND fk_parent_line = '.$fk_parent_line;
+ $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql .= ' AND fk_parent_line = '.((int) $fk_parent_line);
dol_syslog(get_class($this)."::line_max", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -3393,7 +3393,7 @@ abstract class CommonObject
}
$sql .= ', multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
if ($exclspec) {
$product_field = 'product_type';
if ($this->table_element_line == 'contratdet') {
@@ -3561,7 +3561,7 @@ abstract class CommonObject
$sql .= ", multicurrency_total_ht = ".price2num($this->multicurrency_total_ht, 'MT', 1);
$sql .= ", multicurrency_total_tva = ".price2num($this->multicurrency_total_tva, 'MT', 1);
$sql .= ", multicurrency_total_ttc = ".price2num($this->multicurrency_total_ttc, 'MT', 1);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update_price", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -5318,7 +5318,7 @@ abstract class CommonObject
}
if ($update_main_doc_field && !empty($this->table_element)) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element." SET last_main_doc = '".$this->db->escape($ecmfile->filepath.'/'.$ecmfile->filename)."'";
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -8827,7 +8827,7 @@ abstract class CommonObject
$sql = 'SELECT '.$objectline->getFieldList('l');
$sql .= ' FROM '.MAIN_DB_PREFIX.$objectline->table_element.' as l';
- $sql .= ' WHERE l.fk_'.$this->element.' = '.$this->id;
+ $sql .= ' WHERE l.fk_'.$this->element.' = '.((int) $this->id);
if ($morewhere) {
$sql .= $morewhere;
}
@@ -8973,7 +8973,7 @@ abstract class CommonObject
if ($forcechilddeletion) { // Force also delete of childtables that should lock deletion in standard case when option force is off
foreach ($this->childtables as $table) {
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$table.' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$table.' WHERE '.$this->fk_element.' = '.((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
@@ -9022,7 +9022,7 @@ abstract class CommonObject
}
} else {
// Delete record in child table
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$table.' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$table.' WHERE '.$this->fk_element.' = '.((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/core/class/coreobject.class.php b/htdocs/core/class/coreobject.class.php
index 45018cb1d8f..150ace90875 100644
--- a/htdocs/core/class/coreobject.class.php
+++ b/htdocs/core/class/coreobject.class.php
@@ -183,7 +183,7 @@ class CoreObject extends CommonObject
$this->{$className} = array();
- $sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$childTable.' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$childTable.' WHERE '.$this->fk_element.' = '.((int) $this->id);
$res = $this->db->query($sql);
if ($res) {
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index ddfad586e7c..ea245e82487 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -5274,8 +5274,9 @@ function price($amount, $form = 0, $outlangs = '', $trunc = 1, $rounding = -1, $
* Put 2 if you know that number is a user input (so we know we don't have to fix decimal separator).
* @return string Amount with universal numeric format (Example: '99.99999').
* If conversion fails to return a numeric, it returns:
- * text unchanged or partial if ($rounding = ''): price2num('W9ç', '', 0) => '9ç', price2num('W9ç', '', 1) => 'W9ç', price2num('W9ç', '', 2) => '9ç'
- * '0' if ($rounding is defined): price2num('W9ç', 'MT', 0) => '9', price2num('W9ç', 'MT', 1) => '0', price2num('W9ç', 'MT', 2) => '9'
+ * - text unchanged or partial if ($rounding = ''): price2num('W9ç', '', 0) => '9ç', price2num('W9ç', '', 1) => 'W9ç', price2num('W9ç', '', 2) => '9ç'
+ * - '0' if ($rounding is defined): price2num('W9ç', 'MT', 0) => '9', price2num('W9ç', 'MT', 1) => '0', price2num('W9ç', 'MT', 2) => '9'
+ * Note: The best way to guarantee a numeric value is to add a cast (float) before the price2num().
* If amount is null or '', it returns '' if $rounding = '' or '0' if $rounding is defined.
*
* @see price() Opposite function of price2num
diff --git a/htdocs/core/lib/ticket.lib.php b/htdocs/core/lib/ticket.lib.php
index 3aededf6a81..ac3f80e00bc 100644
--- a/htdocs/core/lib/ticket.lib.php
+++ b/htdocs/core/lib/ticket.lib.php
@@ -959,7 +959,7 @@ function getTicketActionCommEcmList($object)
$sql = 'SELECT ecm.rowid as id, ecm.src_object_type, ecm.src_object_id, ecm.filepath, ecm.filename';
$sql .= ' FROM '.MAIN_DB_PREFIX.'ecm_files ecm';
$sql .= ' WHERE ecm.filepath = \'agenda/'.$object->id.'\'';
- //$sql.= ' ecm.src_object_type = \''.$object->element.'\' AND ecm.src_object_id = '.$object->id; // Actually upload file doesn't add type
+ //$sql.= ' ecm.src_object_type = \''.$object->element.'\' AND ecm.src_object_id = '.((int) $object->id); // Actually upload file doesn't add type
$sql .= ' ORDER BY ecm.position ASC';
$resql = $db->query($sql);
diff --git a/htdocs/don/class/don.class.php b/htdocs/don/class/don.class.php
index 6bb4c99b86d..85a95905073 100644
--- a/htdocs/don/class/don.class.php
+++ b/htdocs/don/class/don.class.php
@@ -1116,7 +1116,7 @@ class Don extends CommonObject
return -1;
}
- $sql = 'SELECT SUM(amount) as sum_amount FROM '.MAIN_DB_PREFIX.'payment_donation WHERE fk_donation = '.$this->id;
+ $sql = 'SELECT SUM(amount) as sum_amount FROM '.MAIN_DB_PREFIX.'payment_donation WHERE fk_donation = '.((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
dol_print_error($this->db);
diff --git a/htdocs/emailcollector/class/emailcollector.class.php b/htdocs/emailcollector/class/emailcollector.class.php
index 16df7774470..2a062dcb1f1 100644
--- a/htdocs/emailcollector/class/emailcollector.class.php
+++ b/htdocs/emailcollector/class/emailcollector.class.php
@@ -675,7 +675,7 @@ class EmailCollector extends CommonObject
$sql = 'SELECT rowid, type, rulevalue, status';
$sql .= ' FROM '.MAIN_DB_PREFIX.'emailcollector_emailcollectorfilter';
- $sql .= ' WHERE fk_emailcollector = '.$this->id;
+ $sql .= ' WHERE fk_emailcollector = '.((int) $this->id);
//$sql.= ' ORDER BY position';
$resql = $this->db->query($sql);
@@ -707,7 +707,7 @@ class EmailCollector extends CommonObject
$sql = 'SELECT rowid, type, actionparam, status';
$sql .= ' FROM '.MAIN_DB_PREFIX.'emailcollector_emailcollectoraction';
- $sql .= ' WHERE fk_emailcollector = '.$this->id;
+ $sql .= ' WHERE fk_emailcollector = '.((int) $this->id);
$sql .= ' ORDER BY position';
$resql = $this->db->query($sql);
diff --git a/htdocs/expedition/class/expedition.class.php b/htdocs/expedition/class/expedition.class.php
index 42d290aa02f..049ef7832b0 100644
--- a/htdocs/expedition/class/expedition.class.php
+++ b/htdocs/expedition/class/expedition.class.php
@@ -2162,7 +2162,7 @@ class Expedition extends CommonObject
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'expedition SET fk_statut='.self::STATUS_CLOSED;
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > 0';
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > 0';
$resql = $this->db->query($sql);
if ($resql) {
@@ -2307,7 +2307,7 @@ class Expedition extends CommonObject
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'expedition SET fk_statut=2, billed=1'; // TODO Update only billed
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > 0';
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > 0';
$resql = $this->db->query($sql);
if ($resql) {
@@ -2356,7 +2356,7 @@ class Expedition extends CommonObject
$oldbilled = $this->billed;
$sql = 'UPDATE '.MAIN_DB_PREFIX.'expedition SET fk_statut=1';
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > 0';
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > 0';
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index c2b63f9393e..22f29bb1d9e 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -1031,7 +1031,7 @@ class ExpenseReport extends CommonObject
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line.' as de';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_type_fees as ctf ON de.fk_c_type_fees = ctf.id';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'projet as p ON de.fk_projet = p.rowid';
- $sql .= ' WHERE de.'.$this->fk_element.' = '.$this->id;
+ $sql .= ' WHERE de.'.$this->fk_element.' = '.((int) $this->id);
if (!empty($conf->global->EXPENSEREPORT_LINES_SORTED_BY_ROWID)) {
$sql .= ' ORDER BY de.rang ASC, de.rowid ASC';
} else {
@@ -1340,7 +1340,7 @@ class ExpenseReport extends CommonObject
// Sélection de la date de début de la NDF
$sql = 'SELECT date_debut';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
@@ -1351,7 +1351,7 @@ class ExpenseReport extends CommonObject
if ($this->status != self::STATUS_VALIDATED) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET fk_statut = ".self::STATUS_VALIDATED;
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::set_save_from_refuse", LOG_DEBUG);
@@ -1386,7 +1386,7 @@ class ExpenseReport extends CommonObject
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET ref = '".$this->db->escape($this->ref)."', fk_statut = ".self::STATUS_APPROVED.", fk_user_approve = ".((int) $fuser->id).",";
$sql .= " date_approve='".$this->db->idate($this->date_approve)."'";
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
if (!$notrigger) {
// Call trigger
@@ -1438,7 +1438,7 @@ class ExpenseReport extends CommonObject
$sql .= " date_refuse='".$this->db->idate($now)."',";
$sql .= " detail_refuse='".$this->db->escape($details)."',";
$sql .= " fk_user_approve = NULL";
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
if ($this->db->query($sql)) {
$this->fk_statut = 99; // deprecated
$this->status = 99;
@@ -1507,7 +1507,7 @@ class ExpenseReport extends CommonObject
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET paid = 0, fk_statut = ".self::STATUS_APPROVED;
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::set_unpaid", LOG_DEBUG);
@@ -1561,7 +1561,7 @@ class ExpenseReport extends CommonObject
$sql .= " SET fk_statut = ".self::STATUS_CANCELED.", fk_user_cancel = ".((int) $fuser->id);
$sql .= ", date_cancel='".$this->db->idate($this->date_cancel)."'";
$sql .= " ,detail_cancel='".$this->db->escape($detail)."'";
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::set_cancel", LOG_DEBUG);
@@ -2525,7 +2525,7 @@ class ExpenseReport extends CommonObject
$sql = 'SELECT sum(amount) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.$this->id;
+ $sql .= ' WHERE '.$field.' = '.((int) $this->id);
dol_syslog(get_class($this)."::getSumPayments", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -2759,15 +2759,15 @@ class ExpenseReportLine
$sql .= ' INNER JOIN '.MAIN_DB_PREFIX.'expensereport e ON (d.fk_expensereport = e.rowid)';
$sql .= ' WHERE e.fk_user_author = '.((int) $fk_user);
if (!empty($this->id)) {
- $sql .= ' AND d.rowid <> '.$this->id;
+ $sql .= ' AND d.rowid <> '.((int) $this->id);
}
$sql .= ' AND d.fk_c_type_fees = '.((int) $rule->fk_c_type_fees);
if ($mode == 'day' || $mode == 'EX_DAY') {
$sql .= " AND d.date = '".dol_print_date($this->date, '%Y-%m-%d')."'";
} elseif ($mode == 'mon' || $mode == 'EX_MON') {
- $sql .= ' AND DATE_FORMAT(d.date, \'%Y-%m\') = \''.dol_print_date($this->date, '%Y-%m').'\''; // @todo DATE_FORMAT is forbidden
+ $sql .= " AND DATE_FORMAT(d.date, '%Y-%m') = '".dol_print_date($this->date, '%Y-%m')."'"; // @todo DATE_FORMAT is forbidden
} elseif ($mode == 'year' || $mode == 'EX_YEA') {
- $sql .= ' AND DATE_FORMAT(d.date, \'%Y\') = \''.dol_print_date($this->date, '%Y').'\''; // @todo DATE_FORMAT is forbidden
+ $sql .= " AND DATE_FORMAT(d.date, '%Y') = '".dol_print_date($this->date, '%Y')."'"; // @todo DATE_FORMAT is forbidden
}
dol_syslog('ExpenseReportLine::getExpAmount');
diff --git a/htdocs/fichinter/card.php b/htdocs/fichinter/card.php
index 1b647af00a6..243545dd14b 100644
--- a/htdocs/fichinter/card.php
+++ b/htdocs/fichinter/card.php
@@ -1279,7 +1279,7 @@ if ($action == 'create') {
$sql = 'SELECT ft.rowid, ft.description, ft.fk_fichinter, ft.duree, ft.rang,';
$sql .= ' ft.date as date_intervention';
$sql .= ' FROM '.MAIN_DB_PREFIX.'fichinterdet as ft';
- $sql .= ' WHERE ft.fk_fichinter = '.$object->id;
+ $sql .= ' WHERE ft.fk_fichinter = '.((int) $object->id);
if (!empty($conf->global->FICHINTER_HIDE_EMPTY_DURATION)) {
$sql .= ' AND ft.duree <> 0';
}
diff --git a/htdocs/fichinter/class/fichinterrec.class.php b/htdocs/fichinter/class/fichinterrec.class.php
index 9aec232cf0a..d23c25253ac 100644
--- a/htdocs/fichinter/class/fichinterrec.class.php
+++ b/htdocs/fichinter/class/fichinterrec.class.php
@@ -356,7 +356,7 @@ class FichinterRec extends Fichinter
$sql .= ' p.label as product_label, p.description as product_desc';
$sql .= ' FROM '.MAIN_DB_PREFIX.'fichinterdet_rec as l';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON l.fk_product = p.rowid';
- $sql .= ' WHERE l.fk_fichinter = '.$this->id;
+ $sql .= ' WHERE l.fk_fichinter = '.((int) $this->id);
dol_syslog('FichInter-rec::fetch_lines', LOG_DEBUG);
$result = $this->db->query($sql);
@@ -718,7 +718,7 @@ class FichinterRec extends Fichinter
if (!empty($unit)) {
$sql .= ', unit_frequency = "'.$this->db->escape($unit).'"';
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setFrequencyAndUnit", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -751,7 +751,7 @@ class FichinterRec extends Fichinter
if ($increment_nb_gen_done > 0) {
$sql .= ', nb_gen_done = nb_gen_done + 1';
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setNextDate", LOG_DEBUG);
if ($this->db->query($sql)) {
@@ -844,7 +844,7 @@ class FichinterRec extends Fichinter
$sql .= ' , statut = 1';
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::setAutoValidate", LOG_DEBUG);
if ($this->db->query($sql)) {
diff --git a/htdocs/fourn/card.php b/htdocs/fourn/card.php
index f37e96ba602..599242375d2 100644
--- a/htdocs/fourn/card.php
+++ b/htdocs/fourn/card.php
@@ -519,7 +519,7 @@ if ($object->id > 0) {
$sql .= ' FROM '.MAIN_DB_PREFIX.'product_fournisseur_price as pfp';
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product as p ON p.rowid = pfp.fk_product";
$sql .= ' WHERE p.entity IN ('.getEntity('product').')';
- $sql .= ' AND pfp.fk_soc = '.$object->id;
+ $sql .= ' AND pfp.fk_soc = '.((int) $object->id);
$sql .= $db->order('pfp.tms', 'desc');
$sql .= $db->plimit($MAXLIST);
@@ -658,7 +658,7 @@ if ($object->id > 0) {
$sql2 .= ', '.MAIN_DB_PREFIX.'commande_fournisseur as c';
$sql2 .= ' WHERE c.fk_soc = s.rowid';
$sql2 .= " AND c.entity IN (".getEntity('commande_fournisseur').")";
- $sql2 .= ' AND s.rowid = '.$object->id;
+ $sql2 .= ' AND s.rowid = '.((int) $object->id);
// Show orders we can bill
if (empty($conf->global->SUPPLIER_ORDER_TO_INVOICE_STATUS)) {
$sql2 .= " AND c.fk_statut IN (".$db->sanitize(CommandeFournisseur::STATUS_RECEIVED_COMPLETELY).")"; // Must match filter in htdocs/fourn/commande/list.php
@@ -758,7 +758,7 @@ if ($object->id > 0) {
$sql .= ' SUM(pf.amount) as am';
$sql .= ' FROM '.MAIN_DB_PREFIX.'facture_fourn as f';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'paiementfourn_facturefourn as pf ON f.rowid=pf.fk_facturefourn';
- $sql .= ' WHERE f.fk_soc = '.$object->id;
+ $sql .= ' WHERE f.fk_soc = '.((int) $object->id);
$sql .= " AND f.entity IN (".getEntity('facture_fourn').")";
$sql .= ' GROUP BY f.rowid,f.libelle,f.ref,f.ref_supplier,f.fk_statut,f.datef,f.total_ht,f.total_tva,f.total_ttc,f.paye';
$sql .= ' ORDER BY f.datef DESC';
diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php
index 4b74b596be5..9d965ee034e 100644
--- a/htdocs/fourn/class/fournisseur.commande.class.php
+++ b/htdocs/fourn/class/fournisseur.commande.class.php
@@ -930,7 +930,7 @@ class CommandeFournisseur extends CommonOrder
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande_fournisseur SET billed = 1';
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > '.self::STATUS_DRAFT;
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > '.self::STATUS_DRAFT;
if ($this->db->query($sql)) {
if (!$error) {
@@ -3399,12 +3399,12 @@ class CommandeFournisseur extends CommonOrder
$sql .= ' cfd.fk_reception = e.rowid AND';
}
$sql .= ' cfd.fk_commandefourndet = cd.rowid';
- $sql .= ' AND cd.fk_commande ='.$this->id;
+ $sql .= ' AND cd.fk_commande ='.((int) $this->id);
if ($this->fk_product > 0) {
- $sql .= ' AND cd.fk_product = '.$this->fk_product;
+ $sql .= ' AND cd.fk_product = '.((int) $this->fk_product);
}
if ($filtre_statut >= 0) {
- $sql .= ' AND e.fk_statut >= '.$filtre_statut;
+ $sql .= ' AND e.fk_statut >= '.((int) $filtre_statut);
}
$sql .= ' GROUP BY cd.rowid, cd.fk_product';
diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index e8ec417edd7..b97bf5485fa 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -818,7 +818,7 @@ class FactureFournisseur extends CommonInvoice
$sql .= ', f.fk_code_ventilation, f.fk_multicurrency, f.multicurrency_code, f.multicurrency_subprice, f.multicurrency_total_ht, f.multicurrency_total_tva, f.multicurrency_total_ttc';
$sql .= ' FROM '.MAIN_DB_PREFIX.'facture_fourn_det as f';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON f.fk_product = p.rowid';
- $sql .= ' WHERE fk_facture_fourn='.$this->id;
+ $sql .= ' WHERE fk_facture_fourn='.((int) $this->id);
$sql .= ' ORDER BY f.rang, f.rowid';
dol_syslog(get_class($this)."::fetch_lines", LOG_DEBUG);
@@ -1491,7 +1491,7 @@ class FactureFournisseur extends CommonInvoice
if ($close_note) {
$sql .= ", close_note='".$this->db->escape($close_note)."'";
}
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -1499,7 +1499,7 @@ class FactureFournisseur extends CommonInvoice
// as they have not been used since the invoice is abandoned.
$sql = 'UPDATE '.MAIN_DB_PREFIX.'societe_remise_except';
$sql .= ' SET fk_invoice_supplier = NULL';
- $sql .= ' WHERE fk_invoice_supplier = '.$this->id;
+ $sql .= ' WHERE fk_invoice_supplier = '.((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
@@ -3317,7 +3317,7 @@ class SupplierInvoiceLine extends CommonObjectLine
if (!$error) {
// Supprime ligne
$sql = 'DELETE FROM '.MAIN_DB_PREFIX.'facture_fourn_det ';
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::delete", LOG_DEBUG);
$resql = $this->db->query($sql);
if (!$resql) {
diff --git a/htdocs/fourn/class/paiementfourn.class.php b/htdocs/fourn/class/paiementfourn.class.php
index 28ef8025a98..2227e2b8c0a 100644
--- a/htdocs/fourn/class/paiementfourn.class.php
+++ b/htdocs/fourn/class/paiementfourn.class.php
@@ -398,11 +398,11 @@ class PaiementFourn extends Paiement
// Efface la ligne de paiement (dans paiement_facture et paiement)
$sql = 'DELETE FROM '.MAIN_DB_PREFIX.'paiementfourn_facturefourn';
- $sql .= ' WHERE fk_paiementfourn = '.$this->id;
+ $sql .= ' WHERE fk_paiementfourn = '.((int) $this->id);
$resql = $this->db->query($sql);
if ($resql) {
$sql = 'DELETE FROM '.MAIN_DB_PREFIX.'paiementfourn';
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if (!$result) {
$this->error = $this->db->error();
@@ -484,16 +484,16 @@ class PaiementFourn extends Paiement
/**
* Return list of supplier invoices the payment point to
*
- * @param string $filter SQL filter
+ * @param string $filter SQL filter. Warning: This value must not come from a user input.
* @return array Array of supplier invoice id
*/
public function getBillsArray($filter = '')
{
$sql = 'SELECT fk_facturefourn';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiementfourn_facturefourn as pf, '.MAIN_DB_PREFIX.'facture_fourn as f';
- $sql .= ' WHERE pf.fk_facturefourn = f.rowid AND fk_paiementfourn = '.$this->id;
+ $sql .= ' WHERE pf.fk_facturefourn = f.rowid AND fk_paiementfourn = '.((int) $this->id);
if ($filter) {
- $sql .= ' AND '.$filter;
+ $sql .= " AND ".$filter;
}
dol_syslog(get_class($this).'::getBillsArray', LOG_DEBUG);
diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php
index 6ea356e189e..b981d46b764 100644
--- a/htdocs/fourn/commande/card.php
+++ b/htdocs/fourn/commande/card.php
@@ -337,14 +337,14 @@ if (empty($reshook)) {
// Currently the "Re-open" also remove the billed flag because there is no button "Set unpaid" yet.
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande_fournisseur';
$sql .= ' SET billed = 0';
- $sql .= ' WHERE rowid = '.$object->id;
+ $sql .= ' WHERE rowid = '.((int) $object->id);
$resql = $db->query($sql);
if ($newstatus == 0) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande_fournisseur';
$sql .= ' SET fk_user_approve = null, fk_user_approve2 = null, date_approve = null, date_approve2 = null';
- $sql .= ' WHERE rowid = '.$object->id;
+ $sql .= ' WHERE rowid = '.((int) $object->id);
$resql = $db->query($sql);
}
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index 2f3fb2b0078..4912419d979 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -578,7 +578,7 @@ if (empty($reshook)) {
$sql = 'SELECT SUM(pf.amount) as total_paiements';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiementfourn_facturefourn as pf, '.MAIN_DB_PREFIX.'paiementfourn as p';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_paiement as c ON p.fk_paiement = c.id AND c.entity IN ('.getEntity('c_paiement').')';
- $sql .= ' WHERE pf.fk_facturefourn = '.$object->id;
+ $sql .= ' WHERE pf.fk_facturefourn = '.((int) $object->id);
$sql .= ' AND pf.fk_paiementfourn = p.rowid';
$sql .= ' AND p.entity IN ('.getEntity('invoice').')';
@@ -3018,7 +3018,7 @@ if ($action == 'create') {
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'bank_account as ba ON b.fk_account = ba.rowid';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_paiement as c ON p.fk_paiement = c.id';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'paiementfourn_facturefourn as pf ON pf.fk_paiementfourn = p.rowid';
- $sql .= ' WHERE pf.fk_facturefourn = '.$object->id;
+ $sql .= ' WHERE pf.fk_facturefourn = '.((int) $object->id);
$sql .= ' ORDER BY p.datep, p.tms';
$result = $db->query($sql);
diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php
index d6f07426a04..527cd851709 100644
--- a/htdocs/fourn/facture/list.php
+++ b/htdocs/fourn/facture/list.php
@@ -549,7 +549,7 @@ if ($search_montant_ttc != '') {
$sql .= natural_search('f.total_ttc', $search_montant_ttc, 1);
}
if ($search_multicurrency_code != '') {
- $sql .= ' AND f.multicurrency_code = "'.$db->escape($search_multicurrency_code).'"';
+ $sql .= " AND f.multicurrency_code = '".$db->escape($search_multicurrency_code)."'";
}
if ($search_multicurrency_tx != '') {
$sql .= natural_search('f.multicurrency_tx', $search_multicurrency_tx, 1);
diff --git a/htdocs/fourn/paiement/card.php b/htdocs/fourn/paiement/card.php
index ccc29105e4f..708fa266f0a 100644
--- a/htdocs/fourn/paiement/card.php
+++ b/htdocs/fourn/paiement/card.php
@@ -259,7 +259,7 @@ if ($result > 0) {
$sql .= ' pf.amount, s.nom as name, s.rowid as socid';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiementfourn_facturefourn as pf,'.MAIN_DB_PREFIX.'facture_fourn as f,'.MAIN_DB_PREFIX.'societe as s';
$sql .= ' WHERE pf.fk_facturefourn = f.rowid AND f.fk_soc = s.rowid';
- $sql .= ' AND pf.fk_paiementfourn = '.$object->id;
+ $sql .= ' AND pf.fk_paiementfourn = '.((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
diff --git a/htdocs/loan/class/loan.class.php b/htdocs/loan/class/loan.class.php
index 2e51b3871a9..ffd745e263f 100644
--- a/htdocs/loan/class/loan.class.php
+++ b/htdocs/loan/class/loan.class.php
@@ -651,7 +651,7 @@ class Loan extends CommonObject
$sql = 'SELECT sum(amount_capital) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.$this->id;
+ $sql .= ' WHERE '.$field.' = '.((int) $this->id);
dol_syslog(get_class($this)."::getSumPayment", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/modulebuilder/template/myobject_list.php b/htdocs/modulebuilder/template/myobject_list.php
index 2eee13fd879..3319ca1909d 100644
--- a/htdocs/modulebuilder/template/myobject_list.php
+++ b/htdocs/modulebuilder/template/myobject_list.php
@@ -345,6 +345,13 @@ $sql .= $hookmanager->resPrint;
$sql = preg_replace('/,\s*$/', '', $sql);
*/
+// Add HAVING from hooks
+/*
+$parameters = array();
+$reshook = $hookmanager->executeHooks('printFieldListHaving', $parameters, $object); // Note that $action and $object may have been modified by hook
+$sql .= !empty($hookmanager->resPrint) ? (" HAVING 1=1 " . $hookmanager->resPrint) : "";
+*/
+
// Count total nb of records
$nbtotalofrecords = '';
if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST)) {
diff --git a/htdocs/mrp/class/mo.class.php b/htdocs/mrp/class/mo.class.php
index bc5e8eca58a..7176d574dab 100644
--- a/htdocs/mrp/class/mo.class.php
+++ b/htdocs/mrp/class/mo.class.php
@@ -502,7 +502,7 @@ class Mo extends CommonObject
if ($lineid > 0) {
$sql .= ' AND t.fk_mrp_production = '.((int) $lineid);
} else {
- $sql .= 'AND t.fk_mo = '.$this->id;
+ $sql .= 'AND t.fk_mo = '.((int) $this->id);
}
$resql = $this->db->query($sql);
@@ -627,7 +627,7 @@ class Mo extends CommonObject
if (!$error) {
// TODO Check that production has not started. If yes, we stop here.
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.'mrp_production WHERE fk_mo = '.$this->id;
+ $sql = 'DELETE FROM '.MAIN_DB_PREFIX.'mrp_production WHERE fk_mo = '.((int) $this->id);
$this->db->query($sql);
$moline = new MoLine($this->db);
diff --git a/htdocs/multicurrency/class/multicurrency.class.php b/htdocs/multicurrency/class/multicurrency.class.php
index 5067a6e91d5..8c2e01f9ceb 100644
--- a/htdocs/multicurrency/class/multicurrency.class.php
+++ b/htdocs/multicurrency/class/multicurrency.class.php
@@ -245,7 +245,7 @@ class MultiCurrency extends CommonObject
{
$sql = 'SELECT cr.rowid';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line.' as cr';
- $sql .= ' WHERE cr.fk_multicurrency = '.$this->id;
+ $sql .= ' WHERE cr.fk_multicurrency = '.((int) $this->id);
$sql .= ' ORDER BY cr.date_sync DESC';
$this->rates = array();
@@ -479,8 +479,8 @@ class MultiCurrency extends CommonObject
{
$sql = 'SELECT cr.rowid';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line.' as cr';
- $sql .= ' WHERE cr.fk_multicurrency = '.$this->id;
- $sql .= ' AND cr.date_sync = (SELECT MAX(cr2.date_sync) FROM '.MAIN_DB_PREFIX.$this->table_element_line.' AS cr2 WHERE cr2.fk_multicurrency = '.$this->id.')';
+ $sql .= ' WHERE cr.fk_multicurrency = '.((int) $this->id);
+ $sql .= ' AND cr.date_sync = (SELECT MAX(cr2.date_sync) FROM '.MAIN_DB_PREFIX.$this->table_element_line.' AS cr2 WHERE cr2.fk_multicurrency = '.((int) $this->id).')';
dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/product/inventory/class/inventory.class.php b/htdocs/product/inventory/class/inventory.class.php
index 9fb74c96f83..e17a1fd418f 100644
--- a/htdocs/product/inventory/class/inventory.class.php
+++ b/htdocs/product/inventory/class/inventory.class.php
@@ -266,7 +266,7 @@ class Inventory extends CommonObject
if ($this->status == self::STATUS_DRAFT) {
// Delete inventory
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.'inventorydet WHERE fk_inventory = '.$this->id;
+ $sql = 'DELETE FROM '.MAIN_DB_PREFIX.'inventorydet WHERE fk_inventory = '.((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
@@ -349,7 +349,7 @@ class Inventory extends CommonObject
$this->db->begin();
// Delete inventory
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.'inventorydet WHERE fk_inventory = '.$this->id;
+ $sql = 'DELETE FROM '.MAIN_DB_PREFIX.'inventorydet WHERE fk_inventory = '.((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
diff --git a/htdocs/product/inventory/inventory.php b/htdocs/product/inventory/inventory.php
index 01968855836..1147869a716 100644
--- a/htdocs/product/inventory/inventory.php
+++ b/htdocs/product/inventory/inventory.php
@@ -116,7 +116,7 @@ if ($action == 'update' && !empty($user->rights->stock->mouvement->creer)) {
$sql = 'SELECT id.rowid, id.datec as date_creation, id.tms as date_modification, id.fk_inventory, id.fk_warehouse,';
$sql .= ' id.fk_product, id.batch, id.qty_stock, id.qty_view, id.qty_regulated';
$sql .= ' FROM '.MAIN_DB_PREFIX.'inventorydet as id';
- $sql .= ' WHERE id.fk_inventory = '.$object->id;
+ $sql .= ' WHERE id.fk_inventory = '.((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
@@ -168,7 +168,7 @@ if ($action =='updateinventorylines' && $permissiontoadd) {
$sql = 'SELECT id.rowid, id.datec as date_creation, id.tms as date_modification, id.fk_inventory, id.fk_warehouse,';
$sql .= ' id.fk_product, id.batch, id.qty_stock, id.qty_view, id.qty_regulated';
$sql .= ' FROM '.MAIN_DB_PREFIX.'inventorydet as id';
- $sql .= ' WHERE id.fk_inventory = '.$object->id;
+ $sql .= ' WHERE id.fk_inventory = '.((int) $object->id);
$db->begin();
diff --git a/htdocs/projet/activity/perday.php b/htdocs/projet/activity/perday.php
index 8897f9550a3..29a3c40209c 100644
--- a/htdocs/projet/activity/perday.php
+++ b/htdocs/projet/activity/perday.php
@@ -310,7 +310,7 @@ if ($action == 'addtime' && $user->rights->projet->lire && GETPOST('formfilterac
setEventMessages($langs->trans("RecordSaved"), null, 'mesgs');
// Redirect to avoid submit twice on back
- header('Location: '.$_SERVER["PHP_SELF"].'?'.($projectid ? 'id='.$projectid : '').($search_usertoprocessid ? '&search_usertoprocessid='.$search_usertoprocessid : '').($mode ? '&mode='.$mode : '').'&year='.$yearofday.'&month='.$monthofday.'&day='.$dayofday);
+ header('Location: '.$_SERVER["PHP_SELF"].'?'.($projectid ? 'id='.$projectid : '').($search_usertoprocessid ? '&search_usertoprocessid='.urlencode($search_usertoprocessid) : '').($mode ? '&mode='.$mode : '').'&year='.$yearofday.'&month='.$monthofday.'&day='.$dayofday);
exit;
}
} else {
diff --git a/htdocs/projet/activity/permonth.php b/htdocs/projet/activity/permonth.php
index 97c54b73675..1fae2fe0300 100644
--- a/htdocs/projet/activity/permonth.php
+++ b/htdocs/projet/activity/permonth.php
@@ -334,12 +334,12 @@ llxHeader("", $title, "", '', '', '', array('/core/js/timesheet.js'));
//print_barre_liste($title, $page, $_SERVER["PHP_SELF"], "", $sortfield, $sortorder, "", $num, '', 'title_project');
$param = '';
-$param .= ($mode ? '&mode='.$mode : '');
-$param .= ($search_project_ref ? '&search_project_ref='.$search_project_ref : '');
-$param .= ($search_usertoprocessid > 0 ? '&search_usertoprocessid='.$search_usertoprocessid : '');
-$param .= ($search_thirdparty ? '&search_thirdparty='.$search_thirdparty : '');
-$param .= ($search_task_ref ? '&search_task_ref='.$search_task_ref : '');
-$param .= ($search_task_label ? '&search_task_label='.$search_task_label : '');
+$param .= ($mode ? '&mode='.urlencode($mode) : '');
+$param .= ($search_project_ref ? '&search_project_ref='.urlencode($search_project_ref) : '');
+$param .= ($search_usertoprocessid > 0 ? '&search_usertoprocessid='.urlencode($search_usertoprocessid) : '');
+$param .= ($search_thirdparty ? '&search_thirdparty='.urlencode($search_thirdparty) : '');
+$param .= ($search_task_ref ? '&search_task_ref='.urlencode($search_task_ref) : '');
+$param .= ($search_task_label ? '&search_task_label='.urlencode($search_task_label) : '');
// Show navigation bar
$nav = ''.img_previous($langs->trans("Previous"))." \n";
diff --git a/htdocs/reception/class/reception.class.php b/htdocs/reception/class/reception.class.php
index 948822c1983..6a4301d86df 100644
--- a/htdocs/reception/class/reception.class.php
+++ b/htdocs/reception/class/reception.class.php
@@ -1034,7 +1034,7 @@ class Reception extends CommonObject
{
// phpcs:enable
dol_include_once('/fourn/class/fournisseur.commande.dispatch.class.php');
- $sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.'commande_fournisseur_dispatch WHERE fk_reception='.$this->id;
+ $sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.'commande_fournisseur_dispatch WHERE fk_reception='.((int) $this->id);
$resql = $this->db->query($sql);
if (!empty($resql)) {
@@ -1445,7 +1445,7 @@ class Reception extends CommonObject
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'reception SET fk_statut='.self::STATUS_CLOSED;
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > 0';
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > 0';
$resql = $this->db->query($sql);
if ($resql) {
@@ -1590,7 +1590,7 @@ class Reception extends CommonObject
$this->setClosed();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'reception SET billed=1';
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > 0';
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > 0';
$resql = $this->db->query($sql);
if ($resql) {
@@ -1630,7 +1630,7 @@ class Reception extends CommonObject
$this->db->begin();
$sql = 'UPDATE '.MAIN_DB_PREFIX.'reception SET fk_statut=1, billed=0';
- $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut > 0';
+ $sql .= " WHERE rowid = ".((int) $this->id).' AND fk_statut > 0';
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/salaries/class/salary.class.php b/htdocs/salaries/class/salary.class.php
index 17274813ef5..c434e73ec08 100644
--- a/htdocs/salaries/class/salary.class.php
+++ b/htdocs/salaries/class/salary.class.php
@@ -468,7 +468,7 @@ class Salary extends CommonObject
{
// phpcs:enable
$sql = 'UPDATE '.MAIN_DB_PREFIX.'salary SET fk_bank = '.((int) $id_bank);
- $sql .= ' WHERE rowid = '.$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
return 1;
@@ -570,7 +570,7 @@ class Salary extends CommonObject
$sql = 'SELECT sum(amount) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.$this->id;
+ $sql .= ' WHERE '.$field.' = '.((int) $this->id);
dol_syslog(get_class($this)."::getSommePaiement", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/salaries/payment_salary/card.php b/htdocs/salaries/payment_salary/card.php
index 5f05c1d98b7..e4364f6727f 100644
--- a/htdocs/salaries/payment_salary/card.php
+++ b/htdocs/salaries/payment_salary/card.php
@@ -180,7 +180,7 @@ $sql = 'SELECT f.rowid as scid, f.label, f.paye, f.amount as sc_amount, ps.amoun
$sql .= ' FROM '.MAIN_DB_PREFIX.'payment_salary as ps,'.MAIN_DB_PREFIX.'salary as f';
$sql .= ' WHERE ps.fk_salary = f.rowid';
$sql .= ' AND f.entity = '.$conf->entity;
-$sql .= ' AND ps.rowid = '.$object->id;
+$sql .= ' AND ps.rowid = '.((int) $object->id);
dol_syslog("payment_salary/card.php", LOG_DEBUG);
$resql = $db->query($sql);
diff --git a/htdocs/stripe/class/actions_stripe.class.php b/htdocs/stripe/class/actions_stripe.class.php
index e44f3480042..f1a7a5c7877 100644
--- a/htdocs/stripe/class/actions_stripe.class.php
+++ b/htdocs/stripe/class/actions_stripe.class.php
@@ -173,7 +173,7 @@ class ActionsStripeconnect
// On verifie si la facture a des paiements
$sql = 'SELECT pf.amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf';
- $sql .= ' WHERE pf.fk_facture = '.$object->id;
+ $sql .= ' WHERE pf.fk_facture = '.((int) $object->id);
$result = $this->db->query($sql);
if ($result) {
diff --git a/htdocs/supplier_proposal/class/supplier_proposal.class.php b/htdocs/supplier_proposal/class/supplier_proposal.class.php
index 6b76cf23af6..e35051829cb 100644
--- a/htdocs/supplier_proposal/class/supplier_proposal.class.php
+++ b/htdocs/supplier_proposal/class/supplier_proposal.class.php
@@ -2565,7 +2565,7 @@ class SupplierProposal extends CommonObject
$sql .= ' pt.fk_multicurrency, pt.multicurrency_code, pt.multicurrency_subprice, pt.multicurrency_total_ht, pt.multicurrency_total_tva, pt.multicurrency_total_ttc, pt.fk_unit';
$sql .= ' FROM '.MAIN_DB_PREFIX.'supplier_proposaldet as pt';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON pt.fk_product=p.rowid';
- $sql .= ' WHERE pt.fk_supplier_proposal = '.$this->id;
+ $sql .= ' WHERE pt.fk_supplier_proposal = '.((int) $this->id);
$sql .= ' ORDER BY pt.rang ASC, pt.rowid';
dol_syslog(get_class($this).'::getLinesArray', LOG_DEBUG);
@@ -3045,8 +3045,8 @@ class SupplierProposalLine extends CommonObjectLine
$sql .= " ".price2num($this->total_ttc).",";
$sql .= " ".(!empty($this->fk_fournprice) ? "'".$this->db->escape($this->fk_fournprice)."'" : "null").",";
$sql .= " ".(isset($this->pa_ht) ? "'".price2num($this->pa_ht)."'" : "null").",";
- $sql .= ' '.$this->special_code.',';
- $sql .= ' '.$this->rang.',';
+ $sql .= ' '.((int) $this->special_code).',';
+ $sql .= ' '.((int) $this->rang).',';
$sql .= " '".$this->db->escape($this->ref_fourn)."'";
$sql .= ", ".($this->fk_multicurrency > 0 ? $this->fk_multicurrency : 'null');
$sql .= ", '".$this->db->escape($this->multicurrency_code)."'";
diff --git a/htdocs/user/group/ldap.php b/htdocs/user/group/ldap.php
index 458978d25ea..e02eb3e25d0 100644
--- a/htdocs/user/group/ldap.php
+++ b/htdocs/user/group/ldap.php
@@ -189,7 +189,7 @@ if ($result > 0) {
$result = show_ldap_content($records, 0, $records['count'], true);
}
} else {
- print ''.$langs->trans("LDAPRecordNotFound").' (dn='.$dn.' - search='.$search.') ';
+ print ''.$langs->trans("LDAPRecordNotFound").' (dn='.dol_escape_htmltag($dn).' - search='.dol_escape_htmltag($search).') ';
}
$ldap->unbind();
$ldap->close();
diff --git a/htdocs/user/ldap.php b/htdocs/user/ldap.php
index e6cee6f6f73..e8ceef77b0a 100644
--- a/htdocs/user/ldap.php
+++ b/htdocs/user/ldap.php
@@ -194,7 +194,7 @@ if ($result > 0) {
$result = show_ldap_content($records, 0, $records['count'], true);
}
} else {
- print ''.$langs->trans("LDAPRecordNotFound").' (dn='.$dn.' - search='.$search.') ';
+ print ''.$langs->trans("LDAPRecordNotFound").' (dn='.dol_escape_htmltag($dn).' - search='.dol_escape_htmltag($search).') ';
}
$ldap->unbind();
diff --git a/htdocs/website/class/website.class.php b/htdocs/website/class/website.class.php
index 4e19c057fd0..0c9ced5e68f 100644
--- a/htdocs/website/class/website.class.php
+++ b/htdocs/website/class/website.class.php
@@ -1252,7 +1252,7 @@ class Website extends CommonObject
// Read record of website that has been updated by the run_sql function previously called so we can get the
// value of fk_default_home that is ID of home page
- $sql = 'SELECT fk_default_home FROM '.MAIN_DB_PREFIX.'website WHERE rowid = '.$object->id;
+ $sql = 'SELECT fk_default_home FROM '.MAIN_DB_PREFIX.'website WHERE rowid = '.((int) $object->id);
$resql = $this->db->query($sql);
if ($resql) {
$obj = $this->db->fetch_object($resql);
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index 23be98a3b8c..ffda0802c51 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -2857,7 +2857,7 @@ if (!GETPOST('hide_websitemenu')) {
$pagepreviousid = 0;
$pagenextid = 0;
if ($pageid) {
- $sql = 'SELECT MAX(rowid) as pagepreviousid FROM '.MAIN_DB_PREFIX.'website_page WHERE rowid < '.$pageid.' AND fk_website = '.$object->id;
+ $sql = 'SELECT MAX(rowid) as pagepreviousid FROM '.MAIN_DB_PREFIX.'website_page WHERE rowid < '.$pageid.' AND fk_website = '.((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -2867,7 +2867,7 @@ if (!GETPOST('hide_websitemenu')) {
} else {
dol_print_error($db);
}
- $sql = 'SELECT MIN(rowid) as pagenextid FROM '.MAIN_DB_PREFIX.'website_page WHERE rowid > '.$pageid.' AND fk_website = '.$object->id;
+ $sql = 'SELECT MIN(rowid) as pagenextid FROM '.MAIN_DB_PREFIX.'website_page WHERE rowid > '.$pageid.' AND fk_website = '.((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
From 11096a54539045081a758a1fdfec76320a09e013 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 00:53:13 +0200
Subject: [PATCH 103/953] Add hook checkSecureAccess. It replaces
mymodule_SUBPERMCATEGORY_FOR_DOCUMENTS and
mymodule_SQLPROTECTAGAINSTEXTERNALS_FOR_DOCUMENTS
---
htdocs/core/lib/files.lib.php | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php
index 330e260a327..ba4b115e830 100644
--- a/htdocs/core/lib/files.lib.php
+++ b/htdocs/core/lib/files.lib.php
@@ -2269,8 +2269,9 @@ function dol_most_recent_file($dir, $regexfilter = '', $excludefilter = array('(
*/
function dol_check_secure_access_document($modulepart, $original_file, $entity, $fuser = '', $refname = '', $mode = 'read')
{
- global $conf, $db, $user;
+ global $conf, $db, $user, $hookmanager;
global $dolibarr_main_data_root, $dolibarr_main_document_root_alt;
+ global $object;
if (!is_object($fuser)) {
$fuser = $user;
@@ -2927,6 +2928,25 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
}
}
+ $parameters = array(
+ 'modulepart' => $modulepart,
+ 'original_file' => $original_file,
+ 'entity' => $entity,
+ 'fuser' => $fuser,
+ 'refname' => '',
+ 'mode' => $mode
+ );
+ $reshook = $hookmanager->executeHooks('checkSecureAccess', $parameters, $object);
+ if ($reshook > 0) {
+ if (!empty($hookmanager->resArray['accessallowed'])) {
+ $accessallowed = $hookmanager->resArray['accessallowed'];
+ }
+ if (!empty($hookmanager->resArray['sqlprotectagainstexternals'])) {
+ $sqlprotectagainstexternals = $hookmanager->resArray['sqlprotectagainstexternals'];
+ }
+ }
+
+ /*
// For modules who wants to manage different levels of permissions for documents
$subPermCategoryConstName = strtoupper($modulepart).'_SUBPERMCATEGORY_FOR_DOCUMENTS';
if (!empty($conf->global->$subPermCategoryConstName)) {
@@ -2939,9 +2959,11 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
// Define $sqlprotectagainstexternals for modules who want to protect access using a SQL query.
$sqlProtectConstName = strtoupper($modulepart).'_SQLPROTECTAGAINSTEXTERNALS_FOR_DOCUMENTS';
if (!empty($conf->global->$sqlProtectConstName)) { // If module want to define its own $sqlprotectagainstexternals
- // Example: mymodule__SQLPROTECTAGAINSTEXTERNALS_FOR_DOCUMENTS = "SELECT fk_soc FROM ".MAIN_DB_PREFIX.$modulepart." WHERE ref='".$db->escape($refname)."' AND entity=".$conf->entity;
+ // Example: mymodule_SQLPROTECTAGAINSTEXTERNALS_FOR_DOCUMENTS = "SELECT fk_soc FROM ".MAIN_DB_PREFIX.$modulepart." WHERE ref='".$db->escape($refname)."' AND entity=".$conf->entity;
+ // TODO Replace this with a hook
eval('$sqlprotectagainstexternals = "'.$conf->global->$sqlProtectConstName.'";');
}
+ */
}
$ret = array(
From 51a4d7630f3ac38e57c800a94a9abc6d5a3967d6 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 00:55:51 +0200
Subject: [PATCH 104/953] Clean code
---
htdocs/compta/facture/class/facture.class.php | 4 +-
htdocs/compta/stats/byratecountry.php | 4 +-
htdocs/compta/tva/class/tva.class.php | 2 +-
htdocs/compta/tva/list.php | 8 +-
htdocs/contact/class/contact.class.php | 4 +-
htdocs/contact/list.php | 2 +-
htdocs/contrat/class/contrat.class.php | 6 +-
htdocs/contrat/index.php | 14 +-
htdocs/contrat/list.php | 10 +-
htdocs/core/ajax/check_notifications.php | 9 +-
htdocs/core/boxes/box_services_expired.php | 2 +-
htdocs/core/boxes/box_validated_projects.php | 4 +-
htdocs/core/class/commoninvoice.class.php | 7 +-
htdocs/core/class/commonobject.class.php | 140 +++++++++---------
htdocs/core/class/commonobjectline.class.php | 4 +-
htdocs/core/class/coreobject.class.php | 2 +-
htdocs/core/class/discount.class.php | 20 +--
htdocs/core/class/dolreceiptprinter.class.php | 4 +-
htdocs/core/class/extrafields.class.php | 12 +-
htdocs/core/class/hookmanager.class.php | 1 +
htdocs/core/class/html.form.class.php | 6 +-
htdocs/core/class/html.formmail.class.php | 2 +-
htdocs/core/class/utils.class.php | 4 +-
htdocs/core/class/validate.class.php | 2 +-
htdocs/core/customreports.php | 59 ++++----
htdocs/core/db/pgsql.class.php | 2 +-
htdocs/core/db/sqlite3.class.php | 17 +--
htdocs/core/lib/admin.lib.php | 4 +-
htdocs/core/lib/company.lib.php | 2 +-
htdocs/core/lib/files.lib.php | 19 ---
htdocs/core/lib/invoice.lib.php | 4 +-
htdocs/core/lib/order.lib.php | 2 +-
htdocs/core/lib/propal.lib.php | 2 +-
htdocs/core/modules/modFournisseur.class.php | 6 +-
htdocs/core/modules/modSociete.class.php | 4 +-
.../class/expensereport.class.php | 2 +-
htdocs/fichinter/index.php | 2 +-
.../fourn/class/fournisseur.facture.class.php | 2 +-
htdocs/fourn/commande/index.php | 2 +-
htdocs/fourn/paiement/list.php | 2 +-
htdocs/loan/class/loan.class.php | 2 +-
htdocs/product/stock/replenishorders.php | 2 +-
htdocs/salaries/class/salary.class.php | 2 +-
htdocs/supplier_proposal/index.php | 2 +-
44 files changed, 193 insertions(+), 219 deletions(-)
diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php
index abb52560d24..bab9be7670c 100644
--- a/htdocs/compta/facture/class/facture.class.php
+++ b/htdocs/compta/facture/class/facture.class.php
@@ -4890,8 +4890,8 @@ class Facture extends CommonInvoice
if ($this->statut >= 0) {
$fieldname = 'retained_warranty_date_limit';
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname.' = '.(strval($timestamp) != '' ? '\''.$this->db->idate($timestamp).'\'' : 'null');
- $sql .= ' WHERE rowid='.((int) $this->id);
+ $sql .= " SET ".$fieldname." = ".(strval($timestamp) != '' ? "'".$this->db->idate($timestamp)."'" : 'null');
+ $sql .= ' WHERE rowid = '.((int) $this->id);
if ($this->db->query($sql)) {
$this->retained_warranty_date_limit = $timestamp;
diff --git a/htdocs/compta/stats/byratecountry.php b/htdocs/compta/stats/byratecountry.php
index 9a9ba40b56a..afc56532fdf 100644
--- a/htdocs/compta/stats/byratecountry.php
+++ b/htdocs/compta/stats/byratecountry.php
@@ -306,7 +306,7 @@ if ($modecompta == 'CREANCES-DETTES') {
$sql .= " fd.product_type AS product_type,";
$sql .= " cc.code, cc.label AS country,";
for ($i = 1; $i <= 12; $i++) {
- $sql .= " SUM(".$db->ifsql('MONTH(f.datef)='.$i, 'fd.total_ht', '0').") AS month".str_pad($i, 2, '0', STR_PAD_LEFT).",";
+ $sql .= " SUM(".$db->ifsql("MONTH(f.datef)=".$i, "fd.total_ht", "0").") AS month".str_pad($i, 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(fd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd";
@@ -393,7 +393,7 @@ if ($modecompta == 'CREANCES-DETTES') {
$sql2 .= " ffd.product_type AS product_type,";
$sql2 .= " cc.code, cc.label AS country,";
for ($i = 1; $i <= 12; $i++) {
- $sql2 .= " SUM(".$db->ifsql('MONTH(ff.datef)='.$i, 'ffd.total_ht', '0').") AS month".str_pad($i, 2, '0', STR_PAD_LEFT).",";
+ $sql2 .= " SUM(".$db->ifsql("MONTH(ff.datef)=".$i, "ffd.total_ht", "0").") AS month".str_pad($i, 2, "0", STR_PAD_LEFT).",";
}
$sql2 .= " SUM(ffd.total_ht) as total";
$sql2 .= " FROM ".MAIN_DB_PREFIX."facture_fourn_det as ffd";
diff --git a/htdocs/compta/tva/class/tva.class.php b/htdocs/compta/tva/class/tva.class.php
index 25fcee08e57..38da3c21eae 100644
--- a/htdocs/compta/tva/class/tva.class.php
+++ b/htdocs/compta/tva/class/tva.class.php
@@ -768,7 +768,7 @@ class Tva extends CommonObject
$sql = 'SELECT sum(amount) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.((int) $this->id);
+ $sql .= " WHERE ".$field." = ".((int) $this->id);
dol_syslog(get_class($this)."::getSommePaiement", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/compta/tva/list.php b/htdocs/compta/tva/list.php
index 1dc0180bd60..8c12dbfd704 100644
--- a/htdocs/compta/tva/list.php
+++ b/htdocs/compta/tva/list.php
@@ -161,16 +161,16 @@ if (!empty($search_label)) {
$sql .= natural_search('t.label', $search_label);
}
if (!empty($search_dateend_start)) {
- $sql .= ' AND t.datev >= "'.$db->idate($search_dateend_start).'"';
+ $sql .= " AND t.datev >= '".$db->idate($search_dateend_start)."'";
}
if (!empty($search_dateend_end)) {
- $sql .= ' AND t.datev <= "'.$db->idate($search_dateend_end).'"';
+ $sql .= " AND t.datev <= '".$db->idate($search_dateend_end)."'";
}
if (!empty($search_datepayment_start)) {
- $sql .= ' AND t.datep >= "'.$db->idate($search_datepayment_start).'"';
+ $sql .= " AND t.datep >= '".$db->idate($search_datepayment_start)."'";
}
if (!empty($search_datepayment_end)) {
- $sql .= ' AND t.datep <= "'.$db->idate($search_datepayment_end).'"';
+ $sql .= " AND t.datep <= '".$db->idate($search_datepayment_end)."'";
}
if (!empty($search_type) && $search_type > 0) {
$sql .= ' AND t.fk_typepayment = '.((int) $search_type);
diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php
index fd9830f36ca..066ee681f7a 100644
--- a/htdocs/contact/class/contact.class.php
+++ b/htdocs/contact/class/contact.class.php
@@ -388,8 +388,8 @@ class Contact extends CommonObject
$sql .= " WHERE sp.fk_soc = s.rowid AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
$clause = "AND";
}
- $sql .= ' '.$clause.' sp.entity IN ('.getEntity($this->element).')';
- $sql .= " AND (sp.priv='0' OR (sp.priv='1' AND sp.fk_user_creat=".((int) $user->id)."))";
+ $sql .= " ".$clause." sp.entity IN (".getEntity($this->element).")";
+ $sql .= " AND (sp.priv='0' OR (sp.priv='1' AND sp.fk_user_creat = ".((int) $user->id)."))";
if ($user->socid > 0) {
$sql .= " AND sp.fk_soc = ".((int) $user->socid);
}
diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index 3f98f556cb7..7a9bfefb11f 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -478,7 +478,7 @@ if (strlen($search_fax)) {
if (!empty($conf->socialnetworks->enabled)) {
foreach ($socialnetworks as $key => $value) {
if ($value['active'] && strlen($search_[$key])) {
- $sql .= ' AND p.socialnetworks LIKE \'%"'.$key.'":"'.$search_[$key].'%\'';
+ $sql .= " AND p.socialnetworks LIKE '%\"".$key."\":\"".$search_[$key]."%'";
}
}
}
diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php
index 1ce51af2d90..a7a42ca7350 100644
--- a/htdocs/contrat/class/contrat.class.php
+++ b/htdocs/contrat/class/contrat.class.php
@@ -1222,7 +1222,7 @@ class Contrat extends CommonObject
// Delete llx_ecm_files
if (!$error) {
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX."ecm_files WHERE src_object_type = '".$this->db->escape($this->table_element.(empty($this->module) ? '' : '@'.$this->module))."' AND src_object_id = ".((int) $this->id);
+ $sql = 'DELETE FROM '.MAIN_DB_PREFIX."ecm_files WHERE src_object_type = '".$this->db->escape($this->table_element.(empty($this->module) ? "" : "@".$this->module))."' AND src_object_id = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
@@ -3257,12 +3257,12 @@ class ContratLigne extends CommonObjectLine
$sql .= " '".$this->db->escape($this->info_bits)."',";
$sql .= " ".price2num($this->price_ht).",".price2num($this->remise).",";
if ($this->fk_fournprice > 0) {
- $sql .= ' '.$this->fk_fournprice.',';
+ $sql .= ' '.((int) $this->fk_fournprice).',';
} else {
$sql .= ' null,';
}
if ($this->pa_ht > 0) {
- $sql .= ' '.price2num($this->pa_ht);
+ $sql .= ' '.((float) price2num($this->pa_ht));
} else {
$sql .= ' null';
}
diff --git a/htdocs/contrat/index.php b/htdocs/contrat/index.php
index cc3bc87ca54..b85cda094f3 100644
--- a/htdocs/contrat/index.php
+++ b/htdocs/contrat/index.php
@@ -99,7 +99,7 @@ $sql .= " WHERE cd.fk_contrat = c.rowid AND c.fk_soc = s.rowid";
$sql .= " AND (cd.statut != 4 OR (cd.statut = 4 AND (cd.date_fin_validite is null or cd.date_fin_validite >= '".$db->idate($now)."')))";
$sql .= " AND c.entity IN (".getEntity('contract', 0).")";
if ($user->socid) {
- $sql .= ' AND c.fk_soc = '.$user->socid;
+ $sql .= ' AND c.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
@@ -136,7 +136,7 @@ $sql .= " WHERE cd.fk_contrat = c.rowid AND c.fk_soc = s.rowid";
$sql .= " AND (cd.statut = 4 AND cd.date_fin_validite < '".$db->idate($now)."')";
$sql .= " AND c.entity IN (".getEntity('contract', 0).")";
if ($user->socid) {
- $sql .= ' AND c.fk_soc = '.$user->socid;
+ $sql .= ' AND c.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
@@ -304,11 +304,11 @@ print '';
// Last modified contracts
$max = 5;
$sql = 'SELECT ';
-$sql .= ' sum('.$db->ifsql("cd.statut=0", 1, 0).') as nb_initial,';
-$sql .= ' sum('.$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NULL OR cd.date_fin_validite >= '".$db->idate($now)."')", 1, 0).') as nb_running,';
-$sql .= ' sum('.$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now)."')", 1, 0).') as nb_expired,';
-$sql .= ' sum('.$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now - $conf->contrat->services->expires->warning_delay)."')", 1, 0).') as nb_late,';
-$sql .= ' sum('.$db->ifsql("cd.statut=5", 1, 0).') as nb_closed,';
+$sql .= " sum(".$db->ifsql("cd.statut=0", 1, 0).') as nb_initial,';
+$sql .= " sum(".$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NULL OR cd.date_fin_validite >= '".$db->idate($now)."')", 1, 0).') as nb_running,';
+$sql .= " sum(".$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now)."')", 1, 0).') as nb_expired,';
+$sql .= " sum(".$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now - $conf->contrat->services->expires->warning_delay)."')", 1, 0).') as nb_late,';
+$sql .= " sum(".$db->ifsql("cd.statut=5", 1, 0).') as nb_closed,';
$sql .= " c.rowid as cid, c.ref, c.datec, c.tms, c.statut, s.nom as name, s.rowid as socid";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s,";
if (!$user->rights->societe->client->voir && !$socid) {
diff --git a/htdocs/contrat/list.php b/htdocs/contrat/list.php
index 596e86df53e..66d84874d76 100644
--- a/htdocs/contrat/list.php
+++ b/htdocs/contrat/list.php
@@ -236,11 +236,11 @@ $sql .= ' s.rowid as socid, s.nom as name, s.name_alias, s.email, s.town, s.zip,
$sql .= " typent.code as typent_code,";
$sql .= " state.code_departement as state_code, state.nom as state_name,";
$sql .= " MIN(".$db->ifsql("cd.statut=4", "cd.date_fin_validite", "null").") as lower_planned_end_date,";
-$sql .= ' SUM('.$db->ifsql("cd.statut=0", 1, 0).') as nb_initial,';
-$sql .= ' SUM('.$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NULL OR cd.date_fin_validite >= '".$db->idate($now)."')", 1, 0).') as nb_running,';
-$sql .= ' SUM('.$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now)."')", 1, 0).') as nb_expired,';
-$sql .= ' SUM('.$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now - $conf->contrat->services->expires->warning_delay)."')", 1, 0).') as nb_late,';
-$sql .= ' SUM('.$db->ifsql("cd.statut=5", 1, 0).') as nb_closed';
+$sql .= " SUM(".$db->ifsql("cd.statut=0", 1, 0).') as nb_initial,';
+$sql .= " SUM(".$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NULL OR cd.date_fin_validite >= '".$db->idate($now)."')", 1, 0).') as nb_running,';
+$sql .= " SUM(".$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now)."')", 1, 0).') as nb_expired,';
+$sql .= " SUM(".$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NOT NULL AND cd.date_fin_validite < '".$db->idate($now - $conf->contrat->services->expires->warning_delay)."')", 1, 0).') as nb_late,';
+$sql .= " SUM(".$db->ifsql("cd.statut=5", 1, 0).') as nb_closed';
// Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) {
diff --git a/htdocs/core/ajax/check_notifications.php b/htdocs/core/ajax/check_notifications.php
index 35d10af49b6..bbbc95a19c5 100644
--- a/htdocs/core/ajax/check_notifications.php
+++ b/htdocs/core/ajax/check_notifications.php
@@ -75,12 +75,9 @@ if ($action == 'stopreminder') {
$listofreminderid = GETPOST('listofreminderids', 'intcomma');
// Set the reminder as done
- //foreach ($listofreminderidsarray as $listofreminderid) {
- // if (empty($listofreminderid)) continue;
- //$sql = 'DELETE FROM '.MAIN_DB_PREFIX.'action_reminder WHERE rowid = '.$listofreminderid.' AND fk_user = '.$user->id;
$sql = 'UPDATE '.MAIN_DB_PREFIX.'actioncomm_reminder SET status = 1';
$sql .= ' WHERE status = 0 AND rowid IN ('.$db->sanitize($db->escape($listofreminderid)).')';
- $sql .= ' AND fk_user = '.$user->id.' AND entity = '.$conf->entity;
+ $sql .= ' AND fk_user = '.((int) $user->id).' AND entity = '.((int) $conf->entity);
$resql = $db->query($sql);
if (!$resql) {
dol_print_error($db);
@@ -149,13 +146,13 @@ if (empty($_SESSION['auto_check_events_not_before']) || $time >= $_SESSION['auto
$sql = 'SELECT a.id as id_agenda, a.code, a.datep, a.label, a.location, ar.rowid as id_reminder, ar.dateremind, ar.fk_user as id_user_reminder';
$sql .= ' FROM '.MAIN_DB_PREFIX.'actioncomm as a';
if (!empty($user->conf->MAIN_USER_WANT_ALL_EVENTS_NOTIFICATIONS)) {
- $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'actioncomm_reminder as ar ON a.id = ar.fk_actioncomm AND ar.fk_user = '.$user->id;
+ $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'actioncomm_reminder as ar ON a.id = ar.fk_actioncomm AND ar.fk_user = '.((int) $user->id);
$sql .= ' WHERE a.code <> "AC_OTH_AUTO"';
$sql .= ' AND (';
$sql .= " (ar.typeremind = 'browser' AND ar.dateremind < '".$db->idate(dol_now())."' AND ar.status = 0 AND ar.entity = ".$conf->entity;
$sql .= ' )';
} else {
- $sql .= ' JOIN '.MAIN_DB_PREFIX.'actioncomm_reminder as ar ON a.id = ar.fk_actioncomm AND ar.fk_user = '.$user->id;
+ $sql .= ' JOIN '.MAIN_DB_PREFIX.'actioncomm_reminder as ar ON a.id = ar.fk_actioncomm AND ar.fk_user = '.((int) $user->id);
$sql .= " AND ar.typeremind = 'browser' AND ar.dateremind < '".$db->idate(dol_now())."' AND ar.status = 0 AND ar.entity = ".$conf->entity;
}
$sql .= $db->order('datep', 'ASC');
diff --git a/htdocs/core/boxes/box_services_expired.php b/htdocs/core/boxes/box_services_expired.php
index 95086cdf2a3..433c566ad31 100644
--- a/htdocs/core/boxes/box_services_expired.php
+++ b/htdocs/core/boxes/box_services_expired.php
@@ -93,7 +93,7 @@ class box_services_expired extends ModeleBoxes
$sql .= " AND c.entity = ".$conf->entity;
$sql .= " AND c.fk_soc=s.rowid AND cd.fk_contrat=c.rowid AND c.statut > 0";
if ($user->socid) {
- $sql .= ' AND c.fk_soc = '.$user->socid;
+ $sql .= ' AND c.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$user->socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
diff --git a/htdocs/core/boxes/box_validated_projects.php b/htdocs/core/boxes/box_validated_projects.php
index f1fb55878aa..0c4155da6c7 100644
--- a/htdocs/core/boxes/box_validated_projects.php
+++ b/htdocs/core/boxes/box_validated_projects.php
@@ -157,7 +157,7 @@ class box_validated_projects extends ModeleBoxes
);
if ($objp->fk_soc > 0) {
- $sql = 'SELECT rowid, nom as name FROM '.MAIN_DB_PREFIX.'societe WHERE rowid ='.$objp->fk_soc;
+ $sql = 'SELECT rowid, nom as name FROM '.MAIN_DB_PREFIX.'societe WHERE rowid = '.((int) $objp->fk_soc);
$resql = $this->db->query($sql);
//$socstatic = new Societe($this->db);
$obj2 = $this->db->fetch_object($resql);
@@ -165,7 +165,7 @@ class box_validated_projects extends ModeleBoxes
'td' => 'class="tdoverflowmax150 maxwidth200onsmartphone"',
'text' => $obj2->name,
'asis' => 1,
- 'url' => DOL_URL_ROOT.'/societe/card.php?socid='.$obj2->rowid
+ 'url' => DOL_URL_ROOT.'/societe/card.php?socid='.urlencode($obj2->rowid)
);
} else {
$this->info_box_contents[$i][] = array(
diff --git a/htdocs/core/class/commoninvoice.class.php b/htdocs/core/class/commoninvoice.class.php
index 65988c9cdf0..dfabfd24ebe 100644
--- a/htdocs/core/class/commoninvoice.class.php
+++ b/htdocs/core/class/commoninvoice.class.php
@@ -132,7 +132,7 @@ abstract class CommonInvoice extends CommonObject
$sql = 'SELECT sum(amount) as amount, sum(multicurrency_amount) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.((int) $this->id);
+ $sql .= " WHERE ".$field." = ".((int) $this->id);
dol_syslog(get_class($this)."::getSommePaiement", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -308,9 +308,8 @@ abstract class CommonInvoice extends CommonObject
$sql = 'SELECT p.ref, pf.amount, pf.multicurrency_amount, p.fk_paiement, p.datep, p.num_paiement as num, t.code'.$field3;
$sql .= ' FROM '.MAIN_DB_PREFIX.$table.' as pf, '.MAIN_DB_PREFIX.$table2.' as p, '.MAIN_DB_PREFIX.'c_paiement as t';
- $sql .= ' WHERE pf.'.$field.' = '.((int) $this->id);
- //$sql.= ' WHERE pf.'.$field.' = 1';
- $sql .= ' AND pf.'.$field2.' = p.rowid';
+ $sql .= " WHERE pf.".$field." = ".((int) $this->id);
+ $sql .= " AND pf.".$field2." = p.rowid";
$sql .= ' AND p.fk_paiement = t.id';
$sql .= ' AND p.entity IN ('.getEntity($sharedentity).')';
if ($filtertype) {
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index a4a98da9690..fce86b080bd 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -2054,7 +2054,7 @@ abstract class CommonObject
}
if (isset($this->ismultientitymanaged) && !is_numeric($this->ismultientitymanaged)) {
$tmparray = explode('@', $this->ismultientitymanaged);
- $sql .= ' AND te.'.$tmparray[0].' = '.($tmparray[1] == 'societe' ? 's' : 'parenttable').'.rowid'; // If we need to link to this table to limit select to entity
+ $sql .= " AND te.".$tmparray[0]." = ".($tmparray[1] == "societe" ? "s" : "parenttable").".rowid"; // If we need to link to this table to limit select to entity
} elseif ($restrictiononfksoc == 1 && $this->element != 'societe' && !$user->rights->societe->client->voir && !$socid) {
$sql .= ' AND te.fk_soc = s.rowid'; // If we need to link to societe to limit select to socid
}
@@ -2075,13 +2075,13 @@ abstract class CommonObject
$sql .= ' AND parenttable.entity IN ('.getEntity($tmparray[1]).')';
}
if ($restrictiononfksoc == 1 && $socid && $this->element != 'societe') {
- $sql .= ' AND te.fk_soc = '.$socid;
+ $sql .= ' AND te.fk_soc = '.((int) $socid);
}
if ($restrictiononfksoc == 2 && $socid && $this->element != 'societe') {
- $sql .= ' AND (te.fk_soc = '.$socid.' OR te.fk_soc IS NULL)';
+ $sql .= ' AND (te.fk_soc = '.((int) $socid).' OR te.fk_soc IS NULL)';
}
if ($restrictiononfksoc && $socid && $this->element == 'societe') {
- $sql .= ' AND te.rowid = '.$socid;
+ $sql .= ' AND te.rowid = '.((int) $socid);
}
//print 'socid='.$socid.' restrictiononfksoc='.$restrictiononfksoc.' ismultientitymanaged = '.$this->ismultientitymanaged.' filter = '.$filter.' -> '.$sql." ";
@@ -2124,7 +2124,7 @@ abstract class CommonObject
}
if (isset($this->ismultientitymanaged) && !is_numeric($this->ismultientitymanaged)) {
$tmparray = explode('@', $this->ismultientitymanaged);
- $sql .= ' AND te.'.$tmparray[0].' = '.($tmparray[1] == 'societe' ? 's' : 'parenttable').'.rowid'; // If we need to link to this table to limit select to entity
+ $sql .= " AND te.".$tmparray[0]." = ".($tmparray[1] == "societe" ? "s" : "parenttable").".rowid"; // If we need to link to this table to limit select to entity
} elseif ($restrictiononfksoc == 1 && $this->element != 'societe' && !$user->rights->societe->client->voir && !$socid) {
$sql .= ' AND te.fk_soc = s.rowid'; // If we need to link to societe to limit select to socid
}
@@ -2145,13 +2145,13 @@ abstract class CommonObject
$sql .= ' AND parenttable.entity IN ('.getEntity($tmparray[1]).')';
}
if ($restrictiononfksoc == 1 && $socid && $this->element != 'societe') {
- $sql .= ' AND te.fk_soc = '.$socid;
+ $sql .= ' AND te.fk_soc = '.((int) $socid);
}
if ($restrictiononfksoc == 2 && $socid && $this->element != 'societe') {
- $sql .= ' AND (te.fk_soc = '.$socid.' OR te.fk_soc IS NULL)';
+ $sql .= ' AND (te.fk_soc = '.((int) $socid).' OR te.fk_soc IS NULL)';
}
if ($restrictiononfksoc && $socid && $this->element == 'societe') {
- $sql .= ' AND te.rowid = '.$socid;
+ $sql .= ' AND te.rowid = '.((int) $socid);
}
//print 'socid='.$socid.' restrictiononfksoc='.$restrictiononfksoc.' ismultientitymanaged = '.$this->ismultientitymanaged.' filter = '.$filter.' -> '.$sql." ";
// Rem: Bug in some mysql version: SELECT MIN(rowid) FROM llx_socpeople WHERE rowid > 1 when one row in database with rowid=1, returns 1 instead of null
@@ -2206,19 +2206,19 @@ abstract class CommonObject
return -1;
}
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
if (!empty($this->fields['fk_project'])) { // Common case
if ($projectid) {
- $sql .= ' SET fk_project = '.((int) $projectid);
+ $sql .= " SET fk_project = ".((int) $projectid);
} else {
- $sql .= ' SET fk_project = NULL';
+ $sql .= " SET fk_project = NULL";
}
$sql .= ' WHERE rowid = '.((int) $this->id);
} elseif ($this->table_element == 'actioncomm') { // Special case for actioncomm
if ($projectid) {
- $sql .= ' SET fk_project = '.((int) $projectid);
+ $sql .= " SET fk_project = ".((int) $projectid);
} else {
- $sql .= ' SET fk_project = NULL';
+ $sql .= " SET fk_project = NULL";
}
$sql .= ' WHERE id = '.((int) $this->id);
} else // Special case for old architecture objects
@@ -2266,8 +2266,8 @@ abstract class CommonObject
$fieldname = 'fk_typepayment';
}
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname.' = '.(($id > 0 || $id == '0') ? $id : 'NULL');
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
+ $sql .= " SET ".$fieldname." = ".(($id > 0 || $id == '0') ? ((int) $id) : 'NULL');
$sql .= ' WHERE rowid='.((int) $this->id);
if ($this->db->query($sql)) {
@@ -2278,7 +2278,7 @@ abstract class CommonObject
}
return 1;
} else {
- dol_syslog(get_class($this).'::setPaymentMethods Error '.$sql.' - '.$this->db->error());
+ dol_syslog(get_class($this).'::setPaymentMethods Error '.$this->db->error());
$this->error = $this->db->error();
return -1;
}
@@ -2302,7 +2302,7 @@ abstract class CommonObject
$fieldname = 'multicurrency_code';
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname." = '".$this->db->escape($code)."'";
+ $sql .= " SET ".$fieldname." = '".$this->db->escape($code)."'";
$sql .= ' WHERE rowid='.((int) $this->id);
if ($this->db->query($sql)) {
@@ -2340,7 +2340,7 @@ abstract class CommonObject
$fieldname = 'multicurrency_tx';
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname.' = '.((float) $rate);
+ $sql .= " SET ".$fieldname." = ".((float) $rate);
$sql .= ' WHERE rowid='.((int) $this->id);
if ($this->db->query($sql)) {
@@ -2548,7 +2548,7 @@ abstract class CommonObject
}
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname.' = '.(($id > 0 || $id == '0') ? $id : 'NULL');
+ $sql .= " SET ".$fieldname." = ".(($id > 0 || $id == '0') ? ((int) $id) : 'NULL');
$sql .= ' WHERE rowid='.((int) $this->id);
if ($this->db->query($sql)) {
@@ -2590,7 +2590,7 @@ abstract class CommonObject
}
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname.' = '.(($id > 0 || $id == '0') ? $id : 'NULL');
+ $sql .= " SET ".$fieldname." = ".(($id > 0 || $id == '0') ? ((int) $id) : 'NULL');
$sql .= ' WHERE rowid='.((int) $this->id);
if ($this->db->query($sql)) {
@@ -2625,7 +2625,7 @@ abstract class CommonObject
$fieldname = 'retained_warranty_fk_cond_reglement';
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' SET '.$fieldname.' = '.((int) $id);
+ $sql .= " SET ".$fieldname." = ".((int) $id);
$sql .= ' WHERE rowid='.((int) $this->id);
if ($this->db->query($sql)) {
@@ -2665,7 +2665,7 @@ abstract class CommonObject
return 1;
} else {
$this->error = $this->db->error();
- dol_syslog(get_class($this).'::setDeliveryAddress Error '.$sql.' - '.$this->error);
+ dol_syslog(get_class($this).'::setDeliveryAddress Error '.$this->error);
return -1;
}
}
@@ -2884,7 +2884,7 @@ abstract class CommonObject
// Count number of lines to reorder (according to choice $renum)
$nl = 0;
$sql = 'SELECT count(rowid) FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.'='.((int) $this->id);
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
if (!$renum) {
$sql .= ' AND rang = 0';
}
@@ -2906,7 +2906,7 @@ abstract class CommonObject
// We first search all lines that are parent lines (for multilevel details lines)
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
if ($fk_parent_line) {
$sql .= ' AND fk_parent_line IS NULL';
}
@@ -2954,7 +2954,7 @@ abstract class CommonObject
$rows = array();
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
$sql .= ' AND fk_parent_line = '.((int) $id);
$sql .= ' ORDER BY rang ASC';
@@ -3031,7 +3031,7 @@ abstract class CommonObject
$fieldposition = 'position';
}
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) $rang);
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldposition." = ".((int) $rang);
$sql .= ' WHERE rowid = '.((int) $rowid);
dol_syslog(get_class($this)."::updateRangOfLine", LOG_DEBUG);
@@ -3074,11 +3074,11 @@ abstract class CommonObject
$fieldposition = 'position';
}
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) $rang);
- $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldposition." = ".((int) $rang);
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
$sql .= ' AND rang = '.((int) ($rang - 1));
if ($this->db->query($sql)) {
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) ($rang - 1));
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldposition." = ".((int) ($rang - 1));
$sql .= ' WHERE rowid = '.((int) $rowid);
if (!$this->db->query($sql)) {
dol_print_error($this->db);
@@ -3105,11 +3105,11 @@ abstract class CommonObject
$fieldposition = 'position';
}
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) $rang);
- $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldposition." = ".((int) $rang);
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
$sql .= ' AND rang = '.((int) ($rang + 1));
if ($this->db->query($sql)) {
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) ($rang + 1));
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element_line." SET ".$fieldposition." = ".((int) ($rang + 1));
$sql .= ' WHERE rowid = '.((int) $rowid);
if (!$this->db->query($sql)) {
dol_print_error($this->db);
@@ -3148,7 +3148,7 @@ abstract class CommonObject
public function getIdOfLine($rang)
{
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
$sql .= ' AND rang = '.((int) $rang);
$resql = $this->db->query($sql);
if ($resql) {
@@ -3174,8 +3174,8 @@ abstract class CommonObject
// Search the last rang with fk_parent_line
if ($fk_parent_line) {
- $sql = 'SELECT max('.$positionfield.') FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql = "SELECT max(".$positionfield.") FROM ".MAIN_DB_PREFIX.$this->table_element_line;
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
$sql .= ' AND fk_parent_line = '.((int) $fk_parent_line);
dol_syslog(get_class($this)."::line_max", LOG_DEBUG);
@@ -3190,8 +3190,8 @@ abstract class CommonObject
}
} else {
// If not, search the last rang of element
- $sql = 'SELECT max('.$positionfield.') FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.$this->id;
+ $sql = "SELECT max(".$positionfield.") FROM ".MAIN_DB_PREFIX.$this->table_element_line;
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
dol_syslog(get_class($this)."::line_max", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -3217,7 +3217,7 @@ abstract class CommonObject
return -1;
}
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET ref_ext = '".$this->db->escape($ref_ext)."'";
$sql .= " WHERE ".(isset($this->table_rowid) ? $this->table_rowid : 'rowid')." = ".((int) $this->id);
@@ -3268,7 +3268,7 @@ abstract class CommonObject
} else {
$fieldusermod = "fk_user_modif";
}
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element;
$sql .= " SET note".$newsuffix." = ".(!empty($note) ? ("'".$this->db->escape($note)."'") : "NULL");
$sql .= ", ".$fieldusermod." = ".((int) $user->id);
$sql .= " WHERE rowid = ".((int) $this->id);
@@ -3386,21 +3386,21 @@ abstract class CommonObject
$fieldup = 'value_unit';
}
- $sql = 'SELECT rowid, qty, '.$fieldup.' as up, remise_percent, total_ht, '.$fieldtva.' as total_tva, total_ttc, '.$fieldlocaltax1.' as total_localtax1, '.$fieldlocaltax2.' as total_localtax2,';
+ $sql = "SELECT rowid, qty, ".$fieldup." as up, remise_percent, total_ht, ".$fieldtva." as total_tva, total_ttc, ".$fieldlocaltax1." as total_localtax1, ".$fieldlocaltax2." as total_localtax2,";
$sql .= ' tva_tx as vatrate, localtax1_tx, localtax2_tx, localtax1_type, localtax2_type, info_bits, product_type';
if ($this->table_element_line == 'facturedet') {
$sql .= ', situation_percent';
}
$sql .= ', multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line;
- $sql .= ' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql .= " WHERE ".$this->fk_element." = ".((int) $this->id);
if ($exclspec) {
$product_field = 'product_type';
if ($this->table_element_line == 'contratdet') {
$product_field = ''; // contratdet table has no product_type field
}
if ($product_field) {
- $sql .= ' AND '.$product_field.' <> 9';
+ $sql .= " AND ".$product_field." <> 9";
}
}
$sql .= ' ORDER by rowid'; // We want to be sure to always use same order of line to not change lines differently when option MAIN_ROUNDOFTOTAL_NOT_TOTALOFROUND is used
@@ -3553,14 +3553,14 @@ abstract class CommonObject
if (empty($nodatabaseupdate)) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element.' SET';
- $sql .= " ".$fieldht." = ".price2num($this->total_ht).",";
- $sql .= " ".$fieldtva." = ".price2num($this->total_tva).",";
- $sql .= " ".$fieldlocaltax1." = ".price2num($this->total_localtax1).",";
- $sql .= " ".$fieldlocaltax2." = ".price2num($this->total_localtax2).",";
- $sql .= " ".$fieldttc." = ".price2num($this->total_ttc);
- $sql .= ", multicurrency_total_ht = ".price2num($this->multicurrency_total_ht, 'MT', 1);
- $sql .= ", multicurrency_total_tva = ".price2num($this->multicurrency_total_tva, 'MT', 1);
- $sql .= ", multicurrency_total_ttc = ".price2num($this->multicurrency_total_ttc, 'MT', 1);
+ $sql .= " ".$fieldht." = ".((float) price2num($this->total_ht)).",";
+ $sql .= " ".$fieldtva." = ".((float) price2num($this->total_tva)).",";
+ $sql .= " ".$fieldlocaltax1." = ".((float) price2num($this->total_localtax1)).",";
+ $sql .= " ".$fieldlocaltax2." = ".((float) price2num($this->total_localtax2)).",";
+ $sql .= " ".$fieldttc." = ".((float) price2num($this->total_ttc));
+ $sql .= ", multicurrency_total_ht = ".((float) price2num($this->multicurrency_total_ht, 'MT', 1));
+ $sql .= ", multicurrency_total_tva = ".((float) price2num($this->multicurrency_total_tva, 'MT', 1));
+ $sql .= ", multicurrency_total_ttc = ".((float) price2num($this->multicurrency_total_ttc, 'MT', 1));
$sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update_price", LOG_DEBUG);
@@ -4038,7 +4038,7 @@ abstract class CommonObject
global $db;
- $sql = 'SELECT '.$field_select.' FROM '.MAIN_DB_PREFIX.$table_element.' WHERE '.$field_where.' = '.((int) $fk_object_where);
+ $sql = "SELECT ".$field_select." FROM ".MAIN_DB_PREFIX.$table_element." WHERE ".$field_where." = ".((int) $fk_object_where);
$resql = $db->query($sql);
$TRes = array();
@@ -4067,7 +4067,7 @@ abstract class CommonObject
global $db;
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$table_element.' WHERE '.$field_where.' = '.((int) $fk_object_where);
+ $sql = "DELETE FROM ".MAIN_DB_PREFIX.$table_element." WHERE ".$field_where." = ".((int) $fk_object_where);
$resql = $db->query($sql);
if (empty($resql)) {
@@ -5317,7 +5317,7 @@ abstract class CommonObject
$update_main_doc_field = 1;
}
if ($update_main_doc_field && !empty($this->table_element)) {
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element." SET last_main_doc = '".$this->db->escape($ecmfile->filepath.'/'.$ecmfile->filename)."'";
+ $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET last_main_doc = '".$this->db->escape($ecmfile->filepath."/".$ecmfile->filename)."'";
$sql .= " WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
@@ -6677,17 +6677,17 @@ abstract class CommonObject
//We have to join on extrafield table
if (strpos($InfoFieldList[4], 'extra') !== false) {
- $sql .= ' as main, '.MAIN_DB_PREFIX.$InfoFieldList[0].'_extrafields as extra';
- $sqlwhere .= ' WHERE extra.fk_object=main.'.$InfoFieldList[2].' AND '.$InfoFieldList[4];
+ $sql .= " as main, ".MAIN_DB_PREFIX.$InfoFieldList[0]."_extrafields as extra";
+ $sqlwhere .= " WHERE extra.fk_object=main.".$InfoFieldList[2]." AND ".$InfoFieldList[4];
} else {
- $sqlwhere .= ' WHERE '.$InfoFieldList[4];
+ $sqlwhere .= " WHERE ".$InfoFieldList[4];
}
} else {
$sqlwhere .= ' WHERE 1=1';
}
// Some tables may have field, some other not. For the moment we disable it.
if (in_array($InfoFieldList[0], array('tablewithentity'))) {
- $sqlwhere .= ' AND entity = '.$conf->entity;
+ $sqlwhere .= " AND entity = ".((int) $conf->entity);
}
$sql .= $sqlwhere;
//print $sql;
@@ -6830,16 +6830,16 @@ abstract class CommonObject
// We have to join on extrafield table
if (strpos($InfoFieldList[4], 'extra') !== false) {
$sql .= ' as main, '.MAIN_DB_PREFIX.$InfoFieldList[0].'_extrafields as extra';
- $sqlwhere .= ' WHERE extra.fk_object=main.'.$InfoFieldList[2].' AND '.$InfoFieldList[4];
+ $sqlwhere .= " WHERE extra.fk_object=main.".$InfoFieldList[2]." AND ".$InfoFieldList[4];
} else {
- $sqlwhere .= ' WHERE '.$InfoFieldList[4];
+ $sqlwhere .= " WHERE ".$InfoFieldList[4];
}
} else {
$sqlwhere .= ' WHERE 1=1';
}
// Some tables may have field, some other not. For the moment we disable it.
if (in_array($InfoFieldList[0], array('tablewithentity'))) {
- $sqlwhere .= ' AND entity = '.$conf->entity;
+ $sqlwhere .= " AND entity = ".((int) $conf->entity);
}
// $sql.=preg_replace('/^ AND /','',$sqlwhere);
// print $sql;
@@ -8770,8 +8770,8 @@ abstract class CommonObject
return 0;
}
- $sql = 'SELECT '.$fieldlist;
- $sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
+ $sql = "SELECT ".$fieldlist;
+ $sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element.' as t';
if (!empty($id)) {
$sql .= ' WHERE t.rowid = '.((int) $id);
@@ -8825,9 +8825,9 @@ abstract class CommonObject
$objectline = new $objectlineclassname($this->db);
- $sql = 'SELECT '.$objectline->getFieldList('l');
- $sql .= ' FROM '.MAIN_DB_PREFIX.$objectline->table_element.' as l';
- $sql .= ' WHERE l.fk_'.$this->element.' = '.((int) $this->id);
+ $sql = "SELECT ".$objectline->getFieldList('l');
+ $sql .= " FROM ".MAIN_DB_PREFIX.$objectline->table_element." as l";
+ $sql .= " WHERE l.fk_".$this->element." = ".((int) $this->id);
if ($morewhere) {
$sql .= $morewhere;
}
@@ -8973,7 +8973,7 @@ abstract class CommonObject
if ($forcechilddeletion) { // Force also delete of childtables that should lock deletion in standard case when option force is off
foreach ($this->childtables as $table) {
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$table.' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql = "DELETE FROM ".MAIN_DB_PREFIX.$table." WHERE ".$this->fk_element." = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
@@ -9022,7 +9022,7 @@ abstract class CommonObject
}
} else {
// Delete record in child table
- $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$table.' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql = "DELETE FROM ".MAIN_DB_PREFIX.$table." WHERE ".$this->fk_element." = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -9100,7 +9100,7 @@ abstract class CommonObject
$this->db->begin();
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX.$this->table_element;
- $sql .= ' WHERE '.$parentField.' = '.(int) $parentId;
+ $sql .= " WHERE ".$parentField." = ".(int) $parentId;
$resql = $this->db->query($sql);
if (!$resql) {
@@ -9533,7 +9533,7 @@ abstract class CommonObject
// Delete in database with mode 1
if ($mode == 1) {
$sql = 'DELETE FROM '.MAIN_DB_PREFIX."ecm_files_extrafields";
- $sql .= " WHERE fk_object IN (SELECT rowid FROM ".MAIN_DB_PREFIX."ecm_files WHERE src_object_type = '".$this->db->escape($this->table_element.(empty($this->module) ? '' : '@'.$this->module))."' AND src_object_id = ".((int) $this->id).")";
+ $sql .= " WHERE fk_object IN (SELECT rowid FROM ".MAIN_DB_PREFIX."ecm_files WHERE src_object_type = '".$this->db->escape($this->table_element.(empty($this->module) ? "" : "@".$this->module))."' AND src_object_id = ".((int) $this->id).")";
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
@@ -9542,7 +9542,7 @@ abstract class CommonObject
}
$sql = 'DELETE FROM '.MAIN_DB_PREFIX."ecm_files";
- $sql .= " WHERE src_object_type = '".$this->db->escape($this->table_element.(empty($this->module) ? '' : '@'.$this->module))."' AND src_object_id = ".((int) $this->id);
+ $sql .= " WHERE src_object_type = '".$this->db->escape($this->table_element.(empty($this->module) ? "" : "@".$this->module))."' AND src_object_id = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
diff --git a/htdocs/core/class/commonobjectline.class.php b/htdocs/core/class/commonobjectline.class.php
index f821e5050b1..6d5573b9d76 100644
--- a/htdocs/core/class/commonobjectline.class.php
+++ b/htdocs/core/class/commonobjectline.class.php
@@ -86,7 +86,7 @@ abstract class CommonObjectLine extends CommonObject
$label_type = 'code';
}
- $sql = 'select '.$label_type.', code from '.MAIN_DB_PREFIX.'c_units where rowid='.$this->fk_unit;
+ $sql = "SELECT ".$label_type.", code from ".MAIN_DB_PREFIX."c_units where rowid = ".((int) $this->fk_unit);
$resql = $this->db->query($sql);
if ($resql && $this->db->num_rows($resql) > 0) {
$res = $this->db->fetch_array($resql);
@@ -98,7 +98,7 @@ abstract class CommonObjectLine extends CommonObject
$this->db->free($resql);
return $label;
} else {
- $this->error = $this->db->error().' sql='.$sql;
+ $this->error = $this->db->lasterror();
dol_syslog(get_class($this)."::getLabelOfUnit Error ".$this->error, LOG_ERR);
return -1;
}
diff --git a/htdocs/core/class/coreobject.class.php b/htdocs/core/class/coreobject.class.php
index 150ace90875..33510186646 100644
--- a/htdocs/core/class/coreobject.class.php
+++ b/htdocs/core/class/coreobject.class.php
@@ -183,7 +183,7 @@ class CoreObject extends CommonObject
$this->{$className} = array();
- $sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.$childTable.' WHERE '.$this->fk_element.' = '.((int) $this->id);
+ $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX.$childTable." WHERE ".$this->fk_element." = ".((int) $this->id);
$res = $this->db->query($sql);
if ($res) {
diff --git a/htdocs/core/class/discount.class.php b/htdocs/core/class/discount.class.php
index 07c6a509815..46789352bd7 100644
--- a/htdocs/core/class/discount.class.php
+++ b/htdocs/core/class/discount.class.php
@@ -516,10 +516,10 @@ class DiscountAbsolute
$sql .= " AND rc.fk_user = ".((int) $user->id);
}
if ($filter) {
- $sql .= ' AND ('.$filter.')';
+ $sql .= " AND (".$filter.")";
}
if ($maxvalue) {
- $sql .= ' AND rc.amount_ttc <= '.price2num($maxvalue);
+ $sql .= ' AND rc.amount_ttc <= '.((float) price2num($maxvalue));
}
$resql = $this->db->query($sql);
@@ -555,12 +555,12 @@ class DiscountAbsolute
if ($invoice->element == 'facture' || $invoice->element == 'invoice') {
$sql = 'SELECT sum(rc.amount_ttc) as amount, sum(rc.multicurrency_amount_ttc) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc, '.MAIN_DB_PREFIX.'facture as f';
- $sql .= ' WHERE rc.fk_facture_source=f.rowid AND rc.fk_facture = '.$invoice->id;
+ $sql .= ' WHERE rc.fk_facture_source=f.rowid AND rc.fk_facture = '.((int) $invoice->id);
$sql .= ' AND f.type = 3';
} elseif ($invoice->element == 'invoice_supplier') {
$sql = 'SELECT sum(rc.amount_ttc) as amount, sum(rc.multicurrency_amount_ttc) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc, '.MAIN_DB_PREFIX.'facture_fourn as f';
- $sql .= ' WHERE rc.fk_invoice_supplier_source=f.rowid AND rc.fk_invoice_supplier = '.$invoice->id;
+ $sql .= ' WHERE rc.fk_invoice_supplier_source=f.rowid AND rc.fk_invoice_supplier = '.((int) $invoice->id);
$sql .= ' AND f.type = 3';
} else {
$this->error = get_class($this)."::getSumDepositsUsed was called with a bad object as a first parameter";
@@ -596,13 +596,13 @@ class DiscountAbsolute
if ($invoice->element == 'facture' || $invoice->element == 'invoice') {
$sql = 'SELECT sum(rc.amount_ttc) as amount, sum(rc.multicurrency_amount_ttc) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc, '.MAIN_DB_PREFIX.'facture as f';
- $sql .= ' WHERE rc.fk_facture_source=f.rowid AND rc.fk_facture = '.$invoice->id;
- $sql .= ' AND f.type IN ('.$this->db->sanitize($invoice::TYPE_STANDARD.', '.$invoice::TYPE_CREDIT_NOTE.', '.$invoice::TYPE_SITUATION).')'; // Find discount coming from credit note or excess received
+ $sql .= ' WHERE rc.fk_facture_source=f.rowid AND rc.fk_facture = '.((int) $invoice->id);
+ $sql .= " AND f.type IN (".$this->db->sanitize($invoice::TYPE_STANDARD.", ".$invoice::TYPE_CREDIT_NOTE.", ".$invoice::TYPE_SITUATION).')'; // Find discount coming from credit note or excess received
} elseif ($invoice->element == 'invoice_supplier') {
$sql = 'SELECT sum(rc.amount_ttc) as amount, sum(rc.multicurrency_amount_ttc) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc, '.MAIN_DB_PREFIX.'facture_fourn as f';
- $sql .= ' WHERE rc.fk_invoice_supplier_source=f.rowid AND rc.fk_invoice_supplier = '.$invoice->id;
- $sql .= ' AND f.type IN ('.$this->db->sanitize($invoice::TYPE_STANDARD.', '.$invoice::TYPE_CREDIT_NOTE).')'; // Find discount coming from credit note or excess paid
+ $sql .= ' WHERE rc.fk_invoice_supplier_source=f.rowid AND rc.fk_invoice_supplier = '.((int) $invoice->id);
+ $sql .= " AND f.type IN (".$this->db->sanitize($invoice::TYPE_STANDARD.", ".$invoice::TYPE_CREDIT_NOTE).')'; // Find discount coming from credit note or excess paid
} else {
$this->error = get_class($this)."::getSumCreditNotesUsed was called with a bad object as a first parameter";
dol_print_error($this->error);
@@ -636,11 +636,11 @@ class DiscountAbsolute
if ($invoice->element == 'facture' || $invoice->element == 'invoice') {
$sql = 'SELECT sum(rc.amount_ttc) as amount, sum(rc.multicurrency_amount_ttc) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc';
- $sql .= ' WHERE rc.fk_facture IS NULL AND rc.fk_facture_source = '.$invoice->id;
+ $sql .= ' WHERE rc.fk_facture IS NULL AND rc.fk_facture_source = '.((int) $invoice->id);
} elseif ($invoice->element == 'invoice_supplier') {
$sql = 'SELECT sum(rc.amount_ttc) as amount, sum(rc.multicurrency_amount_ttc) as multicurrency_amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe_remise_except as rc';
- $sql .= ' WHERE rc.fk_invoice_supplier IS NULL AND rc.fk_invoice_supplier_source = '.$invoice->id;
+ $sql .= ' WHERE rc.fk_invoice_supplier IS NULL AND rc.fk_invoice_supplier_source = '.((int) $invoice->id);
} else {
$this->error = get_class($this)."::getSumCreditNotesUsed was called with a bad object as a first parameter";
dol_print_error($this->error);
diff --git a/htdocs/core/class/dolreceiptprinter.class.php b/htdocs/core/class/dolreceiptprinter.class.php
index a3ddb3d7c7f..9813876c031 100644
--- a/htdocs/core/class/dolreceiptprinter.class.php
+++ b/htdocs/core/class/dolreceiptprinter.class.php
@@ -867,7 +867,7 @@ class dolReceiptPrinter extends Printer
$error = 0;
$sql = 'SELECT template';
$sql .= ' FROM '.MAIN_DB_PREFIX.'printer_receipt_template';
- $sql .= ' WHERE rowid='.$templateid;
+ $sql .= ' WHERE rowid = '.((int) $templateid);
$sql .= ' AND entity = '.$conf->entity;
$resql = $this->db->query($sql);
if ($resql) {
@@ -905,7 +905,7 @@ class dolReceiptPrinter extends Printer
$sql = 'SELECT rowid, name, fk_type, fk_profile, parameter';
$sql .= ' FROM '.MAIN_DB_PREFIX.'printer_receipt';
$sql .= ' WHERE rowid = '.((int) $printerid);
- $sql .= ' AND entity = '.$conf->entity;
+ $sql .= ' AND entity = '.((int) $conf->entity);
$resql = $this->db->query($sql);
if ($resql) {
$obj = $this->db->fetch_array($resql);
diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index f6a5ba93d61..4e4a199600f 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -1273,16 +1273,16 @@ class ExtraFields
//We have to join on extrafield table
if (strpos($InfoFieldList[4], 'extra') !== false) {
$sql .= ' as main, '.MAIN_DB_PREFIX.$InfoFieldList[0].'_extrafields as extra';
- $sqlwhere .= ' WHERE extra.fk_object=main.'.$InfoFieldList[2].' AND '.$InfoFieldList[4];
+ $sqlwhere .= " WHERE extra.fk_object=main.".$InfoFieldList[2]." AND ".$InfoFieldList[4];
} else {
- $sqlwhere .= ' WHERE '.$InfoFieldList[4];
+ $sqlwhere .= " WHERE ".$InfoFieldList[4];
}
} else {
$sqlwhere .= ' WHERE 1=1';
}
// Some tables may have field, some other not. For the moment we disable it.
if (in_array($InfoFieldList[0], array('tablewithentity'))) {
- $sqlwhere .= ' AND entity = '.$conf->entity;
+ $sqlwhere .= ' AND entity = '.((int) $conf->entity);
}
$sql .= $sqlwhere;
//print $sql;
@@ -1485,16 +1485,16 @@ class ExtraFields
// We have to join on extrafield table
if (strpos($InfoFieldList[4], 'extra.') !== false) {
$sql .= ' as main, '.MAIN_DB_PREFIX.$InfoFieldList[0].'_extrafields as extra';
- $sqlwhere .= ' WHERE extra.fk_object=main.'.$InfoFieldList[2].' AND '.$InfoFieldList[4];
+ $sqlwhere .= " WHERE extra.fk_object=main.".$InfoFieldList[2]." AND ".$InfoFieldList[4];
} else {
- $sqlwhere .= ' WHERE '.$InfoFieldList[4];
+ $sqlwhere .= " WHERE ".$InfoFieldList[4];
}
} else {
$sqlwhere .= ' WHERE 1=1';
}
// Some tables may have field, some other not. For the moment we disable it.
if (in_array($InfoFieldList[0], array('tablewithentity'))) {
- $sqlwhere .= ' AND entity = '.$conf->entity;
+ $sqlwhere .= " AND entity = ".((int) $conf->entity);
}
// $sql.=preg_replace('/^ AND /','',$sqlwhere);
// print $sql;
diff --git a/htdocs/core/class/hookmanager.class.php b/htdocs/core/class/hookmanager.class.php
index 345de3f5be5..d243e67697b 100644
--- a/htdocs/core/class/hookmanager.class.php
+++ b/htdocs/core/class/hookmanager.class.php
@@ -172,6 +172,7 @@ class HookManager
'addSearchEntry',
'addStatisticLine',
'addSectionECMAuto',
+ 'checkSecureAccess',
'createDictionaryFieldlist',
'editDictionaryFieldlist',
'getFormMail',
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 8f3c92a3c43..74f6ed83ee2 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -2565,7 +2565,7 @@ class Form
$sql .= ')';
}
if (count($warehouseStatusArray)) {
- $sql .= ' GROUP BY'.$selectFields;
+ $sql .= " GROUP BY ".$selectFields;
}
//Sort by category
@@ -6988,7 +6988,7 @@ class Form
if (isset($objecttmp->ismultientitymanaged)) {
if (!is_numeric($objecttmp->ismultientitymanaged)) {
$tmparray = explode('@', $objecttmp->ismultientitymanaged);
- $sql .= ' INNER JOIN '.MAIN_DB_PREFIX.$tmparray[1].' as parenttable ON parenttable.rowid = t.'.$tmparray[0];
+ $sql .= " INNER JOIN ".MAIN_DB_PREFIX.$tmparray[1]." as parenttable ON parenttable.rowid = t.".$tmparray[0];
}
if ($objecttmp->ismultientitymanaged == 'fk_soc@societe') {
if (!$user->rights->societe->client->voir && !$user->socid) {
@@ -7009,7 +7009,7 @@ class Form
$sql .= " AND t.entity IN (".getEntity($objecttmp->table_element).")";
}
if (!is_numeric($objecttmp->ismultientitymanaged)) {
- $sql .= ' AND parenttable.entity = t.'.$tmparray[0];
+ $sql .= " AND parenttable.entity = t.".$tmparray[0];
}
if ($objecttmp->ismultientitymanaged == 1 && !empty($user->socid)) {
if ($objecttmp->element == 'societe') {
diff --git a/htdocs/core/class/html.formmail.class.php b/htdocs/core/class/html.formmail.class.php
index 3dc2743adf1..f5b13671a44 100644
--- a/htdocs/core/class/html.formmail.class.php
+++ b/htdocs/core/class/html.formmail.class.php
@@ -601,7 +601,7 @@ class FormMail extends Form
// Add also email aliases from the c_email_senderprofile table
$sql = 'SELECT rowid, label, email FROM '.MAIN_DB_PREFIX.'c_email_senderprofile';
- $sql .= ' WHERE active = 1 AND (private = 0 OR private = '.$user->id.')';
+ $sql .= ' WHERE active = 1 AND (private = 0 OR private = '.((int) $user->id).')';
$sql .= ' ORDER BY position';
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/core/class/utils.class.php b/htdocs/core/class/utils.class.php
index 5371d917022..fd89a00a810 100644
--- a/htdocs/core/class/utils.class.php
+++ b/htdocs/core/class/utils.class.php
@@ -1088,11 +1088,11 @@ class Utils
fwrite($handle, "/*!40000 ALTER TABLE `".$table."` DISABLE KEYS */;\n");
}
- $sql = 'SELECT * FROM '.$table; // Here SELECT * is allowed because we don't have definition of columns to take
+ $sql = "SELECT * FROM ".$table; // Here SELECT * is allowed because we don't have definition of columns to take
$result = $db->query($sql);
while ($row = $db->fetch_row($result)) {
// For each row of data we print a line of INSERT
- fwrite($handle, 'INSERT '.$delayed.$ignore.'INTO `'.$table.'` VALUES (');
+ fwrite($handle, "INSERT ".$delayed.$ignore."INTO ".$table." VALUES (");
$columns = count($row);
for ($j = 0; $j < $columns; $j++) {
// Processing each columns of the row to ensure that we correctly save the value (eg: add quotes for string - in fact we add quotes for everything, it's easier)
diff --git a/htdocs/core/class/validate.class.php b/htdocs/core/class/validate.class.php
index 1738034545d..61b8931179e 100644
--- a/htdocs/core/class/validate.class.php
+++ b/htdocs/core/class/validate.class.php
@@ -263,7 +263,7 @@ class Validate
}
foreach ($value_arr as $val) {
- $sql = 'SELECT ' . $col . ' FROM ' . MAIN_DB_PREFIX . $table . " WHERE " . $col ." = '" . $this->db->escape($val) . "'"; // nore quick than count(*) to check existing of a row
+ $sql = "SELECT ".$col." FROM ".MAIN_DB_PREFIX.$table." WHERE ".$col." = '".$this->db->escape($val)."'"; // nore quick than count(*) to check existing of a row
$resql = $this->db->getRow($sql);
if ($resql) {
continue;
diff --git a/htdocs/core/customreports.php b/htdocs/core/customreports.php
index ca6e61e3b1c..3693b52cc74 100644
--- a/htdocs/core/customreports.php
+++ b/htdocs/core/customreports.php
@@ -239,13 +239,14 @@ if (is_array($search_groupby) && count($search_groupby)) {
$fieldtocount = $search_groupby[$gkey];
}
- $sql = 'SELECT DISTINCT '.$fieldtocount.' as val';
+ $sql = "SELECT DISTINCT ".$fieldtocount." as val";
if (strpos($fieldtocount, 'te.') === 0) {
$sql .= ' FROM '.MAIN_DB_PREFIX.$object->table_element.'_extrafields as te';
} else {
$sql .= ' FROM '.MAIN_DB_PREFIX.$object->table_element.' as t';
}
// TODO Add the where here
+ // ...
$sql .= ' LIMIT '.($MAXUNIQUEVALFORGROUP + 1);
@@ -469,60 +470,60 @@ if (!empty($search_measures) && !empty($search_xaxis)) {
foreach ($search_xaxis as $key => $val) {
if (preg_match('/\-year$/', $val)) {
$tmpval = preg_replace('/\-year$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y') as x_".$key.', ';
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y') as x_".$key.', ';
} elseif (preg_match('/\-month$/', $val)) {
$tmpval = preg_replace('/\-month$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m') as x_".$key.', ';
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m') as x_".$key.', ';
} elseif (preg_match('/\-day$/', $val)) {
$tmpval = preg_replace('/\-day$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m-%d') as x_".$key.', ';
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m-%d') as x_".$key.', ';
} else {
- $sql .= $val.' as x_'.$key.', ';
+ $sql .= $val." as x_".$key.", ";
}
}
foreach ($search_groupby as $key => $val) {
if (preg_match('/\-year$/', $val)) {
$tmpval = preg_replace('/\-year$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y') as g_".$key.', ';
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y') as g_".$key.', ';
} elseif (preg_match('/\-month$/', $val)) {
$tmpval = preg_replace('/\-month$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m') as g_".$key.', ';
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m') as g_".$key.', ';
} elseif (preg_match('/\-day$/', $val)) {
$tmpval = preg_replace('/\-day$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m-%d') as g_".$key.', ';
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m-%d') as g_".$key.', ';
} else {
- $sql .= $val.' as g_'.$key.', ';
+ $sql .= $val." as g_".$key.", ";
}
}
foreach ($search_measures as $key => $val) {
if ($val == 't.count') {
- $sql .= 'COUNT(t.'.$fieldid.') as y_'.$key.', ';
+ $sql .= "COUNT(t.".$fieldid.") as y_".$key.', ';
} elseif (preg_match('/\-sum$/', $val)) {
$tmpval = preg_replace('/\-sum$/', '', $val);
- $sql .= 'SUM('.$db->ifsql($tmpval.' IS NULL', '0', $tmpval).') as y_'.$key.', ';
+ $sql .= "SUM(".$db->ifsql($tmpval.' IS NULL', '0', $tmpval).") as y_".$key.", ";
} elseif (preg_match('/\-average$/', $val)) {
$tmpval = preg_replace('/\-average$/', '', $val);
- $sql .= 'AVG('.$db->ifsql($tmpval.' IS NULL', '0', $tmpval).') as y_'.$key.', ';
+ $sql .= "AVG(".$db->ifsql($tmpval.' IS NULL', '0', $tmpval).") as y_".$key.", ";
} elseif (preg_match('/\-min$/', $val)) {
$tmpval = preg_replace('/\-min$/', '', $val);
- $sql .= 'MIN('.$db->ifsql($tmpval.' IS NULL', '0', $tmpval).') as y_'.$key.', ';
+ $sql .= "MIN(".$db->ifsql($tmpval.' IS NULL', '0', $tmpval).") as y_".$key.", ";
} elseif (preg_match('/\-max$/', $val)) {
$tmpval = preg_replace('/\-max$/', '', $val);
- $sql .= 'MAX('.$db->ifsql($tmpval.' IS NULL', '0', $tmpval).') as y_'.$key.', ';
+ $sql .= "MAX(".$db->ifsql($tmpval.' IS NULL', '0', $tmpval).") as y_".$key.", ";
}
}
$sql = preg_replace('/,\s*$/', '', $sql);
$sql .= ' FROM '.MAIN_DB_PREFIX.$object->table_element.' as t';
// Add measure from extrafields
if ($object->isextrafieldmanaged) {
- $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.$object->table_element.'_extrafields as te ON te.fk_object = t.'.$fieldid;
+ $sql .= " LEFT JOIN ".MAIN_DB_PREFIX.$object->table_element."_extrafields as te ON te.fk_object = t.".$fieldid;
}
if ($object->ismultientitymanaged) {
if ($object->ismultientitymanaged == 1) {
// Nothing here
} else {
$tmparray = explode('@', $object->ismultientitymanaged);
- $sql .= ' INNER JOIN '.MAIN_DB_PREFIX.$tmparray[1].' as parenttable ON t.'.$tmparray[0].' = parenttable.rowid';
+ $sql .= " INNER JOIN ".MAIN_DB_PREFIX.$tmparray[1]." as parenttable ON t.".$tmparray[0]." = parenttable.rowid";
$sql .= ' AND parenttable.entity IN ('.getEntity($tmparray[1]).')';
}
}
@@ -537,27 +538,27 @@ if (!empty($search_measures) && !empty($search_xaxis)) {
foreach ($search_xaxis as $key => $val) {
if (preg_match('/\-year$/', $val)) {
$tmpval = preg_replace('/\-year$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y'), ";
} elseif (preg_match('/\-month$/', $val)) {
$tmpval = preg_replace('/\-month$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m'), ";
} elseif (preg_match('/\-day$/', $val)) {
$tmpval = preg_replace('/\-day$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m-%d'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m-%d'), ";
} else {
- $sql .= $val.', ';
+ $sql .= $val.", ";
}
}
foreach ($search_groupby as $key => $val) {
if (preg_match('/\-year$/', $val)) {
$tmpval = preg_replace('/\-year$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y'), ";
} elseif (preg_match('/\-month$/', $val)) {
$tmpval = preg_replace('/\-month$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m'), ";
} elseif (preg_match('/\-day$/', $val)) {
$tmpval = preg_replace('/\-day$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m-%d'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m-%d'), ";
} else {
$sql .= $val.', ';
}
@@ -567,13 +568,13 @@ if (!empty($search_measures) && !empty($search_xaxis)) {
foreach ($search_xaxis as $key => $val) {
if (preg_match('/\-year$/', $val)) {
$tmpval = preg_replace('/\-year$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y'), ";
} elseif (preg_match('/\-month$/', $val)) {
$tmpval = preg_replace('/\-month$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m'), ";
} elseif (preg_match('/\-day$/', $val)) {
$tmpval = preg_replace('/\-day$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m-%d'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m-%d'), ";
} else {
$sql .= $val.', ';
}
@@ -581,13 +582,13 @@ if (!empty($search_measures) && !empty($search_xaxis)) {
foreach ($search_groupby as $key => $val) {
if (preg_match('/\-year$/', $val)) {
$tmpval = preg_replace('/\-year$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y'), ";
} elseif (preg_match('/\-month$/', $val)) {
$tmpval = preg_replace('/\-month$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m'), ";
} elseif (preg_match('/\-day$/', $val)) {
$tmpval = preg_replace('/\-day$/', '', $val);
- $sql .= 'DATE_FORMAT('.$tmpval.", '%Y-%m-%d'), ";
+ $sql .= "DATE_FORMAT(".$tmpval.", '%Y-%m-%d'), ";
} else {
$sql .= $val.', ';
}
diff --git a/htdocs/core/db/pgsql.class.php b/htdocs/core/db/pgsql.class.php
index 6e9a4f54db6..55d5f18dd00 100644
--- a/htdocs/core/db/pgsql.class.php
+++ b/htdocs/core/db/pgsql.class.php
@@ -905,7 +905,7 @@ class DoliDBPgsql extends DoliDB
// Test charset match LC_TYPE (pgsql error otherwise)
//print $charset.' '.setlocale(LC_CTYPE,'0'); exit;
- $sql = 'CREATE DATABASE "'.$database.'" OWNER "'.$owner.'" ENCODING \''.$charset.'\'';
+ $sql = "CREATE DATABASE '".$this->escape($database)."' OWNER '".$this->escape($owner)."' ENCODING '".$this->escape($charset)."'";
dol_syslog($sql, LOG_DEBUG);
$ret = $this->query($sql);
return $ret;
diff --git a/htdocs/core/db/sqlite3.class.php b/htdocs/core/db/sqlite3.class.php
index 53bcb6806dc..072d5f0c4b3 100644
--- a/htdocs/core/db/sqlite3.class.php
+++ b/htdocs/core/db/sqlite3.class.php
@@ -421,7 +421,7 @@ class DoliDBSqlite3 extends DoliDB
$descTable = $this->db->querySingle("SELECT sql FROM sqlite_master WHERE name='".$this->escape($tablename)."'");
// 1- Renommer la table avec un nom temporaire
- $this->query('ALTER TABLE '.$tablename.' RENAME TO tmp_'.$tablename);
+ $this->query("ALTER TABLE ".$tablename." RENAME TO tmp_".$tablename);
// 2- Recréer la table avec la contrainte ajoutée
@@ -436,10 +436,10 @@ class DoliDBSqlite3 extends DoliDB
$this->query($descTable);
// 3- Transférer les données
- $this->query('INSERT INTO '.$tablename.' SELECT * FROM tmp_'.$tablename);
+ $this->query("INSERT INTO ".$tablename." SELECT * FROM tmp_".$tablename);
// 4- Supprimer la table temporaire
- $this->query('DROP TABLE tmp_'.$tablename);
+ $this->query("DROP TABLE tmp_".$tablename);
// dummy statement
$query = "SELECT 0";
@@ -840,17 +840,12 @@ class DoliDBSqlite3 extends DoliDB
}
// ALTER DATABASE dolibarr_db DEFAULT CHARACTER SET latin DEFAULT COLLATE latin1_swedish_ci
- $sql = 'CREATE DATABASE '.$database;
- $sql .= ' DEFAULT CHARACTER SET '.$charset.' DEFAULT COLLATE '.$collation;
+ $sql = "CREATE DATABASE ".$this->escape($database);
+ $sql .= " DEFAULT CHARACTER SET ".$this->escape($charset)." DEFAULT COLLATE ".$this->escape($collation);
dol_syslog($sql, LOG_DEBUG);
$ret = $this->query($sql);
- if (!$ret) {
- // We try again for compatibility with Mysql < 4.1.1
- $sql = 'CREATE DATABASE '.$database;
- $ret = $this->query($sql);
- dol_syslog($sql, LOG_DEBUG);
- }
+
return $ret;
}
diff --git a/htdocs/core/lib/admin.lib.php b/htdocs/core/lib/admin.lib.php
index 3df3e7ee182..531af9017b3 100644
--- a/htdocs/core/lib/admin.lib.php
+++ b/htdocs/core/lib/admin.lib.php
@@ -306,8 +306,8 @@ function run_sql($sqlfile, $silent = 1, $entity = '', $usesavepoint = 1, $handle
// with
// 'INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 1401 + 200100000, 'PCG99-ABREGE','CAPIT', '1234', 1400 + 200100000,...'
// Note: string with 'PCG99-ABREGE','CAPIT', 1234 instead of 'PCG99-ABREGE','CAPIT', '1234' is also supported
- $newsql = preg_replace('/VALUES\s*\(__ENTITY__, \s*(\d+)\s*,(\s*\'[^\',]*\'\s*,\s*\'[^\',]*\'\s*,\s*\'?[^\',]*\'?\s*),\s*\'?([^\',]*)\'?/ims', 'VALUES (__ENTITY__, \1 + '.$offsetforchartofaccount.', \2, \3 + '.$offsetforchartofaccount, $newsql);
- $newsql = preg_replace('/([,\s])0 \+ '.$offsetforchartofaccount.'/ims', '\1 0', $newsql);
+ $newsql = preg_replace('/VALUES\s*\(__ENTITY__, \s*(\d+)\s*,(\s*\'[^\',]*\'\s*,\s*\'[^\',]*\'\s*,\s*\'?[^\',]*\'?\s*),\s*\'?([^\',]*)\'?/ims', 'VALUES (__ENTITY__, \1 + '.((int) $offsetforchartofaccount).', \2, \3 + '.((int) $offsetforchartofaccount), $newsql);
+ $newsql = preg_replace('/([,\s])0 \+ '.((int) $offsetforchartofaccount).'/ims', '\1 0', $newsql);
//var_dump($newsql);
$arraysql[$i] = $newsql;
diff --git a/htdocs/core/lib/company.lib.php b/htdocs/core/lib/company.lib.php
index 8806bcc8b92..7a10d2d4ff8 100644
--- a/htdocs/core/lib/company.lib.php
+++ b/htdocs/core/lib/company.lib.php
@@ -1526,7 +1526,7 @@ function show_actions_done($conf, $langs, $db, $filterobj, $objcon = '', $noprin
}
} elseif (is_object($filterobj) && is_array($filterobj->fields) && is_array($filterobj->fields['rowid']) && is_array($filterobj->fields['ref']) && $filterobj->table_element && $filterobj->element) {
// Generic case
- $sql .= " AND a.fk_element = o.rowid AND a.elementtype = '".$db->escape($filterobj->element).($module ? '@'.$module : '')."'";
+ $sql .= " AND a.fk_element = o.rowid AND a.elementtype = '".$db->escape($filterobj->element).($module ? "@".$module : "")."'";
if ($filterobj->id) {
$sql .= " AND a.fk_element = ".((int) $filterobj->id);
}
diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php
index ba4b115e830..350c2334915 100644
--- a/htdocs/core/lib/files.lib.php
+++ b/htdocs/core/lib/files.lib.php
@@ -2945,25 +2945,6 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
$sqlprotectagainstexternals = $hookmanager->resArray['sqlprotectagainstexternals'];
}
}
-
- /*
- // For modules who wants to manage different levels of permissions for documents
- $subPermCategoryConstName = strtoupper($modulepart).'_SUBPERMCATEGORY_FOR_DOCUMENTS';
- if (!empty($conf->global->$subPermCategoryConstName)) {
- $subPermCategory = $conf->global->$subPermCategoryConstName;
- if (!empty($subPermCategory) && (($fuser->rights->$modulepart->$subPermCategory->{$lire}) || ($fuser->rights->$modulepart->$subPermCategory->{$read}) || ($fuser->rights->$modulepart->$subPermCategory->{$download}))) {
- $accessallowed = 1;
- }
- }
-
- // Define $sqlprotectagainstexternals for modules who want to protect access using a SQL query.
- $sqlProtectConstName = strtoupper($modulepart).'_SQLPROTECTAGAINSTEXTERNALS_FOR_DOCUMENTS';
- if (!empty($conf->global->$sqlProtectConstName)) { // If module want to define its own $sqlprotectagainstexternals
- // Example: mymodule_SQLPROTECTAGAINSTEXTERNALS_FOR_DOCUMENTS = "SELECT fk_soc FROM ".MAIN_DB_PREFIX.$modulepart." WHERE ref='".$db->escape($refname)."' AND entity=".$conf->entity;
- // TODO Replace this with a hook
- eval('$sqlprotectagainstexternals = "'.$conf->global->$sqlProtectConstName.'";');
- }
- */
}
$ret = array(
diff --git a/htdocs/core/lib/invoice.lib.php b/htdocs/core/lib/invoice.lib.php
index 1f797c67d1b..e3337c4266f 100644
--- a/htdocs/core/lib/invoice.lib.php
+++ b/htdocs/core/lib/invoice.lib.php
@@ -239,7 +239,7 @@ function getCustomerInvoicePieChart($socid = 0)
$sql .= " WHERE f.fk_soc = s.rowid";
$sql .= " AND f.entity IN (".getEntity('facture').")";
if ($user->socid) {
- $sql .= ' AND f.fk_soc = '.$user->socid;
+ $sql .= ' AND f.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
@@ -359,7 +359,7 @@ function getPurchaseInvoicePieChart($socid = 0)
$sql .= " WHERE f.fk_soc = s.rowid";
$sql .= " AND f.entity IN (".getEntity('facture_fourn').")";
if ($user->socid) {
- $sql .= ' AND f.fk_soc = '.$user->socid;
+ $sql .= ' AND f.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
diff --git a/htdocs/core/lib/order.lib.php b/htdocs/core/lib/order.lib.php
index 6dcb40e1cc7..f264eadaf58 100644
--- a/htdocs/core/lib/order.lib.php
+++ b/htdocs/core/lib/order.lib.php
@@ -205,7 +205,7 @@ function getCustomerOrderPieChart($socid = 0)
$sql .= " WHERE c.fk_soc = s.rowid";
$sql .= " AND c.entity IN (".getEntity('societe').")";
if ($user->socid) {
- $sql .= ' AND c.fk_soc = '.$user->socid;
+ $sql .= ' AND c.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
diff --git a/htdocs/core/lib/propal.lib.php b/htdocs/core/lib/propal.lib.php
index f7dc3970dcb..038ab2a7911 100644
--- a/htdocs/core/lib/propal.lib.php
+++ b/htdocs/core/lib/propal.lib.php
@@ -184,7 +184,7 @@ function getCustomerProposalPieChart($socid = 0)
$sql .= " WHERE p.entity IN (".getEntity($propalstatic->element).")";
$sql .= " AND p.fk_soc = s.rowid";
if ($user->socid) {
- $sql .= ' AND p.fk_soc = '.$user->socid;
+ $sql .= ' AND p.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
diff --git a/htdocs/core/modules/modFournisseur.class.php b/htdocs/core/modules/modFournisseur.class.php
index baa983fc7cf..a36f219007b 100644
--- a/htdocs/core/modules/modFournisseur.class.php
+++ b/htdocs/core/modules/modFournisseur.class.php
@@ -353,7 +353,7 @@ class modFournisseur extends DolibarrModules
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_facture_fourn';
$this->export_sql_end[$r] .= ' AND f.entity IN ('.getEntity('supplier_invoice').')';
if (is_object($user) && empty($user->rights->societe->client->voir)) {
- $this->export_sql_end[$r] .= ' AND sc.fk_user = '.$user->id;
+ $this->export_sql_end[$r] .= ' AND sc.fk_user = '.((int) $user->id);
}
$r++;
@@ -417,7 +417,7 @@ class modFournisseur extends DolibarrModules
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid';
$this->export_sql_end[$r] .= ' AND f.entity IN ('.getEntity('supplier_invoice').')';
if (is_object($user) && empty($user->rights->societe->client->voir)) {
- $this->export_sql_end[$r] .= ' AND sc.fk_user = '.$user->id;
+ $this->export_sql_end[$r] .= ' AND sc.fk_user = '.((int) $user->id);
}
// Order
@@ -493,7 +493,7 @@ class modFournisseur extends DolibarrModules
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_commande';
$this->export_sql_end[$r] .= ' AND f.entity IN ('.getEntity('supplier_order').')';
if (is_object($user) && empty($user->rights->societe->client->voir)) {
- $this->export_sql_end[$r] .= ' AND sc.fk_user = '.$user->id;
+ $this->export_sql_end[$r] .= ' AND sc.fk_user = '.((int) $user->id);
}
//Import Supplier Invoice
diff --git a/htdocs/core/modules/modSociete.class.php b/htdocs/core/modules/modSociete.class.php
index af4fb9e64b8..eed6871c465 100644
--- a/htdocs/core/modules/modSociete.class.php
+++ b/htdocs/core/modules/modSociete.class.php
@@ -340,7 +340,7 @@ class modSociete extends DolibarrModules
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_incoterms as incoterm ON s.fk_incoterms = incoterm.rowid';
$this->export_sql_end[$r] .= ' WHERE s.entity IN ('.getEntity('societe').')';
if (is_object($user) && empty($user->rights->societe->client->voir)) {
- $this->export_sql_end[$r] .= ' AND (sc.fk_user = '.$user->id.' ';
+ $this->export_sql_end[$r] .= ' AND (sc.fk_user = '.((int) $user->id).' ';
if (!empty($conf->global->SOCIETE_EXPORT_SUBORDINATES_CHILDS)) {
$subordinatesids = $user->getAllChildIds();
$this->export_sql_end[$r] .= count($subordinatesids) > 0 ? ' OR (sc.fk_user IN ('.$this->db->sanitize(implode(',', $subordinatesids)).')' : '';
@@ -410,7 +410,7 @@ class modSociete extends DolibarrModules
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_typent as t ON s.fk_typent = t.id';
$this->export_sql_end[$r] .= ' WHERE c.entity IN ('.getEntity('socpeople').')';
if (is_object($user) && empty($user->rights->societe->client->voir)) {
- $this->export_sql_end[$r] .= ' AND (sc.fk_user = '.$user->id.' ';
+ $this->export_sql_end[$r] .= ' AND (sc.fk_user = '.((int) $user->id).' ';
if (!empty($conf->global->SOCIETE_EXPORT_SUBORDINATES_CHILDS)) {
$subordinatesids = $user->getAllChildIds();
$this->export_sql_end[$r] .= count($subordinatesids) > 0 ? ' OR (sc.fk_user IN ('.$this->db->sanitize(implode(',', $subordinatesids)).')' : '';
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index 22f29bb1d9e..fdbd1e5ab55 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -2525,7 +2525,7 @@ class ExpenseReport extends CommonObject
$sql = 'SELECT sum(amount) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.((int) $this->id);
+ $sql .= " WHERE ".$field." = ".((int) $this->id);
dol_syslog(get_class($this)."::getSumPayments", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/fichinter/index.php b/htdocs/fichinter/index.php
index 8513238b385..8eca043ef40 100644
--- a/htdocs/fichinter/index.php
+++ b/htdocs/fichinter/index.php
@@ -80,7 +80,7 @@ if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " WHERE f.entity IN (".getEntity('intervention').")";
$sql .= " AND f.fk_soc = s.rowid";
if ($user->socid) {
- $sql .= ' AND f.fk_soc = '.$user->socid;
+ $sql .= ' AND f.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index b97bf5485fa..eab1d445558 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -2411,7 +2411,7 @@ class FactureFournisseur extends CommonInvoice
$sql .= ' AND ff.fk_statut > 0';
$sql .= " AND ff.entity = ".$conf->entity;
if ($user->socid) {
- $sql .= ' AND ff.fk_soc = '.$user->socid;
+ $sql .= ' AND ff.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$user->socid) {
$sql .= " AND ff.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
diff --git a/htdocs/fourn/commande/index.php b/htdocs/fourn/commande/index.php
index 866063382bb..b4956ea706f 100644
--- a/htdocs/fourn/commande/index.php
+++ b/htdocs/fourn/commande/index.php
@@ -73,7 +73,7 @@ if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " WHERE cf.fk_soc = s.rowid";
$sql .= " AND cf.entity IN (".getEntity('supplier_order').")";
if ($user->socid) {
- $sql .= ' AND cf.fk_soc = '.$user->socid;
+ $sql .= ' AND cf.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
diff --git a/htdocs/fourn/paiement/list.php b/htdocs/fourn/paiement/list.php
index f02c872fb0e..8534ad8bac1 100644
--- a/htdocs/fourn/paiement/list.php
+++ b/htdocs/fourn/paiement/list.php
@@ -192,7 +192,7 @@ if (!$user->rights->societe->client->voir) {
$sql .= ' WHERE f.entity = '.$conf->entity;
if (!$user->rights->societe->client->voir) {
- $sql .= ' AND s.rowid = sc.fk_soc AND sc.fk_user = '.$user->id;
+ $sql .= ' AND s.rowid = sc.fk_soc AND sc.fk_user = '.((int) $user->id);
}
if ($socid > 0) {
$sql .= ' AND f.fk_soc = '.((int) $socid);
diff --git a/htdocs/loan/class/loan.class.php b/htdocs/loan/class/loan.class.php
index ffd745e263f..0ec7786fc20 100644
--- a/htdocs/loan/class/loan.class.php
+++ b/htdocs/loan/class/loan.class.php
@@ -651,7 +651,7 @@ class Loan extends CommonObject
$sql = 'SELECT sum(amount_capital) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.((int) $this->id);
+ $sql .= " WHERE ".$field." = ".((int) $this->id);
dol_syslog(get_class($this)."::getSumPayment", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/product/stock/replenishorders.php b/htdocs/product/stock/replenishorders.php
index 17490e330bb..01a7e2dd1a3 100644
--- a/htdocs/product/stock/replenishorders.php
+++ b/htdocs/product/stock/replenishorders.php
@@ -135,7 +135,7 @@ if ($conf->global->STOCK_CALCULATE_ON_SUPPLIER_VALIDATE_ORDER) {
$sql .= ' AND cf.fk_statut < 5';
}
if (!$user->rights->societe->client->voir && !$socid) {
- $sql .= ' AND s.rowid = sc.fk_soc AND sc.fk_user = '.$user->id;
+ $sql .= ' AND s.rowid = sc.fk_soc AND sc.fk_user = '.((int) $user->id);
}
if ($sref) {
$sql .= natural_search('cf.ref', $sref);
diff --git a/htdocs/salaries/class/salary.class.php b/htdocs/salaries/class/salary.class.php
index c434e73ec08..8fdd741efee 100644
--- a/htdocs/salaries/class/salary.class.php
+++ b/htdocs/salaries/class/salary.class.php
@@ -570,7 +570,7 @@ class Salary extends CommonObject
$sql = 'SELECT sum(amount) as amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.$table;
- $sql .= ' WHERE '.$field.' = '.((int) $this->id);
+ $sql .= " WHERE ".$field." = ".((int) $this->id);
dol_syslog(get_class($this)."::getSommePaiement", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/supplier_proposal/index.php b/htdocs/supplier_proposal/index.php
index 45501ed9b2b..ac937fe480d 100644
--- a/htdocs/supplier_proposal/index.php
+++ b/htdocs/supplier_proposal/index.php
@@ -72,7 +72,7 @@ if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " WHERE p.fk_soc = s.rowid";
$sql .= " AND p.entity IN (".getEntity('supplier_proposal').")";
if ($user->socid) {
- $sql .= ' AND p.fk_soc = '.$user->socid;
+ $sql .= ' AND p.fk_soc = '.((int) $user->socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
From 29abbbe2fb67ad8fe406fb67b410f64c23e39e4e Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 01:45:53 +0200
Subject: [PATCH 105/953] Clean code
---
.../accountancy/class/bookkeeping.class.php | 14 ++++----
htdocs/core/class/cproductnature.class.php | 8 ++---
htdocs/core/class/ctyperesource.class.php | 5 +--
htdocs/core/class/cunits.class.php | 8 ++---
htdocs/core/class/defaultvalues.class.php | 10 +++---
htdocs/core/lib/functions.lib.php | 12 +++----
htdocs/core/lib/functions2.lib.php | 12 +++----
htdocs/core/lib/ticket.lib.php | 4 +--
htdocs/core/lib/website2.lib.php | 2 +-
htdocs/core/login/functions_dolibarr.php | 18 +++++-----
.../modules/import/import_csv.modules.php | 34 +++++++++----------
.../modules/import/import_xlsx.modules.php | 32 ++++++++---------
.../modules/mailings/modules_mailings.php | 2 +-
.../modules/printing/printipp.modules.php | 2 +-
.../tpl/extrafields_list_search_sql.tpl.php | 6 ++--
htdocs/cron/class/cronjob.class.php | 4 +--
htdocs/cron/list.php | 4 +--
htdocs/dav/dav.class.php | 6 ++--
htdocs/ecm/class/ecmfiles.class.php | 12 +++----
.../class/conferenceorbooth.class.php | 6 ++--
.../class/conferenceorboothattendee.class.php | 2 +-
.../conferenceorbooth_list.php | 2 +-
.../class/expensereport.class.php | 26 +++++++-------
.../class/expensereport_rule.class.php | 4 +--
.../class/expensereportstats.class.php | 14 ++++----
htdocs/exports/class/export.class.php | 8 ++---
htdocs/fichinter/class/fichinter.class.php | 4 +--
.../fournisseur.commande.dispatch.class.php | 8 ++---
.../class/productcustomerprice.class.php | 16 ++++-----
.../class/productstockentrepot.class.php | 2 +-
htdocs/public/recruitment/index.php | 8 ++---
htdocs/public/ticket/list.php | 8 ++---
htdocs/resource/class/dolresource.class.php | 12 +++----
htdocs/ticket/class/ticket.class.php | 8 ++---
htdocs/website/class/website.class.php | 2 +-
htdocs/website/class/websitepage.class.php | 14 ++++----
36 files changed, 168 insertions(+), 171 deletions(-)
diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php
index acdce0229d0..e1a54edf3cd 100644
--- a/htdocs/accountancy/class/bookkeeping.class.php
+++ b/htdocs/accountancy/class/bookkeeping.class.php
@@ -1137,17 +1137,17 @@ class BookKeeping extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.doc_date') {
- $sqlwhere[] = $key.'=\''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 't.doc_date>=' || $key == 't.doc_date<=') {
- $sqlwhere[] = $key.'\''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key."'".$this->db->idate($value)."'";
} elseif ($key == 't.numero_compte>=' || $key == 't.numero_compte<=' || $key == 't.subledger_account>=' || $key == 't.subledger_account<=') {
- $sqlwhere[] = $key.'\''.$this->db->escape($value).'\'';
+ $sqlwhere[] = $key."'".$this->db->escape($value)."'";
} elseif ($key == 't.fk_doc' || $key == 't.fk_docdet' || $key == 't.piece_num') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif ($key == 't.subledger_account' || $key == 't.numero_compte') {
- $sqlwhere[] = $key.' LIKE \''.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '".$this->db->escape($value)."%'";
} elseif ($key == 't.subledger_label') {
- $sqlwhere[] = $key.' LIKE \''.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '".$this->db->escape($value)."%'";
} elseif ($key == 't.code_journal' && !empty($value)) {
if (is_array($value)) {
$sqlwhere[] = natural_search("t.code_journal", join(',', $value), 3, 1);
@@ -1155,7 +1155,7 @@ class BookKeeping extends CommonObject
$sqlwhere[] = natural_search("t.code_journal", $value, 3, 1);
}
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/core/class/cproductnature.class.php b/htdocs/core/class/cproductnature.class.php
index cd2114d4929..2f523d4cda7 100644
--- a/htdocs/core/class/cproductnature.class.php
+++ b/htdocs/core/class/cproductnature.class.php
@@ -208,13 +208,13 @@ class CProductNature // extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid' || $key == 't.active' || $key == 't.code') {
- $sqlwhere[] = $key.'='.(int) $value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 't.label') {
- $sqlwhere[] = $key.' = \''.$this->db->escape($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->escape($value)."'";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/core/class/ctyperesource.class.php b/htdocs/core/class/ctyperesource.class.php
index c286418caab..5b22e4e2033 100644
--- a/htdocs/core/class/ctyperesource.class.php
+++ b/htdocs/core/class/ctyperesource.class.php
@@ -230,19 +230,16 @@ class Ctyperesource
$sql = 'SELECT';
$sql .= ' t.rowid,';
-
$sql .= " t.code,";
$sql .= " t.label,";
$sql .= " t.active";
-
-
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
// Manage filter
$sqlwhere = array();
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
- $sqlwhere [] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere [] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
diff --git a/htdocs/core/class/cunits.class.php b/htdocs/core/class/cunits.class.php
index 536a596d2f1..6fd9b7a05cf 100644
--- a/htdocs/core/class/cunits.class.php
+++ b/htdocs/core/class/cunits.class.php
@@ -251,13 +251,13 @@ class CUnits // extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid' || $key == 't.active' || $key == 't.scale') {
- $sqlwhere[] = $key.'='.(int) $value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (strpos($key, 'date') !== false) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 't.unit_type' || $key == 't.code' || $key == 't.short_label') {
- $sqlwhere[] = $key.' = \''.$this->db->escape($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->escape($value)."'";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/core/class/defaultvalues.class.php b/htdocs/core/class/defaultvalues.class.php
index 165ba87c45d..bad30901594 100644
--- a/htdocs/core/class/defaultvalues.class.php
+++ b/htdocs/core/class/defaultvalues.class.php
@@ -264,17 +264,17 @@ class DefaultValues extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid' || ($key == 't.entity' && !is_array($value)) || ($key == 't.user_id' && !is_array($value))) {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (isset($this->fields[$key]) && in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 't.page' || $key == 't.param' || $key == 't.type') {
- $sqlwhere[] = $key.' = \''.$this->db->escape($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->escape($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (is_array($value)) {
- $sqlwhere[] = $key.' IN ('.$this->db->sanitize(implode(',', $value)).')';
+ $sqlwhere[] = $key." IN (".$this->db->sanitize(implode(',', $value)).")";
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index ea245e82487..5d961bf36fc 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -8900,10 +8900,10 @@ function natural_search($fields, $value, $mode = 0, $nofirstand = 0)
foreach ($tmparray as $val) {
$val = trim($val);
if ($val) {
- $newres .= ($i2 > 0 ? ' OR (' : '(').$field.' LIKE \''.$db->escape($val).',%\'';
- $newres .= ' OR '.$field.' = \''.$db->escape($val).'\'';
- $newres .= ' OR '.$field.' LIKE \'%,'.$db->escape($val).'\'';
- $newres .= ' OR '.$field.' LIKE \'%,'.$db->escape($val).',%\'';
+ $newres .= ($i2 > 0 ? " OR (" : "(").$field." LIKE '".$db->escape($val).",%'";
+ $newres .= ' OR '.$field." = '".$db->escape($val)."'";
+ $newres .= ' OR '.$field." LIKE '%,".$db->escape($val)."'";
+ $newres .= ' OR '.$field." LIKE '%,".$db->escape($val).",%'";
$newres .= ')';
$i2++;
}
@@ -8942,7 +8942,7 @@ function natural_search($fields, $value, $mode = 0, $nofirstand = 0)
$newres .= $tmpafter;
$newres .= "'";
if ($tmpcrit2 == '') {
- $newres .= ' OR '.$field." IS NULL";
+ $newres .= " OR ".$field." IS NULL";
}
}
@@ -9538,7 +9538,7 @@ function getDictvalue($tablename, $field, $id, $checkentity = false, $rowidfield
if (!isset($dictvalues[$tablename])) {
$dictvalues[$tablename] = array();
- $sql = 'SELECT * FROM '.$tablename.' WHERE 1 = 1'; // Here select * is allowed as it is generic code and we don't have list of fields
+ $sql = "SELECT * FROM ".$tablename." WHERE 1 = 1"; // Here select * is allowed as it is generic code and we don't have list of fields
if ($checkentity) {
$sql .= ' AND entity IN (0,'.getEntity($tablename).')';
}
diff --git a/htdocs/core/lib/functions2.lib.php b/htdocs/core/lib/functions2.lib.php
index f89156b24e1..5ea704881e3 100644
--- a/htdocs/core/lib/functions2.lib.php
+++ b/htdocs/core/lib/functions2.lib.php
@@ -1235,7 +1235,7 @@ function get_next_value($db, $mask, $table, $field, $where = '', $objsoc = '', $
$sqlwhere .= "(SUBSTRING(".$field.", ".$yearpos.", ".$yearlen.") = '".$db->escape($yearcomp)."'";
$sqlwhere .= " AND SUBSTRING(".$field.", ".$monthpos.", ".$monthlen.") = '".str_pad($monthcomp, $monthlen, '0', STR_PAD_LEFT)."')";
} else { // reset is done on january
- $sqlwhere .= '(SUBSTRING('.$field.', '.$yearpos.', '.$yearlen.") = '".$db->escape($yearcomp)."')";
+ $sqlwhere .= "(SUBSTRING(".$field.", ".$yearpos.", ".$yearlen.") = '".$db->escape($yearcomp)."')";
}
}
//print "sqlwhere=".$sqlwhere." yearcomp=".$yearcomp." \n"; // sqlwhere and yearcomp defined only if we ask a reset
@@ -1250,7 +1250,7 @@ function get_next_value($db, $mask, $table, $field, $where = '', $objsoc = '', $
if ($posnumstart < 0) {
return 'ErrorBadMaskFailedToLocatePosOfSequence';
}
- $sqlstring = 'SUBSTRING('.$field.', '.($posnumstart + 1).', '.dol_strlen($maskcounter).')';
+ $sqlstring = "SUBSTRING(".$field.", ".($posnumstart + 1).", ".dol_strlen($maskcounter).")";
// Define $maskLike
$maskLike = dol_string_nospecial($mask);
@@ -1291,7 +1291,7 @@ function get_next_value($db, $mask, $table, $field, $where = '', $objsoc = '', $
$sql .= $where;
}
if ($sqlwhere) {
- $sql .= ' AND '.$sqlwhere;
+ $sql .= " AND ".$sqlwhere;
}
//print $sql.' ';
@@ -1351,7 +1351,7 @@ function get_next_value($db, $mask, $table, $field, $where = '', $objsoc = '', $
$sql .= $where;
}
if ($sqlwhere) {
- $sql .= ' AND '.$sqlwhere;
+ $sql .= " AND ".$sqlwhere;
}
dol_syslog("functions2::get_next_value mode=".$mode."", LOG_DEBUG);
@@ -1414,7 +1414,7 @@ function get_next_value($db, $mask, $table, $field, $where = '', $objsoc = '', $
if ($sqlwhere) {
$maskrefclient_sql .= ' AND '.$sqlwhere; //use the same sqlwhere as general mask
}
- $maskrefclient_sql .= ' AND (SUBSTRING('.$field.', '.(strpos($maskwithnocode, $maskrefclient) + 1).', '.dol_strlen($maskrefclient_maskclientcode).")='".$db->escape($maskrefclient_clientcode)."')";
+ $maskrefclient_sql .= " AND (SUBSTRING(".$field.", ".(strpos($maskwithnocode, $maskrefclient) + 1).", ".dol_strlen($maskrefclient_maskclientcode).") = '".$db->escape($maskrefclient_clientcode)."')";
dol_syslog("functions2::get_next_value maskrefclient", LOG_DEBUG);
$maskrefclient_resql = $db->query($maskrefclient_sql);
@@ -2250,7 +2250,7 @@ function cleanCorruptedTree($db, $tabletocleantree, $fieldfkparent)
$listofparentid = array();
// Get list of all id in array listofid and all parents in array listofparentid
- $sql = 'SELECT rowid, '.$fieldfkparent.' as parent_id FROM '.MAIN_DB_PREFIX.$tabletocleantree;
+ $sql = "SELECT rowid, ".$fieldfkparent." as parent_id FROM ".MAIN_DB_PREFIX.$tabletocleantree;
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
diff --git a/htdocs/core/lib/ticket.lib.php b/htdocs/core/lib/ticket.lib.php
index ac3f80e00bc..9506984f4f3 100644
--- a/htdocs/core/lib/ticket.lib.php
+++ b/htdocs/core/lib/ticket.lib.php
@@ -958,8 +958,8 @@ function getTicketActionCommEcmList($object)
$sql = 'SELECT ecm.rowid as id, ecm.src_object_type, ecm.src_object_id, ecm.filepath, ecm.filename';
$sql .= ' FROM '.MAIN_DB_PREFIX.'ecm_files ecm';
- $sql .= ' WHERE ecm.filepath = \'agenda/'.$object->id.'\'';
- //$sql.= ' ecm.src_object_type = \''.$object->element.'\' AND ecm.src_object_id = '.((int) $object->id); // Actually upload file doesn't add type
+ $sql .= " WHERE ecm.filepath = 'agenda/".((int) $object->id)."'";
+ //$sql.= " ecm.src_object_type = '".$db->escape($object->element)."' AND ecm.src_object_id = ".((int) $object->id); // Old version didn't add object_type during upload
$sql .= ' ORDER BY ecm.position ASC';
$resql = $db->query($sql);
diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php
index 721b908b9d1..c3d2ee92c37 100644
--- a/htdocs/core/lib/website2.lib.php
+++ b/htdocs/core/lib/website2.lib.php
@@ -223,7 +223,7 @@ function dolSavePageContent($filetpl, Website $object, WebsitePage $objectpage,
}
// Add "has translation pages"
- $sql = 'SELECT rowid as id, lang, pageurl from '.MAIN_DB_PREFIX.'website_page where fk_page IN ('.$db->sanitize($objectpage->id.($translationof ? ', '.$translationof : '')).")";
+ $sql = "SELECT rowid as id, lang, pageurl from ".MAIN_DB_PREFIX.'website_page where fk_page IN ('.$db->sanitize($objectpage->id.($translationof ? ", ".$translationof : '')).")";
$resql = $db->query($sql);
if ($resql) {
$num_rows = $db->num_rows($resql);
diff --git a/htdocs/core/login/functions_dolibarr.php b/htdocs/core/login/functions_dolibarr.php
index 6daea1f2c68..f102cd2f358 100644
--- a/htdocs/core/login/functions_dolibarr.php
+++ b/htdocs/core/login/functions_dolibarr.php
@@ -55,18 +55,18 @@ function check_user_password_dolibarr($usertotest, $passwordtotest, $entitytotes
$usernamecol2 = 'email';
$entitycol = 'entity';
- $sql = 'SELECT rowid, login, entity, pass, pass_crypted, datestartvalidity, dateendvalidity';
- $sql .= ' FROM '.$table;
- $sql .= ' WHERE ('.$usernamecol1." = '".$db->escape($usertotest)."'";
+ $sql = "SELECT rowid, login, entity, pass, pass_crypted, datestartvalidity, dateendvalidity";
+ $sql .= " FROM ".$table;
+ $sql .= " WHERE (".$usernamecol1." = '".$db->escape($usertotest)."'";
if (preg_match('/@/', $usertotest)) {
- $sql .= ' OR '.$usernamecol2." = '".$db->escape($usertotest)."'";
+ $sql .= " OR ".$usernamecol2." = '".$db->escape($usertotest)."'";
}
- $sql .= ') AND '.$entitycol." IN (0,".($entity ? $entity : 1).")";
- $sql .= ' AND statut = 1';
+ $sql .= ") AND ".$entitycol." IN (0,".($entity ? ((int) $entity) : 1).")";
+ $sql .= " AND statut = 1";
// Note: Test on validity is done later
- // Required to firstly found the user into entity, then the superadmin.
- // For the case (TODO we must avoid that) a user has renamed its login with same value than a user in entity 0.
- $sql .= ' ORDER BY entity DESC';
+ // Order is required to firstly found the user into entity, then the superadmin.
+ // For the case (TODO: we must avoid that) a user has renamed its login with same value than a user in entity 0.
+ $sql .= " ORDER BY entity DESC";
$resql = $db->query($sql);
if ($resql) {
diff --git a/htdocs/core/modules/import/import_csv.modules.php b/htdocs/core/modules/import/import_csv.modules.php
index 6bec94d6130..184c99a95e7 100644
--- a/htdocs/core/modules/import/import_csv.modules.php
+++ b/htdocs/core/modules/import/import_csv.modules.php
@@ -720,7 +720,7 @@ class ImportCsv extends ModeleImports
}
if ($val == 'user->id') {
$listfields[] = preg_replace('/^'.preg_quote($alias, '/').'\./', '', $key);
- $listvalues[] = $user->id;
+ $listvalues[] = ((int) $user->id);
} elseif (preg_match('/^lastrowid-/', $val)) {
$tmp = explode('-', $val);
$lastinsertid = (isset($last_insert_id_array[$tmp[1]])) ? $last_insert_id_array[$tmp[1]] : 0;
@@ -731,7 +731,7 @@ class ImportCsv extends ModeleImports
} elseif (preg_match('/^const-/', $val)) {
$tmp = explode('-', $val, 2);
$listfields[] = preg_replace('/^'.preg_quote($alias, '/').'\./', '', $key);
- $listvalues[] = "'".$tmp[1]."'";
+ $listvalues[] = "'".$this->db->escape($tmp[1])."'";
} else {
$this->errors[$error]['lib'] = 'Bad value of profile setup '.$val.' for array_import_fieldshidden';
$this->errors[$error]['type'] = 'Import profile setup';
@@ -753,7 +753,7 @@ class ImportCsv extends ModeleImports
// We do SELECT to get the rowid, if we already have the rowid, it's to be used below for related tables (extrafields)
if (empty($lastinsertid)) { // No insert done yet for a parent table
- $sqlSelect = 'SELECT rowid FROM '.$tablename;
+ $sqlSelect = "SELECT rowid FROM ".$tablename;
$data = array_combine($listfields, $listvalues);
$where = array();
@@ -764,7 +764,7 @@ class ImportCsv extends ModeleImports
$where[] = $key.' = '.$data[$key];
$filters[] = $col.' = '.$data[$key];
}
- $sqlSelect .= ' WHERE '.implode(' AND ', $where);
+ $sqlSelect .= " WHERE ".implode(' AND ', $where);
$resql = $this->db->query($sqlSelect);
if ($resql) {
@@ -791,12 +791,12 @@ class ImportCsv extends ModeleImports
// a direct insert into subtable extrafields, but when me wake an update, the insertid is defined and the child record
// may already exists. So we rescan the extrafield table to know if record exists or not for the rowid.
// Note: For extrafield tablename, we have in importfieldshidden_array an enty 'extra.fk_object'=>'lastrowid-tableparent' so $keyfield is 'fk_object'
- $sqlSelect = 'SELECT rowid FROM '.$tablename;
+ $sqlSelect = "SELECT rowid FROM ".$tablename;
if (empty($keyfield)) {
$keyfield = 'rowid';
}
- $sqlSelect .= ' WHERE '.$keyfield.' = '.((int) $lastinsertid);
+ $sqlSelect .= " WHERE ".$keyfield.' = '.((int) $lastinsertid);
$resql = $this->db->query($sqlSelect);
if ($resql) {
@@ -818,19 +818,19 @@ class ImportCsv extends ModeleImports
if (!empty($lastinsertid)) {
// Build SQL UPDATE request
- $sqlstart = 'UPDATE '.$tablename;
+ $sqlstart = "UPDATE ".$tablename;
$data = array_combine($listfields, $listvalues);
$set = array();
foreach ($data as $key => $val) {
- $set[] = $key.' = '.$val;
+ $set[] = $key." = ".$val;
}
- $sqlstart .= ' SET '.implode(', ', $set);
+ $sqlstart .= " SET ".implode(', ', $set);
if (empty($keyfield)) {
$keyfield = 'rowid';
}
- $sqlend = ' WHERE '.$keyfield.' = '.((int) $lastinsertid);
+ $sqlend = " WHERE ".$keyfield." = ".((int) $lastinsertid);
$sql = $sqlstart.$sqlend;
@@ -851,17 +851,17 @@ class ImportCsv extends ModeleImports
// Update not done, we do insert
if (!$error && !$updatedone) {
// Build SQL INSERT request
- $sqlstart = 'INSERT INTO '.$tablename.'('.implode(', ', $listfields).', import_key';
- $sqlend = ') VALUES('.implode(', ', $listvalues).", '".$this->db->escape($importid)."'";
+ $sqlstart = "INSERT INTO ".$tablename."(".implode(", ", $listfields).", import_key";
+ $sqlend = ") VALUES(".implode(', ', $listvalues).", '".$this->db->escape($importid)."'";
if (!empty($tablewithentity_cache[$tablename])) {
- $sqlstart .= ', entity';
- $sqlend .= ', '.$conf->entity;
+ $sqlstart .= ", entity";
+ $sqlend .= ", ".$conf->entity;
}
if (!empty($objimport->array_import_tables_creator[0][$alias])) {
- $sqlstart .= ', '.$objimport->array_import_tables_creator[0][$alias];
- $sqlend .= ', '.$user->id;
+ $sqlstart .= ", ".$objimport->array_import_tables_creator[0][$alias];
+ $sqlend .= ", ".$user->id;
}
- $sql = $sqlstart.$sqlend.')';
+ $sql = $sqlstart.$sqlend.")";
//dol_syslog("import_csv.modules", LOG_DEBUG);
// Run insert request
diff --git a/htdocs/core/modules/import/import_xlsx.modules.php b/htdocs/core/modules/import/import_xlsx.modules.php
index 0378180475d..aaca0d3bd77 100644
--- a/htdocs/core/modules/import/import_xlsx.modules.php
+++ b/htdocs/core/modules/import/import_xlsx.modules.php
@@ -761,7 +761,7 @@ class ImportXlsx extends ModeleImports
}
if ($val == 'user->id') {
$listfields[] = preg_replace('/^' . preg_quote($alias, '/') . '\./', '', $key);
- $listvalues[] = $user->id;
+ $listvalues[] = ((int) $user->id);
} elseif (preg_match('/^lastrowid-/', $val)) {
$tmp = explode('-', $val);
$lastinsertid = (isset($last_insert_id_array[$tmp[1]])) ? $last_insert_id_array[$tmp[1]] : 0;
@@ -772,7 +772,7 @@ class ImportXlsx extends ModeleImports
} elseif (preg_match('/^const-/', $val)) {
$tmp = explode('-', $val, 2);
$listfields[] = preg_replace('/^' . preg_quote($alias, '/') . '\./', '', $key);
- $listvalues[] = "'" . $tmp[1] . "'";
+ $listvalues[] = "'" . $this->db->escape($tmp[1]) . "'";
} else {
$this->errors[$error]['lib'] = 'Bad value of profile setup ' . $val . ' for array_import_fieldshidden';
$this->errors[$error]['type'] = 'Import profile setup';
@@ -793,7 +793,7 @@ class ImportXlsx extends ModeleImports
// We do SELECT to get the rowid, if we already have the rowid, it's to be used below for related tables (extrafields)
if (empty($lastinsertid)) { // No insert done yet for a parent table
- $sqlSelect = 'SELECT rowid FROM ' . $tablename;
+ $sqlSelect = "SELECT rowid FROM " . $tablename;
$data = array_combine($listfields, $listvalues);
$where = array();
@@ -804,7 +804,7 @@ class ImportXlsx extends ModeleImports
$where[] = $key . ' = ' . $data[$key];
$filters[] = $col . ' = ' . $data[$key];
}
- $sqlSelect .= ' WHERE ' . implode(' AND ', $where);
+ $sqlSelect .= " WHERE " . implode(' AND ', $where);
$resql = $this->db->query($sqlSelect);
if ($resql) {
@@ -831,12 +831,12 @@ class ImportXlsx extends ModeleImports
// a direct insert into subtable extrafields, but when me wake an update, the insertid is defined and the child record
// may already exists. So we rescan the extrafield table to know if record exists or not for the rowid.
// Note: For extrafield tablename, we have in importfieldshidden_array an enty 'extra.fk_object'=>'lastrowid-tableparent' so $keyfield is 'fk_object'
- $sqlSelect = 'SELECT rowid FROM ' . $tablename;
+ $sqlSelect = "SELECT rowid FROM " . $tablename;
if (empty($keyfield)) {
$keyfield = 'rowid';
}
- $sqlSelect .= ' WHERE ' . $keyfield . ' = ' .((int) $lastinsertid);
+ $sqlSelect .= "WHERE " . $keyfield . " = " .((int) $lastinsertid);
$resql = $this->db->query($sqlSelect);
if ($resql) {
@@ -858,19 +858,19 @@ class ImportXlsx extends ModeleImports
if (!empty($lastinsertid)) {
// Build SQL UPDATE request
- $sqlstart = 'UPDATE ' . $tablename;
+ $sqlstart = "UPDATE " . $tablename;
$data = array_combine($listfields, $listvalues);
$set = array();
foreach ($data as $key => $val) {
$set[] = $key . ' = ' . $val;
}
- $sqlstart .= ' SET ' . implode(', ', $set);
+ $sqlstart .= " SET " . implode(', ', $set);
if (empty($keyfield)) {
$keyfield = 'rowid';
}
- $sqlend = ' WHERE ' . $keyfield . ' = '.((int) $lastinsertid);
+ $sqlend = " WHERE " . $keyfield . " = ".((int) $lastinsertid);
$sql = $sqlstart . $sqlend;
@@ -891,17 +891,17 @@ class ImportXlsx extends ModeleImports
// Update not done, we do insert
if (!$error && !$updatedone) {
// Build SQL INSERT request
- $sqlstart = 'INSERT INTO ' . $tablename . '(' . implode(', ', $listfields) . ', import_key';
- $sqlend = ') VALUES(' . implode(', ', $listvalues) . ", '" . $this->db->escape($importid) . "'";
+ $sqlstart = "INSERT INTO " . $tablename . "(" . implode(", ", $listfields) . ", import_key";
+ $sqlend = ") VALUES(" . implode(', ', $listvalues) . ", '" . $this->db->escape($importid) . "'";
if (!empty($tablewithentity_cache[$tablename])) {
- $sqlstart .= ', entity';
- $sqlend .= ', ' . $conf->entity;
+ $sqlstart .= ", entity";
+ $sqlend .= ", " . $conf->entity;
}
if (!empty($objimport->array_import_tables_creator[0][$alias])) {
- $sqlstart .= ', ' . $objimport->array_import_tables_creator[0][$alias];
- $sqlend .= ', ' . $user->id;
+ $sqlstart .= ", " . $objimport->array_import_tables_creator[0][$alias];
+ $sqlend .= ", " . $user->id;
}
- $sql = $sqlstart . $sqlend . ')';
+ $sql = $sqlstart . $sqlend . ")";
//dol_syslog("import_xlsx.modules", LOG_DEBUG);
// Run insert request
diff --git a/htdocs/core/modules/mailings/modules_mailings.php b/htdocs/core/modules/mailings/modules_mailings.php
index de5feb233ad..afbf1e22481 100644
--- a/htdocs/core/modules/mailings/modules_mailings.php
+++ b/htdocs/core/modules/mailings/modules_mailings.php
@@ -184,7 +184,7 @@ class MailingTargets // This can't be abstract as it is used for some method
$sql .= "'".$this->db->escape($targetarray['other'])."',";
$sql .= "'".$this->db->escape($targetarray['source_url'])."',";
$sql .= (empty($targetarray['source_id']) ? 'null' : "'".$this->db->escape($targetarray['source_id'])."'").",";
- $sql .= "'".$this->db->escape(dol_hash($dolibarr_main_instance_unique_id.';'.$targetarray['email'].';'.$targetarray['lastname'].';'.$mailing_id.';'.$conf->global->MAILING_EMAIL_UNSUBSCRIBE_KEY, 'md5'))."',";
+ $sql .= "'".$this->db->escape(dol_hash($dolibarr_main_instance_unique_id.";".$targetarray['email'].";".$targetarray['lastname'].";".$mailing_id.";".$conf->global->MAILING_EMAIL_UNSUBSCRIBE_KEY, 'md5'))."',";
$sql .= "'".$this->db->escape($targetarray['source_type'])."')";
dol_syslog(__METHOD__, LOG_DEBUG);
$result = $this->db->query($sql);
diff --git a/htdocs/core/modules/printing/printipp.modules.php b/htdocs/core/modules/printing/printipp.modules.php
index 6c4403e2593..0d824d2c7c0 100644
--- a/htdocs/core/modules/printing/printipp.modules.php
+++ b/htdocs/core/modules/printing/printipp.modules.php
@@ -309,7 +309,7 @@ class printing_printipp extends PrintingDriver
$ipp->setAuthentication($this->user, $this->password);
}
// select printer uri for module order, propal,...
- $sql = 'SELECT rowid,printer_uri,printer_name FROM '.MAIN_DB_PREFIX.'printer_ipp WHERE module="'.$module.'"';
+ $sql = "SELECT rowid,printer_uri,printer_name FROM ".MAIN_DB_PREFIX."printer_ipp WHERE module = '".$this->db->escape($module)."'";
$result = $this->db->query($sql);
if ($result) {
$obj = $this->db->fetch_object($result);
diff --git a/htdocs/core/tpl/extrafields_list_search_sql.tpl.php b/htdocs/core/tpl/extrafields_list_search_sql.tpl.php
index 8b7ff9ac62c..4ba40384648 100644
--- a/htdocs/core/tpl/extrafields_list_search_sql.tpl.php
+++ b/htdocs/core/tpl/extrafields_list_search_sql.tpl.php
@@ -33,11 +33,11 @@ if (!empty($extrafieldsobjectkey) && !empty($search_array_options) && is_array($
$sql .= " AND ".$extrafieldsobjectprefix.$tmpkey." = '".$db->idate($crit)."'";
} elseif (is_array($crit)) {
if ($crit['start'] !== '' && $crit['end'] !== '') {
- $sql .= ' AND ('.$extrafieldsobjectprefix.$tmpkey." BETWEEN '". $db->idate($crit['start']). "' AND '".$db->idate($crit['end']) . "')";
+ $sql .= " AND (".$extrafieldsobjectprefix.$tmpkey." BETWEEN '". $db->idate($crit['start']). "' AND '".$db->idate($crit['end']) . "')";
} elseif ($crit['start'] !== '') {
- $sql .= ' AND ('.$extrafieldsobjectprefix.$tmpkey." >= '". $db->idate($crit['start'])."')";
+ $sql .= " AND (".$extrafieldsobjectprefix.$tmpkey." >= '". $db->idate($crit['start'])."')";
} elseif ($crit['end'] !== '') {
- $sql .= ' AND ('.$extrafieldsobjectprefix.$tmpkey." <= '". $db->idate($crit['end'])."')";
+ $sql .= " AND (".$extrafieldsobjectprefix.$tmpkey." <= '". $db->idate($crit['end'])."')";
}
}
} elseif (in_array($typ, array('boolean'))) {
diff --git a/htdocs/cron/class/cronjob.class.php b/htdocs/cron/class/cronjob.class.php
index 2ffce20a924..e069ea7a326 100644
--- a/htdocs/cron/class/cronjob.class.php
+++ b/htdocs/cron/class/cronjob.class.php
@@ -557,9 +557,9 @@ class Cronjob extends CommonObject
if (is_array($filter) && count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid') {
- $sql .= ' AND '.$key.' = '.((int) $value);
+ $sql .= " AND ".$key." = ".((int) $value);
} else {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/cron/list.php b/htdocs/cron/list.php
index 4d829258b2b..aba6558f20d 100644
--- a/htdocs/cron/list.php
+++ b/htdocs/cron/list.php
@@ -278,12 +278,12 @@ if ($search_lastresult != '') {
//Manage filter
if (is_array($filter) && count($filter) > 0) {
foreach ($filter as $key => $value) {
- $sql .= ' AND '.$key.' LIKE \'%'.$db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$db->escape($value)."%'";
}
}
$sqlwhere = array();
if (!empty($search_module_name)) {
- $sqlwhere[] = '(t.module_name='.$db->escape($search_module_name).')';
+ $sqlwhere[] = "(t.module_name = '".$db->escape($search_module_name)."')";
}
if (count($sqlwhere) > 0) {
$sql .= " WHERE ".implode(' AND ', $sqlwhere);
diff --git a/htdocs/dav/dav.class.php b/htdocs/dav/dav.class.php
index 6ff9e58b73a..a4c98eba8a7 100644
--- a/htdocs/dav/dav.class.php
+++ b/htdocs/dav/dav.class.php
@@ -82,8 +82,8 @@ class CdavLib
LEFT OUTER JOIN '.MAIN_DB_PREFIX.'user AS u ON (u.rowid=fk_element)
WHERE ar.element_type=\'user\' AND fk_actioncomm=a.id) AS other_users
FROM '.MAIN_DB_PREFIX.'actioncomm AS a';
- if (!$this->user->rights->societe->client->voir) {//FIXME si 'voir' on voit plus de chose ?
- $sql .= ' LEFT OUTER JOIN '.MAIN_DB_PREFIX.'societe_commerciaux AS sc ON (a.fk_soc = sc.fk_soc AND sc.fk_user='.$this->user->id.')
+ if (!$this->user->rights->societe->client->voir) { //FIXME si 'voir' on voit plus de chose ?
+ $sql .= ' LEFT OUTER JOIN '.MAIN_DB_PREFIX.'societe_commerciaux AS sc ON (a.fk_soc = sc.fk_soc AND sc.fk_user='.((int) $this->user->id).')
LEFT JOIN '.MAIN_DB_PREFIX.'societe AS s ON (s.rowid = sc.fk_soc)
LEFT JOIN '.MAIN_DB_PREFIX.'socpeople AS sp ON (sp.fk_soc = sc.fk_soc AND sp.rowid = a.fk_contact)
LEFT JOIN '.MAIN_DB_PREFIX.'actioncomm_cdav AS ac ON (a.id = ac.fk_object)';
@@ -95,7 +95,7 @@ class CdavLib
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_country as co ON co.rowid = sp.fk_pays
LEFT JOIN '.MAIN_DB_PREFIX.'c_country as cos ON cos.rowid = s.fk_pays
- WHERE a.id IN (SELECT ar.fk_actioncomm FROM '.MAIN_DB_PREFIX.'actioncomm_resources ar WHERE ar.element_type=\'user\' AND ar.fk_element='.intval($calid).')
+ WHERE a.id IN (SELECT ar.fk_actioncomm FROM '.MAIN_DB_PREFIX.'actioncomm_resources ar WHERE ar.element_type=\'user\' AND ar.fk_element='.((int) $calid).')
AND a.code IN (SELECT cac.code FROM '.MAIN_DB_PREFIX.'c_actioncomm cac WHERE cac.type<>\'systemauto\')
AND a.entity IN ('.getEntity('societe', 1).')';
if ($oid !== false) {
diff --git a/htdocs/ecm/class/ecmfiles.class.php b/htdocs/ecm/class/ecmfiles.class.php
index 049ba50bfbe..15cfba4c03e 100644
--- a/htdocs/ecm/class/ecmfiles.class.php
+++ b/htdocs/ecm/class/ecmfiles.class.php
@@ -303,17 +303,17 @@ class EcmFiles extends CommonObject
$sql .= " '".$this->db->escape($ref)."', ";
$sql .= ' '.(!isset($this->label) ? 'NULL' : "'".$this->db->escape($this->label)."'").',';
$sql .= ' '.(!isset($this->share) ? 'NULL' : "'".$this->db->escape($this->share)."'").',';
- $sql .= ' '.$this->entity.',';
+ $sql .= ' '.((int) $this->entity).',';
$sql .= ' '.(!isset($this->filename) ? 'NULL' : "'".$this->db->escape($this->filename)."'").',';
$sql .= ' '.(!isset($this->filepath) ? 'NULL' : "'".$this->db->escape($this->filepath)."'").',';
$sql .= ' '.(!isset($this->fullpath_orig) ? 'NULL' : "'".$this->db->escape($this->fullpath_orig)."'").',';
$sql .= ' '.(!isset($this->description) ? 'NULL' : "'".$this->db->escape($this->description)."'").',';
$sql .= ' '.(!isset($this->keywords) ? 'NULL' : "'".$this->db->escape($this->keywords)."'").',';
$sql .= ' '.(!isset($this->cover) ? 'NULL' : "'".$this->db->escape($this->cover)."'").',';
- $sql .= ' '.$maxposition.',';
+ $sql .= ' '.((int) $maxposition).',';
$sql .= ' '.(!isset($this->gen_or_uploaded) ? 'NULL' : "'".$this->db->escape($this->gen_or_uploaded)."'").',';
$sql .= ' '.(!isset($this->extraparams) ? 'NULL' : "'".$this->db->escape($this->extraparams)."'").',';
- $sql .= ' '."'".$this->db->idate($this->date_c)."'".',';
+ $sql .= " '".$this->db->idate($this->date_c)."',";
$sql .= ' '.(!isset($this->date_m) || dol_strlen($this->date_m) == 0 ? 'NULL' : "'".$this->db->idate($this->date_m)."'").',';
$sql .= ' '.(!isset($this->fk_user_c) ? $user->id : $this->fk_user_c).',';
$sql .= ' '.(!isset($this->fk_user_m) ? 'NULL' : $this->fk_user_m).',';
@@ -530,9 +530,9 @@ class EcmFiles extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.src_object_id') {
- $sqlwhere[] = $key.' = '.((int) $value);
+ $sqlwhere[] = $key." = ".((int) $value);
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -664,7 +664,7 @@ class EcmFiles extends CommonObject
// Update request
$sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element.' SET';
- $sql .= " ref = '".dol_hash($this->filepath.'/'.$this->filename, 3)."',";
+ $sql .= " ref = '".$this->db->escape(dol_hash($this->filepath."/".$this->filename, 3))."',";
$sql .= ' label = '.(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null").',';
$sql .= ' share = '.(!empty($this->share) ? "'".$this->db->escape($this->share)."'" : "null").',';
$sql .= ' entity = '.(isset($this->entity) ? $this->entity : $conf->entity).',';
diff --git a/htdocs/eventorganization/class/conferenceorbooth.class.php b/htdocs/eventorganization/class/conferenceorbooth.class.php
index 09997716c01..9318e3f8465 100644
--- a/htdocs/eventorganization/class/conferenceorbooth.class.php
+++ b/htdocs/eventorganization/class/conferenceorbooth.class.php
@@ -293,15 +293,15 @@ class ConferenceOrBooth extends ActionComm
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.id' || $key == 't.fk_project' || $key == 't.fk_soc' || $key == 't.fk_action') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif (in_array($this->fields[$key]['type'], array('date', 'datetime', 'timestamp'))) {
- $sqlwhere[] = $key.' = \''.$this->db->idate($value).'\'';
+ $sqlwhere[] = $key." = '".$this->db->idate($value)."'";
} elseif ($key == 'customsql') {
$sqlwhere[] = $value;
} elseif (strpos($value, '%') === false) {
$sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/eventorganization/class/conferenceorboothattendee.class.php b/htdocs/eventorganization/class/conferenceorboothattendee.class.php
index 825451e9868..5169058d41c 100644
--- a/htdocs/eventorganization/class/conferenceorboothattendee.class.php
+++ b/htdocs/eventorganization/class/conferenceorboothattendee.class.php
@@ -422,7 +422,7 @@ class ConferenceOrBoothAttendee extends CommonObject
} elseif (strpos($value, '%') === false) {
$sqlwhere[] = $key.' IN ('.$this->db->sanitize($this->db->escape($value)).')';
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/eventorganization/conferenceorbooth_list.php b/htdocs/eventorganization/conferenceorbooth_list.php
index d3bbd835367..679e0d2d735 100644
--- a/htdocs/eventorganization/conferenceorbooth_list.php
+++ b/htdocs/eventorganization/conferenceorbooth_list.php
@@ -472,7 +472,7 @@ if ($object->ismultientitymanaged == 1) {
$sql .= " WHERE 1 = 1";
}
if ($projectid > 0) {
- $sql .= ' AND t.fk_project='.$project->id;
+ $sql .= " AND t.fk_project = ".((int) $project->id);
}
foreach ($search as $key => $val) {
if (array_key_exists($key, $object->fields)) {
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index fdbd1e5ab55..a67b447ca9c 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -973,7 +973,7 @@ class ExpenseReport extends CommonObject
{
$sql = 'SELECT tt.total_ht, tt.total_ttc, tt.total_tva';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line.' as tt';
- $sql .= ' WHERE tt.'.$this->fk_element.' = '.((int) $id);
+ $sql .= " WHERE tt.".$this->fk_element.' = '.((int) $id);
$total_ht = 0; $total_tva = 0; $total_ttc = 0;
@@ -981,18 +981,18 @@ class ExpenseReport extends CommonObject
if ($result) {
$num = $this->db->num_rows($result);
$i = 0;
- while ($i < $num) :
+ while ($i < $num) {
$objp = $this->db->fetch_object($result);
$total_ht += $objp->total_ht;
$total_tva += $objp->total_tva;
$i++;
- endwhile;
+ }
$total_ttc = $total_ht + $total_tva;
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET";
- $sql .= " total_ht = ".price2num($total_ht, 'MT');
- $sql .= " , total_ttc = ".price2num($total_ttc, 'MT');
- $sql .= " , total_tva = ".price2num($total_tva, 'MT');
+ $sql .= " total_ht = ".((float) price2num($total_ht, 'MT'));
+ $sql .= " , total_ttc = ".((float) price2num($total_ttc, 'MT'));
+ $sql .= " , total_tva = ".((float) price2num($total_tva, 'MT'));
$sql .= " WHERE rowid = ".((int) $id);
$result = $this->db->query($sql);
if ($result) :
@@ -1024,14 +1024,14 @@ class ExpenseReport extends CommonObject
$this->lines = array();
$sql = ' SELECT de.rowid, de.comments, de.qty, de.value_unit, de.date, de.rang,';
- $sql .= ' de.'.$this->fk_element.', de.fk_c_type_fees, de.fk_c_exp_tax_cat, de.fk_projet as fk_project, de.tva_tx, de.fk_ecm_files,';
+ $sql .= " de.".$this->fk_element.", de.fk_c_type_fees, de.fk_c_exp_tax_cat, de.fk_projet as fk_project, de.tva_tx, de.fk_ecm_files,";
$sql .= ' de.total_ht, de.total_tva, de.total_ttc,';
$sql .= ' ctf.code as code_type_fees, ctf.label as libelle_type_fees,';
$sql .= ' p.ref as ref_projet, p.title as title_projet';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line.' as de';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_type_fees as ctf ON de.fk_c_type_fees = ctf.id';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'projet as p ON de.fk_projet = p.rowid';
- $sql .= ' WHERE de.'.$this->fk_element.' = '.((int) $this->id);
+ $sql .= " WHERE de.".$this->fk_element." = ".((int) $this->id);
if (!empty($conf->global->EXPENSEREPORT_LINES_SORTED_BY_ROWID)) {
$sql .= ' ORDER BY de.rang ASC, de.rowid ASC';
} else {
@@ -2025,12 +2025,12 @@ class ExpenseReport extends CommonObject
public function offsetAlreadyGiven()
{
$sql = 'SELECT e.rowid FROM '.MAIN_DB_PREFIX.'expensereport e';
- $sql .= ' INNER JOIN '.MAIN_DB_PREFIX.'expensereport_det d ON (e.rowid = d.fk_expensereport)';
- $sql .= ' INNER JOIN '.MAIN_DB_PREFIX.'c_type_fees f ON (d.fk_c_type_fees = f.id AND f.code = "EX_KME")';
- $sql .= ' WHERE e.fk_user_author = '.(int) $this->fk_user_author;
- $sql .= ' AND YEAR(d.date) = "'.dol_print_date($this->line->date, '%Y').'" AND MONTH(d.date) = "'.dol_print_date($this->line->date, '%m').'"';
+ $sql .= " INNER JOIN ".MAIN_DB_PREFIX."expensereport_det d ON (e.rowid = d.fk_expensereport)";
+ $sql .= " INNER JOIN ".MAIN_DB_PREFIX."c_type_fees f ON (d.fk_c_type_fees = f.id AND f.code = 'EX_KME')";
+ $sql .= " WHERE e.fk_user_author = ".(int) $this->fk_user_author;
+ $sql .= " AND YEAR(d.date) = '".dol_print_date($this->line->date, '%Y')."' AND MONTH(d.date) = '".dol_print_date($this->line->date, '%m')."'";
if (!empty($this->line->id)) {
- $sql .= ' AND d.rowid <> '.$this->line->id;
+ $sql .= ' AND d.rowid <> '.((int) $this->line->id);
}
dol_syslog(get_class($this)."::offsetAlreadyGiven sql=".$sql);
diff --git a/htdocs/expensereport/class/expensereport_rule.class.php b/htdocs/expensereport/class/expensereport_rule.class.php
index 03ecab10f6a..6299dd7c5bd 100644
--- a/htdocs/expensereport/class/expensereport_rule.class.php
+++ b/htdocs/expensereport/class/expensereport_rule.class.php
@@ -157,7 +157,7 @@ class ExpenseReportRule extends CoreObject
$sql .= ' FROM '.MAIN_DB_PREFIX.'expensereport_rules er';
$sql .= ' WHERE er.entity IN (0,'.getEntity('').')';
if (!empty($fk_c_type_fees)) {
- $sql .= ' AND er.fk_c_type_fees IN (-1, '.$fk_c_type_fees.')';
+ $sql .= ' AND er.fk_c_type_fees IN (-1, '.((int) $fk_c_type_fees).')';
}
if (!empty($date)) {
$sql .= " AND er.dates <= '".dol_print_date($date, '%Y-%m-%d')."'";
@@ -170,7 +170,7 @@ class ExpenseReportRule extends CoreObject
}
$sql .= ' ORDER BY er.is_for_all, er.fk_usergroup, er.fk_user';
- dol_syslog("ExpenseReportRule::getAllRule sql=".$sql);
+ dol_syslog("ExpenseReportRule::getAllRule");
$resql = $db->query($sql);
if ($resql) {
diff --git a/htdocs/expensereport/class/expensereportstats.class.php b/htdocs/expensereport/class/expensereportstats.class.php
index 13e7a44bc7f..e36b1c1e49e 100644
--- a/htdocs/expensereport/class/expensereportstats.class.php
+++ b/htdocs/expensereport/class/expensereportstats.class.php
@@ -94,7 +94,7 @@ class ExpenseReportStats extends Stats
*/
public function getNbByYear()
{
- $sql = "SELECT YEAR(".$this->db->ifsql('e.'.$this->datetouse.' IS NULL', 'e.date_create', 'e.'.$this->datetouse).") as dm, count(*)";
+ $sql = "SELECT YEAR(".$this->db->ifsql("e.".$this->datetouse." IS NULL", "e.date_create", "e.".$this->datetouse).") as dm, count(*)";
$sql .= " FROM ".$this->from;
$sql .= " GROUP BY dm DESC";
$sql .= " WHERE ".$this->where;
@@ -112,7 +112,7 @@ class ExpenseReportStats extends Stats
*/
public function getNbByMonth($year, $format = 0)
{
- $sql = "SELECT MONTH(".$this->db->ifsql('e.'.$this->datetouse.' IS NULL', 'e.date_create', 'e.'.$this->datetouse).") as dm, count(*)";
+ $sql = "SELECT MONTH(".$this->db->ifsql("e.".$this->datetouse." IS NULL", "e.date_create", "e.".$this->datetouse).") as dm, count(*)";
$sql .= " FROM ".$this->from;
$sql .= " WHERE YEAR(e.".$this->datetouse.") = ".((int) $year);
$sql .= " AND ".$this->where;
@@ -134,9 +134,9 @@ class ExpenseReportStats extends Stats
*/
public function getAmountByMonth($year, $format = 0)
{
- $sql = "SELECT date_format(".$this->db->ifsql('e.'.$this->datetouse.' IS NULL', 'e.date_create', 'e.'.$this->datetouse).",'%m') as dm, sum(".$this->field.")";
+ $sql = "SELECT date_format(".$this->db->ifsql("e.".$this->datetouse." IS NULL", "e.date_create", "e.".$this->datetouse).",'%m') as dm, sum(".$this->field.")";
$sql .= " FROM ".$this->from;
- $sql .= " WHERE date_format(".$this->db->ifsql('e.'.$this->datetouse.' IS NULL', 'e.date_create', 'e.'.$this->datetouse).",'%Y') = '".$this->db->escape($year)."'";
+ $sql .= " WHERE date_format(".$this->db->ifsql("e.".$this->datetouse." IS NULL", "e.date_create", "e.".$this->datetouse).",'%Y') = '".$this->db->escape($year)."'";
$sql .= " AND ".$this->where;
$sql .= " GROUP BY dm";
$sql .= $this->db->order('dm', 'DESC');
@@ -154,9 +154,9 @@ class ExpenseReportStats extends Stats
*/
public function getAverageByMonth($year)
{
- $sql = "SELECT date_format(".$this->db->ifsql('e.'.$this->datetouse.' IS NULL', 'e.date_create', 'e.'.$this->datetouse).",'%m') as dm, avg(".$this->field.")";
+ $sql = "SELECT date_format(".$this->db->ifsql("e.".$this->datetouse." IS NULL", "e.date_create", "e.".$this->datetouse).",'%m') as dm, avg(".$this->field.")";
$sql .= " FROM ".$this->from;
- $sql .= " WHERE date_format(".$this->db->ifsql('e.'.$this->datetouse.' IS NULL', 'e.date_create', 'e.'.$this->datetouse).",'%Y') = '".$this->db->escape($year)."'";
+ $sql .= " WHERE date_format(".$this->db->ifsql("e.".$this->datetouse." IS NULL", "e.date_create", "e.".$this->datetouse).",'%Y') = '".$this->db->escape($year)."'";
$sql .= " AND ".$this->where;
$sql .= " GROUP BY dm";
$sql .= $this->db->order('dm', 'DESC');
@@ -171,7 +171,7 @@ class ExpenseReportStats extends Stats
*/
public function getAllByYear()
{
- $sql = "SELECT date_format(".$this->db->ifsql('e.'.$this->datetouse.' IS NULL', 'e.date_create', 'e.'.$this->datetouse).",'%Y') as year, count(*) as nb, sum(".$this->field.") as total, avg(".$this->field.") as avg";
+ $sql = "SELECT date_format(".$this->db->ifsql("e.".$this->datetouse." IS NULL", "e.date_create", "e.".$this->datetouse).",'%Y') as year, count(*) as nb, sum(".$this->field.") as total, avg(".$this->field.") as avg";
$sql .= " FROM ".$this->from;
$sql .= " WHERE ".$this->where;
$sql .= " GROUP BY year";
diff --git a/htdocs/exports/class/export.class.php b/htdocs/exports/class/export.class.php
index 483935c7fdf..50acd166237 100644
--- a/htdocs/exports/class/export.class.php
+++ b/htdocs/exports/class/export.class.php
@@ -455,14 +455,14 @@ class Export
} else {
$keyList = 'rowid';
}
- $sql = 'SELECT '.$keyList.' as rowid, '.$InfoFieldList[2].' as label'.(empty($InfoFieldList[3]) ? '' : ', '.$InfoFieldList[3].' as code');
+ $sql = "SELECT ".$keyList." as rowid, ".$InfoFieldList[2]." as label".(empty($InfoFieldList[3]) ? "" : ", ".$InfoFieldList[3]." as code");
if ($InfoFieldList[1] == 'c_stcomm') {
- $sql = 'SELECT id as id, '.$keyList.' as rowid, '.$InfoFieldList[2].' as label'.(empty($InfoFieldList[3]) ? '' : ', '.$InfoFieldList[3].' as code');
+ $sql = "SELECT id as id, ".$keyList." as rowid, ".$InfoFieldList[2]." as label".(empty($InfoFieldList[3]) ? "" : ", ".$InfoFieldList[3].' as code');
}
if ($InfoFieldList[1] == 'c_country') {
- $sql = 'SELECT '.$keyList.' as rowid, '.$InfoFieldList[2].' as label, code as code';
+ $sql = "SELECT ".$keyList." as rowid, ".$InfoFieldList[2]." as label, code as code";
}
- $sql .= ' FROM '.MAIN_DB_PREFIX.$InfoFieldList[1];
+ $sql .= " FROM ".MAIN_DB_PREFIX.$InfoFieldList[1];
if (!empty($InfoFieldList[4])) {
$sql .= ' WHERE entity IN ('.getEntity($InfoFieldList[4]).')';
}
diff --git a/htdocs/fichinter/class/fichinter.class.php b/htdocs/fichinter/class/fichinter.class.php
index 6da1a30b618..23766a91bbe 100644
--- a/htdocs/fichinter/class/fichinter.class.php
+++ b/htdocs/fichinter/class/fichinter.class.php
@@ -1481,7 +1481,7 @@ class FichinterLigne extends CommonObjectLine
if ($rangToUse == -1) {
// Recupere rang max de la ligne d'intervention dans $rangmax
$sql = 'SELECT max(rang) as max FROM '.MAIN_DB_PREFIX.'fichinterdet';
- $sql .= ' WHERE fk_fichinter ='.$this->fk_fichinter;
+ $sql .= ' WHERE fk_fichinter = '.((int) $this->fk_fichinter);
$resql = $this->db->query($sql);
if ($resql) {
$obj = $this->db->fetch_object($resql);
@@ -1496,7 +1496,7 @@ class FichinterLigne extends CommonObjectLine
// Insertion dans base de la ligne
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'fichinterdet';
$sql .= ' (fk_fichinter, description, date, duree, rang)';
- $sql .= " VALUES (".$this->fk_fichinter.",";
+ $sql .= " VALUES (".((int) $this->fk_fichinter).",";
$sql .= " '".$this->db->escape($this->desc)."',";
$sql .= " '".$this->db->idate($this->datei)."',";
$sql .= " ".((int) $this->duration).",";
diff --git a/htdocs/fourn/class/fournisseur.commande.dispatch.class.php b/htdocs/fourn/class/fournisseur.commande.dispatch.class.php
index 39aaea1bbfe..fcf1c6a50f4 100644
--- a/htdocs/fourn/class/fournisseur.commande.dispatch.class.php
+++ b/htdocs/fourn/class/fournisseur.commande.dispatch.class.php
@@ -666,13 +666,13 @@ class CommandeFournisseurDispatch extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.comment') {
- $sqlwhere [] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere [] = $key." LIKE '%".$this->db->escape($value)."%'";
} elseif ($key == 't.datec' || $key == 't.tms' || $key == 't.eatby' || $key == 't.sellby' || $key == 't.batch') {
- $sqlwhere [] = $key.' = \''.$this->db->escape($value).'\'';
+ $sqlwhere [] = $key." = '".$this->db->escape($value)."'";
} elseif ($key == 'qty') {
- $sqlwhere [] = $key.' = '.((float) $value);
+ $sqlwhere [] = $key." = ".((float) $value);
} else {
- $sqlwhere [] = $key.' = '.((int) $value);
+ $sqlwhere [] = $key." = ".((int) $value);
}
}
}
diff --git a/htdocs/product/class/productcustomerprice.class.php b/htdocs/product/class/productcustomerprice.class.php
index 701b10093af..a5e2581d69b 100644
--- a/htdocs/product/class/productcustomerprice.class.php
+++ b/htdocs/product/class/productcustomerprice.class.php
@@ -404,15 +404,15 @@ class Productcustomerprice extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year
- $sql .= ' AND '.$key.' = \''.$this->db->escape($value).'\'';
+ $sql .= " AND ".$key." = '".$this->db->escape($value)."'";
} elseif ($key == 'soc.nom') {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
} elseif ($key == 'prod.ref' || $key == 'prod.label') {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
} elseif ($key == 't.price' || $key == 't.price_ttc') {
- $sql .= ' AND '.$key.' LIKE \'%'.price2num($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".price2num($value)."%'";
} else {
- $sql .= ' AND '.$key.' = '.((int) $value);
+ $sql .= " AND ".$key." = ".((int) $value);
}
}
}
@@ -521,11 +521,11 @@ class Productcustomerprice extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year
- $sql .= ' AND '.$key.' = \''.$value.'\'';
+ $sql .= " AND ".$key." = '".$db->escape($value)."'";
} elseif ($key == 'soc.nom') {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
} else {
- $sql .= ' AND '.$key.' = '.((int) $value);
+ $sql .= " AND ".$key." = ".((int) $value);
}
}
}
diff --git a/htdocs/product/stock/class/productstockentrepot.class.php b/htdocs/product/stock/class/productstockentrepot.class.php
index 0fdbba51041..0a9636c0290 100644
--- a/htdocs/product/stock/class/productstockentrepot.class.php
+++ b/htdocs/product/stock/class/productstockentrepot.class.php
@@ -273,7 +273,7 @@ class ProductStockEntrepot extends CommonObject
$sqlwhere = array();
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
- $sqlwhere [] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere [] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
if (count($sqlwhere) > 0) {
diff --git a/htdocs/public/recruitment/index.php b/htdocs/public/recruitment/index.php
index f6fdd94b6f1..e576d5abde2 100644
--- a/htdocs/public/recruitment/index.php
+++ b/htdocs/public/recruitment/index.php
@@ -261,15 +261,15 @@ if ($display_ticket_list) {
if (!empty($filter)) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year
- $sql .= ' AND '.$key.' = \''.$db->escape($value).'\'';
+ $sql .= " AND ".$key." = '".$db->escape($value)."'";
} elseif ($key == 't.fk_statut') {
if (is_array($value) && count($value) > 0) {
- $sql .= 'AND '.$key.' IN ('.$db->sanitize(implode(',', $value)).')';
+ $sql .= " AND ".$key.' IN ('.$db->sanitize(implode(',', $value)).')';
} else {
- $sql .= ' AND '.$key.' = '.((int) $value);
+ $sql .= " AND ".$key." = ".((int) $value);
}
} else {
- $sql .= ' AND '.$key.' LIKE \'%'.$db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$db->escape($value)."%'";
}
}
}
diff --git a/htdocs/public/ticket/list.php b/htdocs/public/ticket/list.php
index 2249dcaa930..5fea0ee94a1 100644
--- a/htdocs/public/ticket/list.php
+++ b/htdocs/public/ticket/list.php
@@ -359,17 +359,17 @@ if ($action == "view_ticketlist") {
if (!empty($filter)) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year
- $sql .= ' AND '.$key.' = \''.$db->escape($value).'\'';
+ $sql .= " AND ".$key." = '".$db->escape($value)."'";
} elseif (($key == 't.fk_user_assign') || ($key == 't.type_code') || ($key == 't.category_code') || ($key == 't.severity_code')) {
$sql .= " AND ".$key." = '".$db->escape($value)."'";
} elseif ($key == 't.fk_statut') {
if (is_array($value) && count($value) > 0) {
- $sql .= 'AND '.$key.' IN ('.$db->sanitize(implode(',', $value)).')';
+ $sql .= " AND ".$key." IN (".$db->sanitize(implode(',', $value)).")";
} else {
- $sql .= ' AND '.$key.' = '.((int) $value);
+ $sql .= " AND ".$key." = ".((int) $value);
}
} else {
- $sql .= ' AND '.$key.' LIKE \'%'.$db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$db->escape($value)."%'";
}
}
}
diff --git a/htdocs/resource/class/dolresource.class.php b/htdocs/resource/class/dolresource.class.php
index db70bc571bf..7020beced48 100644
--- a/htdocs/resource/class/dolresource.class.php
+++ b/htdocs/resource/class/dolresource.class.php
@@ -511,11 +511,11 @@ class Dolresource extends CommonObject
if (!empty($filter)) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) {
- $sql .= ' AND '.$key.' = \''.$this->db->idate($value).'\'';
+ $sql .= " AND ".$key." = '".$this->db->idate($value)."'";
} elseif (strpos($key, 'ef.') !== false) {
$sql .= $value;
} else {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -591,9 +591,9 @@ class Dolresource extends CommonObject
if (!empty($filter)) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) {
- $sql .= ' AND '.$key.' = \''.$this->db->idate($value).'\'';
+ $sql .= " AND ".$key." = '".$this->db->idate($value)."'";
} else {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
@@ -675,9 +675,9 @@ class Dolresource extends CommonObject
if (!empty($filter)) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) {
- $sql .= ' AND '.$key.' = \''.$this->db->idate($value).'\'';
+ $sql .= " AND ".$key." = '".$this->db->idate($value)."'";
} else {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php
index e2860d240d7..a53d649c2b3 100644
--- a/htdocs/ticket/class/ticket.class.php
+++ b/htdocs/ticket/class/ticket.class.php
@@ -714,17 +714,17 @@ class Ticket extends CommonObject
if (!empty($filter)) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year
- $sql .= ' AND '.$key." = '".$this->db->escape($value)."'";
+ $sql .= " AND ".$key." = '".$this->db->escape($value)."'";
} elseif (($key == 't.fk_user_assign') || ($key == 't.type_code') || ($key == 't.category_code') || ($key == 't.severity_code') || ($key == 't.fk_soc')) {
$sql .= " AND ".$key." = '".$this->db->escape($value)."'";
} elseif ($key == 't.fk_statut') {
if (is_array($value) && count($value) > 0) {
- $sql .= 'AND '.$key.' IN ('.$this->db->sanitize(implode(',', $value)).')';
+ $sql .= " AND ".$key." IN (".$this->db->sanitize(implode(',', $value)).")";
} else {
- $sql .= ' AND '.$key.' = '.((int) $value);
+ $sql .= " AND ".$key.' = '.((int) $value);
}
} else {
- $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
diff --git a/htdocs/website/class/website.class.php b/htdocs/website/class/website.class.php
index 0c9ced5e68f..893cd9a6bf1 100644
--- a/htdocs/website/class/website.class.php
+++ b/htdocs/website/class/website.class.php
@@ -415,7 +415,7 @@ class Website extends CommonObject
$sqlwhere = array();
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
- $sqlwhere [] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
if (count($sqlwhere) > 0) {
diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php
index f255b4e92e5..275c3c94afe 100644
--- a/htdocs/website/class/websitepage.class.php
+++ b/htdocs/website/class/websitepage.class.php
@@ -417,7 +417,7 @@ class WebsitePage extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid' || $key == 't.fk_website' || $key == 'status') {
- $sqlwhere[] = $key.' = '.((int) $value);
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif ($key == 'type_container') {
$sqlwhere[] = $key." = '".$this->db->escape($value)."'";
} elseif ($key == 'lang' || $key == 't.lang') {
@@ -432,16 +432,16 @@ class WebsitePage extends CommonObject
}
$stringtouse = $key." IN (".$this->db->sanitize(join(',', $listoflang), 1).")";
if ($foundnull) {
- $stringtouse = '('.$stringtouse.' OR '.$key.' IS NULL)';
+ $stringtouse = "(".$stringtouse." OR ".$key." IS NULL)";
}
$sqlwhere[] = $stringtouse;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
if (count($sqlwhere) > 0) {
- $sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
+ $sql .= " AND (".implode(' '.$filtermode.' ', $sqlwhere).')';
}
if (!empty($sortfield)) {
@@ -519,7 +519,7 @@ class WebsitePage extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid' || $key == 't.fk_website' || $key == 'status') {
- $sqlwhere[] = $key.' = '.((int) $value);
+ $sqlwhere[] = $key." = ".((int) $value);
} elseif ($key == 'type_container') {
$sqlwhere[] = $key." = '".$this->db->escape($value)."'";
} elseif ($key == 'lang' || $key == 't.lang') {
@@ -534,11 +534,11 @@ class WebsitePage extends CommonObject
}
$stringtouse = $key." IN (".$this->db->sanitize(join(',', $listoflang), 1).")";
if ($foundnull) {
- $stringtouse = '('.$stringtouse.' OR '.$key.' IS NULL)';
+ $stringtouse = "(".$stringtouse." OR ".$key." IS NULL)";
}
$sqlwhere[] = $stringtouse;
} else {
- $sqlwhere[] = $key.' LIKE \'%'.$this->db->escape($value).'%\'';
+ $sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
}
From 3d72a21396d8e565311d4998c5183502797cee7e Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 03:09:18 +0200
Subject: [PATCH 106/953] Clean code
---
.../fourn/class/fournisseur.facture.class.php | 6 +-
htdocs/fourn/class/paiementfourn.class.php | 6 +-
htdocs/fourn/commande/card.php | 10 +-
htdocs/fourn/commande/list.php | 2 +-
htdocs/fourn/facture/list.php | 4 +-
htdocs/fourn/facture/paiement.php | 4 +-
htdocs/install/lib/repair.lib.php | 2 +-
htdocs/install/repair.php | 34 ++---
htdocs/install/step5.php | 16 +--
htdocs/install/upgrade.php | 3 +-
htdocs/install/upgrade2.php | 38 +++---
.../class/intracommreport.class.php | 2 +-
htdocs/loan/payment/card.php | 4 +-
htdocs/margin/checkMargins.php | 4 +-
.../core/modules/modMyModule.class.php | 8 +-
.../class/multicurrency.class.php | 24 ++--
htdocs/product/class/product.class.php | 9 +-
.../class/productcustomerprice.class.php | 2 +-
htdocs/product/fournisseurs.php | 6 +-
.../inventory/class/inventory.class.php | 4 +-
htdocs/product/stats/contrat.php | 8 +-
htdocs/product/stats/mo.php | 8 +-
htdocs/product/stock/class/entrepot.class.php | 2 +-
.../stock/class/mouvementstock.class.php | 11 +-
htdocs/product/stock/list.php | 2 +-
htdocs/product/stock/replenish.php | 40 +++---
htdocs/product/stock/stockatdate.php | 4 +-
htdocs/projet/class/projectstats.class.php | 6 +-
htdocs/projet/class/taskstats.class.php | 4 +-
htdocs/public/emailing/mailing-read.php | 4 +-
.../public/emailing/mailing-unsubscribe.php | 2 +-
htdocs/public/payment/paymentok.php | 2 +-
htdocs/public/recruitment/index.php | 4 +-
htdocs/public/ticket/list.php | 4 +-
htdocs/reception/list.php | 2 +-
htdocs/societe/admin/societe.php | 8 +-
htdocs/societe/class/societe.class.php | 8 +-
htdocs/societe/paymentmodes.php | 2 +-
htdocs/stripe/class/stripe.class.php | 6 +-
htdocs/supplier_proposal/list.php | 2 +-
htdocs/takepos/invoice.php | 5 +-
htdocs/ticket/class/ticket.class.php | 120 +-----------------
htdocs/user/class/user.class.php | 8 +-
htdocs/user/notify/card.php | 2 +-
.../class/ProductCombination.class.php | 2 +-
htdocs/website/class/website.class.php | 4 +-
htdocs/website/index.php | 8 +-
47 files changed, 172 insertions(+), 294 deletions(-)
diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index eab1d445558..ccfe09eec0c 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -506,7 +506,7 @@ class FactureFournisseur extends CommonInvoice
dol_syslog("There is ".count($this->lines)." lines that are invoice lines objects");
foreach ($this->lines as $i => $val) {
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'facture_fourn_det (fk_facture_fourn, special_code, fk_remise_except)';
- $sql .= ' VALUES ('.$this->id.','.intval($this->lines[$i]->special_code).','.($this->lines[$i]->fk_remise_except > 0 ? $this->lines[$i]->fk_remise_except : 'NULL').')';
+ $sql .= " VALUES (".((int) $this->id).", ".((int) $this->lines[$i]->special_code).", ".($this->lines[$i]->fk_remise_except > 0 ? ((int) $this->lines[$i]->fk_remise_except) : 'NULL').')';
$resql_insert = $this->db->query($sql);
if ($resql_insert) {
@@ -552,7 +552,7 @@ class FactureFournisseur extends CommonInvoice
}
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'facture_fourn_det (fk_facture_fourn, special_code, fk_remise_except)';
- $sql .= ' VALUES ('.$this->id.','.intval($this->lines[$i]->special_code).','.($this->lines[$i]->fk_remise_except > 0 ? $this->lines[$i]->fk_remise_except : 'NULL').')';
+ $sql .= " VALUES (".((int) $this->id).", ".((int) $this->lines[$i]->special_code).", ".($this->lines[$i]->fk_remise_except > 0 ? ((int) $this->lines[$i]->fk_remise_except) : 'NULL').')';
$resql_insert = $this->db->query($sql);
if ($resql_insert) {
@@ -1375,7 +1375,7 @@ class FactureFournisseur extends CommonInvoice
if ($close_note) {
$sql .= ", close_note='".$this->db->escape($close_note)."'";
}
- $sql .= ', fk_user_closing = '.$user->id;
+ $sql .= ', fk_user_closing = '.((int) $user->id);
$sql .= ", date_closing = '".$this->db->idate($now)."'";
$sql .= ' WHERE rowid = '.((int) $this->id);
diff --git a/htdocs/fourn/class/paiementfourn.class.php b/htdocs/fourn/class/paiementfourn.class.php
index 2227e2b8c0a..fa58139b7e7 100644
--- a/htdocs/fourn/class/paiementfourn.class.php
+++ b/htdocs/fourn/class/paiementfourn.class.php
@@ -201,8 +201,8 @@ class PaiementFourn extends Paiement
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'paiementfourn (';
$sql .= 'ref, entity, datec, datep, amount, multicurrency_amount, fk_paiement, num_paiement, note, fk_user_author, fk_bank)';
- $sql .= " VALUES ('".$this->db->escape($ref)."', ".$conf->entity.", '".$this->db->idate($now)."',";
- $sql .= " '".$this->db->idate($this->datepaye)."', '".$total."', '".$mtotal."', ".$this->paiementid.", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note_private)."', ".$user->id.", 0)";
+ $sql .= " VALUES ('".$this->db->escape($ref)."', ".((int) $conf->entity).", '".$this->db->idate($now)."',";
+ $sql .= " '".$this->db->idate($this->datepaye)."', ".((float) $total).", ".((float) $mtotal).", ".((int) $this->paiementid).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note_private)."', ".((int) $user->id).", 0)";
$resql = $this->db->query($sql);
if ($resql) {
@@ -214,7 +214,7 @@ class PaiementFourn extends Paiement
if (is_numeric($amount) && $amount <> 0) {
$amount = price2num($amount);
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'paiementfourn_facturefourn (fk_facturefourn, fk_paiementfourn, amount, multicurrency_amount)';
- $sql .= ' VALUES ('.$facid.','.$this->id.',\''.$amount.'\', \''.$this->multicurrency_amounts[$key].'\')';
+ $sql .= " VALUES (".((int) $facid).", ".((int) $this->id).", ".((float) $amount).', '.((float) $this->multicurrency_amounts[$key]).')';
$resql = $this->db->query($sql);
if ($resql) {
$invoice = new FactureFournisseur($this->db);
diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php
index b981d46b764..c2cb03a27cb 100644
--- a/htdocs/fourn/commande/card.php
+++ b/htdocs/fourn/commande/card.php
@@ -243,9 +243,9 @@ if (empty($reshook)) {
// Update supplier
$sql = 'UPDATE '.MAIN_DB_PREFIX.'commande_fournisseur';
- $sql .= ' SET fk_soc='.$new_socid;
- $sql .= ' WHERE fk_soc='.$object->thirdparty->id;
- $sql .= ' AND rowid='.$object->id;
+ $sql .= ' SET fk_soc = '.((int) $new_socid);
+ $sql .= ' WHERE fk_soc = '.((int) $object->thirdparty->id);
+ $sql .= ' AND rowid = '.((int) $object->id);
$res = $db->query($sql);
@@ -258,8 +258,8 @@ if (empty($reshook)) {
foreach ($object->lines as $l) {
$sql = 'SELECT price, unitprice, tva_tx, ref_fourn';
$sql .= ' FROM '.MAIN_DB_PREFIX.'product_fournisseur_price';
- $sql .= ' WHERE fk_product='.$l->fk_product;
- $sql .= ' AND fk_soc='.$new_socid;
+ $sql .= ' WHERE fk_product = '.((int) $l->fk_product);
+ $sql .= ' AND fk_soc = '.((int) $new_socid);
$sql .= ' ORDER BY unitprice ASC';
$resql = $db->query($sql);
diff --git a/htdocs/fourn/commande/list.php b/htdocs/fourn/commande/list.php
index e4d10cbb23d..ef39e7502f6 100644
--- a/htdocs/fourn/commande/list.php
+++ b/htdocs/fourn/commande/list.php
@@ -769,7 +769,7 @@ if ($search_total_ttc != '') {
$sql .= natural_search('cf.total_ttc', $search_total_ttc, 1);
}
if ($search_multicurrency_code != '') {
- $sql .= ' AND cf.multicurrency_code = "'.$db->escape($search_multicurrency_code).'"';
+ $sql .= " AND cf.multicurrency_code = '".$db->escape($search_multicurrency_code)."'";
}
if ($search_multicurrency_tx != '') {
$sql .= natural_search('cf.multicurrency_tx', $search_multicurrency_tx, 1);
diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php
index 527cd851709..358b1c59c1b 100644
--- a/htdocs/fourn/facture/list.php
+++ b/htdocs/fourn/facture/list.php
@@ -606,7 +606,7 @@ if ($filter && $filter != -1) {
$aFilter = explode(',', $filter);
foreach ($aFilter as $fil) {
$filt = explode(':', $fil);
- $sql .= ' AND '.$db->escape(trim($filt[0]))." = '".$db->escape(trim($filt[1]))."'";
+ $sql .= " AND ".$db->escape(trim($filt[0]))." = '".$db->escape(trim($filt[1]))."'";
}
}
if ($search_sale > 0) {
@@ -655,7 +655,7 @@ if (!$search_all) {
// Add HAVING from hooks
$parameters = array();
$reshook = $hookmanager->executeHooks('printFieldListHaving', $parameters, $object); // Note that $action and $object may have been modified by hook
-$sql .= !empty($hookmanager->resPrint) ? (' HAVING 1=1 ' . $hookmanager->resPrint) : '';
+$sql .= !empty($hookmanager->resPrint) ? (" HAVING 1=1 " . $hookmanager->resPrint) : "";
$sql .= $db->order($sortfield, $sortorder);
diff --git a/htdocs/fourn/facture/paiement.php b/htdocs/fourn/facture/paiement.php
index f0967453701..b5bc33b78c0 100644
--- a/htdocs/fourn/facture/paiement.php
+++ b/htdocs/fourn/facture/paiement.php
@@ -510,8 +510,8 @@ if ($action == 'create' || $action == 'confirm_paiement' || $action == 'add_paie
$sql .= ' SUM(pf.amount) as am, SUM(pf.multicurrency_amount) as multicurrency_am';
$sql .= ' FROM '.MAIN_DB_PREFIX.'facture_fourn as f';
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'paiementfourn_facturefourn as pf ON pf.fk_facturefourn = f.rowid';
- $sql .= " WHERE f.entity = ".$conf->entity;
- $sql .= ' AND f.fk_soc = '.$object->socid;
+ $sql .= " WHERE f.entity = ".((int) $conf->entity);
+ $sql .= ' AND f.fk_soc = '.((int) $object->socid);
$sql .= ' AND f.paye = 0';
$sql .= ' AND f.fk_statut = 1'; // Status=0 => unvalidated, Status=2 => canceled
if ($object->type != FactureFournisseur::TYPE_CREDIT_NOTE) {
diff --git a/htdocs/install/lib/repair.lib.php b/htdocs/install/lib/repair.lib.php
index bd54e55ebde..aa0866fac69 100644
--- a/htdocs/install/lib/repair.lib.php
+++ b/htdocs/install/lib/repair.lib.php
@@ -88,7 +88,7 @@ function checkLinkedElements($sourcetype, $targettype)
$out = $langs->trans('SourceType').': '.$sourcetype.' => '.$langs->trans('TargetType').': '.$targettype.' ';
$sql = 'SELECT rowid, fk_source, fk_target FROM '.MAIN_DB_PREFIX.'element_element';
- $sql .= ' WHERE sourcetype="'.$sourcetype.'" AND targettype="'.$targettype.'"';
+ $sql .= " WHERE sourcetype='".$db->escape($sourcetype)."' AND targettype='".$db->escape($targettype)."'";
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
diff --git a/htdocs/install/repair.php b/htdocs/install/repair.php
index 037c7ee4b82..8160f6e89b8 100644
--- a/htdocs/install/repair.php
+++ b/htdocs/install/repair.php
@@ -1236,7 +1236,7 @@ if ($ok && GETPOST('force_utf8_on_tables', 'alpha')) {
print '';
print $table;
- $sql = 'ALTER TABLE '.$table.' CONVERT TO CHARACTER SET utf8 COLLATE utf8_unicode_ci';
+ $sql = "ALTER TABLE ".$table." CONVERT TO CHARACTER SET utf8 COLLATE utf8_unicode_ci";
print '';
if ($force_utf8_on_tables == 'confirmed') {
$resql = $db->query($sql);
@@ -1282,8 +1282,8 @@ if ($ok && GETPOST('force_utf8mb4_on_tables', 'alpha')) {
print ' ';
print $table;
- $sql1 = 'ALTER TABLE '.$table.' ROW_FORMAT=dynamic;';
- $sql2 = 'ALTER TABLE '.$table.' CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci';
+ $sql1 = "ALTER TABLE ".$table." ROW_FORMAT=dynamic";
+ $sql2 = "ALTER TABLE ".$table." CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci";
print '';
print '';
if ($force_utf8mb4_on_tables == 'confirmed') {
@@ -1407,25 +1407,25 @@ if ($ok && GETPOST('repair_link_dispatch_lines_supplier_order_lines')) {
$first_iteration = false;
} else {
$sql_attach_values = array(
- $obj_dispatch->fk_commande,
- $obj_dispatch->fk_product,
- $obj_line->rowid,
- $qty_for_line,
- $obj_dispatch->fk_entrepot,
- $obj_dispatch->fk_user,
- $obj_dispatch->datec ? '"'.$db->escape($obj_dispatch->datec).'"' : 'NULL',
- $obj_dispatch->comment ? '"'.$db->escape($obj_dispatch->comment).'"' : 'NULL',
- $obj_dispatch->status ?: 'NULL',
- $obj_dispatch->tms ? '"'.$db->escape($obj_dispatch->tms).'"' : 'NULL',
- $obj_dispatch->batch ?: 'NULL',
- $obj_dispatch->eatby ? '"'.$db->escape($obj_dispatch->eatby).'"' : 'NULL',
- $obj_dispatch->sellby ? '"'.$db->escape($obj_dispatch->sellby).'"' : 'NULL'
+ ((int) $obj_dispatch->fk_commande),
+ ((int) $obj_dispatch->fk_product),
+ ((int) $obj_line->rowid),
+ ((float) $qty_for_line),
+ ((int) $obj_dispatch->fk_entrepot),
+ ((int) $obj_dispatch->fk_user),
+ $obj_dispatch->datec ? "'".$db->idate($db->jdate($obj_dispatch->datec))."'" : 'NULL',
+ $obj_dispatch->comment ? "'".$db->escape($obj_dispatch->comment)."'" : 'NULL',
+ $obj_dispatch->status ? ((int) $obj_dispatch->status) : 'NULL',
+ $obj_dispatch->tms ? "'".$db->idate($db->jdate($obj_dispatch->tms))."'" : 'NULL',
+ $obj_dispatch->batch ? "'".$db->escape($obj_dispatch->batch)."'" : 'NULL',
+ $obj_dispatch->eatby ? "'".$db->escape($obj_dispatch->eatby)."'" : 'NULL',
+ $obj_dispatch->sellby ? "'".$db->escape($obj_dispatch->sellby)."'" : 'NULL'
);
$sql_attach_values = join(', ', $sql_attach_values);
$sql_attach = 'INSERT INTO '.MAIN_DB_PREFIX.'commande_fournisseur_dispatch';
$sql_attach .= ' (fk_commande, fk_product, fk_commandefourndet, qty, fk_entrepot, fk_user, datec, comment, status, tms, batch, eatby, sellby)';
- $sql_attach .= ' VALUES ('.$sql_attach_values.')';
+ $sql_attach .= " VALUES (".$sql_attach_values.")";
}
if ($repair_link_dispatch_lines_supplier_order_lines == 'confirmed') {
diff --git a/htdocs/install/step5.php b/htdocs/install/step5.php
index 0958ef7bb3b..b434612afcd 100644
--- a/htdocs/install/step5.php
+++ b/htdocs/install/step5.php
@@ -234,7 +234,7 @@ if ($action == "set" || empty($action) || preg_match('/upgrade/i', $action)) {
// Insert MAIN_VERSION_FIRST_INSTALL in a dedicated transaction. So if it fails (when first install was already done), we can do other following requests.
$db->begin();
dolibarr_install_syslog('step5: set MAIN_VERSION_FIRST_INSTALL const to '.$targetversion, LOG_DEBUG);
- $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) values(".$db->encrypt('MAIN_VERSION_FIRST_INSTALL', 1).",".$db->encrypt($targetversion, 1).",'chaine',0,'Dolibarr version when first install',0)");
+ $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name, value, type, visible, note, entity) values('".$db->escape($db->encrypt('MAIN_VERSION_FIRST_INSTALL'))."', '".$db->escape($db->encrypt($targetversion))."', 'chaine', 0, 'Dolibarr version when first install', 0)");
if ($resql) {
$conf->global->MAIN_VERSION_FIRST_INSTALL = $targetversion;
$db->commit();
@@ -246,11 +246,11 @@ if ($action == "set" || empty($action) || preg_match('/upgrade/i', $action)) {
$db->begin();
dolibarr_install_syslog('step5: set MAIN_VERSION_LAST_INSTALL const to '.$targetversion, LOG_DEBUG);
- $resql = $db->query("DELETE FROM ".MAIN_DB_PREFIX."const WHERE ".$db->decrypt('name')."='MAIN_VERSION_LAST_INSTALL'");
+ $resql = $db->query("DELETE FROM ".MAIN_DB_PREFIX."const WHERE ".$db->decrypt('name')." = 'MAIN_VERSION_LAST_INSTALL'");
if (!$resql) {
dol_print_error($db, 'Error in setup program');
}
- $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) values(".$db->encrypt('MAIN_VERSION_LAST_INSTALL', 1).",".$db->encrypt($targetversion, 1).",'chaine',0,'Dolibarr version when last install',0)");
+ $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) values('".$db->escape($db->encrypt('MAIN_VERSION_LAST_INSTALL'))."', '".$db->escape($db->encrypt($targetversion))."', 'chaine', 0, 'Dolibarr version when last install', 0)");
if (!$resql) {
dol_print_error($db, 'Error in setup program');
}
@@ -258,11 +258,11 @@ if ($action == "set" || empty($action) || preg_match('/upgrade/i', $action)) {
if ($useforcedwizard) {
dolibarr_install_syslog('step5: set MAIN_REMOVE_INSTALL_WARNING const to 1', LOG_DEBUG);
- $resql = $db->query("DELETE FROM ".MAIN_DB_PREFIX."const WHERE ".$db->decrypt('name')."='MAIN_REMOVE_INSTALL_WARNING'");
+ $resql = $db->query("DELETE FROM ".MAIN_DB_PREFIX."const WHERE ".$db->decrypt('name')." = 'MAIN_REMOVE_INSTALL_WARNING'");
if (!$resql) {
dol_print_error($db, 'Error in setup program');
}
- $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) values(".$db->encrypt('MAIN_REMOVE_INSTALL_WARNING', 1).",".$db->encrypt(1, 1).",'chaine',1,'Disable install warnings',0)");
+ $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) values('".$db->escape($db->encrypt('MAIN_REMOVE_INSTALL_WARNING'))."', '".$db->escape($db->encrypt(1))."', 'chaine', 1, 'Disable install warnings', 0)");
if (!$resql) {
dol_print_error($db, 'Error in setup program');
}
@@ -326,11 +326,11 @@ if ($action == "set" || empty($action) || preg_match('/upgrade/i', $action)) {
if ($tagdatabase) {
dolibarr_install_syslog('step5: set MAIN_VERSION_LAST_UPGRADE const to value '.$targetversion);
- $resql = $db->query("DELETE FROM ".MAIN_DB_PREFIX."const WHERE ".$db->decrypt('name')."='MAIN_VERSION_LAST_UPGRADE'");
+ $resql = $db->query("DELETE FROM ".MAIN_DB_PREFIX."const WHERE ".$db->decrypt('name')." = 'MAIN_VERSION_LAST_UPGRADE'");
if (!$resql) {
dol_print_error($db, 'Error in setup program');
}
- $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) VALUES (".$db->encrypt('MAIN_VERSION_LAST_UPGRADE', 1).",".$db->encrypt($targetversion, 1).",'chaine',0,'Dolibarr version for last upgrade',0)");
+ $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name, value, type, visible, note, entity) VALUES ('".$db->escape($db->encrypt('MAIN_VERSION_LAST_UPGRADE'))."', '".$db->escape($db->encrypt($targetversion))."', 'chaine', 0, 'Dolibarr version for last upgrade', 0)");
if (!$resql) {
dol_print_error($db, 'Error in setup program');
}
@@ -346,7 +346,7 @@ if ($action == "set" || empty($action) || preg_match('/upgrade/i', $action)) {
}
// May fail if parameter already defined
- $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) VALUES (".$db->encrypt('MAIN_LANG_DEFAULT', 1).",".$db->encrypt($setuplang, 1).",'chaine',0,'Default language',1)");
+ $resql = $db->query("INSERT INTO ".MAIN_DB_PREFIX."const(name,value,type,visible,note,entity) VALUES ('".$db->escape($db->encrypt('MAIN_LANG_DEFAULT'))."', '".$db->escape($db->encrypt($setuplang))."', 'chaine', 0, 'Default language', 1)");
//if (! $resql) dol_print_error($db,'Error in setup program');
$db->close();
diff --git a/htdocs/install/upgrade.php b/htdocs/install/upgrade.php
index e349317b0c4..7f4a8ac7bad 100644
--- a/htdocs/install/upgrade.php
+++ b/htdocs/install/upgrade.php
@@ -270,6 +270,7 @@ if (!GETPOST('action', 'aZ09') || preg_match('/upgrade/i', GETPOST('action', 'aZ
$values = $db->fetch_array($resql);
$i = 0;
$createsql = $values[1];
+ $reg = aray();
while (preg_match('/CONSTRAINT `(0_[0-9a-zA-Z]+|[_0-9a-zA-Z]+_ibfk_[0-9]+)`/i', $createsql, $reg) && $i < 100) {
$sqldrop = "ALTER TABLE ".$val." DROP FOREIGN KEY ".$reg[1];
$resqldrop = $db->query($sqldrop);
@@ -282,7 +283,7 @@ if (!GETPOST('action', 'aZ09') || preg_match('/upgrade/i', GETPOST('action', 'aZ
$db->free($resql);
} else {
if ($db->lasterrno() != 'DB_ERROR_NOSUCHTABLE') {
- print ' '.$sql.' : '.$db->lasterror()." \n";
+ print ''.dol_escape_htmltag($sql).' : '.dol_escape_htmltag($db->lasterror())." \n";
}
}
}
diff --git a/htdocs/install/upgrade2.php b/htdocs/install/upgrade2.php
index 974dd4c8324..368e05c5b04 100644
--- a/htdocs/install/upgrade2.php
+++ b/htdocs/install/upgrade2.php
@@ -692,7 +692,7 @@ function migrate_paiements($db, $langs, $conf)
$num = count($row);
for ($i = 0; $i < $num; $i++) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."paiement_facture (fk_facture, fk_paiement, amount)";
- $sql .= " VALUES (".$row[$i][1].",".$row[$i][0].",".$row[$i][2].")";
+ $sql .= " VALUES (".((int) $row[$i][1]).",".((int) $row[$i][0]).",".((float) $row[$i][2]).")";
$res += $db->query($sql);
@@ -803,7 +803,7 @@ function migrate_paiements_orphelins_1($db, $langs, $conf)
$facid = $obj->rowid;
$sql = "INSERT INTO ".MAIN_DB_PREFIX."paiement_facture (fk_facture, fk_paiement, amount)";
- $sql .= " VALUES (".((int) $facid).",".((int) $row[$i]['paymentid']).",".$row[$i]['pamount'].")";
+ $sql .= " VALUES (".((int) $facid).",".((int) $row[$i]['paymentid']).", ".((float) $row[$i]['pamount']).")";
$res += $db->query($sql);
@@ -914,7 +914,7 @@ function migrate_paiements_orphelins_2($db, $langs, $conf)
$facid = $obj->rowid;
$sql = "INSERT INTO ".MAIN_DB_PREFIX."paiement_facture (fk_facture, fk_paiement, amount)";
- $sql .= " VALUES (".((int) $facid).",".((int) $row[$i]['paymentid']).",".$row[$i]['pamount'].")";
+ $sql .= " VALUES (".((int) $facid).",".((int) $row[$i]['paymentid']).", ".((float) $row[$i]['pamount']).")";
$res += $db->query($sql);
@@ -1002,14 +1002,14 @@ function migrate_contracts_det($db, $langs, $conf)
$sql .= "date_ouverture_prevue, date_ouverture, date_fin_validite, tva_tx, qty,";
$sql .= "subprice, price_ht, fk_user_author, fk_user_ouverture)";
$sql .= " VALUES (";
- $sql .= $obj->cref.", ".($obj->fk_product ? $obj->fk_product : 0).", ";
+ $sql .= ((int) $obj->cref).", ".($obj->fk_product ? ((int) $obj->fk_product) : 0).", ";
$sql .= "0, ";
$sql .= "'".$db->escape($obj->label)."', null, ";
- $sql .= ($obj->date_contrat ? "'".$db->escape($obj->date_contrat)."'" : "null").", ";
+ $sql .= ($obj->date_contrat ? "'".$db->idate($db->jdate($obj->date_contrat))."'" : "null").", ";
$sql .= "null, ";
$sql .= "null, ";
- $sql .= "'".$db->escape($obj->tva_tx)."' , 1, ";
- $sql .= "'".$db->escape($obj->price)."', '".$db->escape($obj->price)."', ".$obj->fk_user_author.",";
+ $sql .= ((float) $obj->tva_tx).", 1, ";
+ $sql .= ((float) $obj->price).", ".((float) $obj->price).", ".((int) $obj->fk_user_author).",";
$sql .= "null";
$sql .= ")";
@@ -2020,7 +2020,7 @@ function migrate_commande_expedition($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sql = "INSERT INTO ".MAIN_DB_PREFIX."co_exp (fk_expedition,fk_commande)";
- $sql .= " VALUES (".$obj->rowid.",".$obj->fk_commande.")";
+ $sql .= " VALUES (".((int) $obj->rowid).", ".((int) $obj->fk_commande).")";
$resql2 = $db->query($sql);
if (!$resql2) {
@@ -2088,15 +2088,15 @@ function migrate_commande_livraison($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sql = "INSERT INTO ".MAIN_DB_PREFIX."co_liv (fk_livraison,fk_commande)";
- $sql .= " VALUES (".$obj->rowid.",".$obj->fk_commande.")";
+ $sql .= " VALUES (".((int) $obj->rowid).", ".((int) $obj->fk_commande).")";
$resql2 = $db->query($sql);
if ($resql2) {
$delivery_date = $db->jdate($obj->delivery_date);
$sqlu = "UPDATE ".MAIN_DB_PREFIX."livraison SET";
- $sqlu .= " ref_client='".$db->escape($obj->ref_client)."'";
- $sqlu .= ", date_livraison='".$db->idate($delivery_date)."'";
+ $sqlu .= " ref_client = '".$db->escape($obj->ref_client)."'";
+ $sqlu .= ", date_livraison = '".$db->idate($delivery_date)."'";
$sqlu .= " WHERE rowid = ".((int) $obj->rowid);
$resql3 = $db->query($sqlu);
if (!$resql3) {
@@ -3361,7 +3361,7 @@ function migrate_clean_association($db, $langs, $conf)
// And we insert only each record once
foreach ($couples as $key => $val) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."categorie_association(fk_categorie_mere,fk_categorie_fille)";
- $sql .= " VALUES(".$val['mere'].", ".$val['fille'].")";
+ $sql .= " VALUES(".((int) $val['mere']).", ".((int) $val['fille']).")";
dolibarr_install_syslog("upgrade: insert association");
$resqli = $db->query($sql);
if (!$resqli) {
@@ -3493,7 +3493,7 @@ function migrate_event_assignement($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sqlUpdate = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element) ";
- $sqlUpdate .= "VALUES(".$obj->id.", 'user', ".$obj->fk_user_action.")";
+ $sqlUpdate .= "VALUES(".((int) $obj->id).", 'user', ".((int) $obj->fk_user_action).")";
$result = $db->query($sqlUpdate);
if (!$result) {
@@ -3559,7 +3559,7 @@ function migrate_event_assignement_contact($db, $langs, $conf)
$obj = $db->fetch_object($resql);
$sqlUpdate = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element) ";
- $sqlUpdate .= "VALUES(".$obj->id.", 'socpeople', ".$obj->fk_contact.")";
+ $sqlUpdate .= "VALUES(".((int) $obj->id).", 'socpeople', ".((int) $obj->fk_contact).")";
$result = $db->query($sqlUpdate);
if (!$result) {
@@ -4605,7 +4605,7 @@ function migrate_users_socialnetworks()
$sqlupd .= ', googleplus=null';
$sqlupd .= ', youtube=null';
$sqlupd .= ', whatsapp=null';
- $sqlupd .= ' WHERE rowid='.$obj->rowid;
+ $sqlupd .= ' WHERE rowid = '.((int) $obj->rowid);
//print $sqlupd." ";
$resqlupd = $db->query($sqlupd);
if (!$resqlupd) {
@@ -4696,7 +4696,7 @@ function migrate_members_socialnetworks()
$sqlupd .= ', googleplus=null';
$sqlupd .= ', youtube=null';
$sqlupd .= ', whatsapp=null';
- $sqlupd .= ' WHERE rowid='.$obj->rowid;
+ $sqlupd .= ' WHERE rowid = '.((int) $obj->rowid);
//print $sqlupd." ";
$resqlupd = $db->query($sqlupd);
if (!$resqlupd) {
@@ -4791,7 +4791,7 @@ function migrate_contacts_socialnetworks()
$sqlupd .= ', googleplus=null';
$sqlupd .= ', youtube=null';
$sqlupd .= ', whatsapp=null';
- $sqlupd .= ' WHERE rowid='.$obj->rowid;
+ $sqlupd .= ' WHERE rowid = '.((int) $obj->rowid);
//print $sqlupd." ";
$resqlupd = $db->query($sqlupd);
if (!$resqlupd) {
@@ -4881,7 +4881,7 @@ function migrate_thirdparties_socialnetworks()
$sqlupd .= ', googleplus=null';
$sqlupd .= ', youtube=null';
$sqlupd .= ', whatsapp=null';
- $sqlupd .= ' WHERE rowid='.$obj->rowid;
+ $sqlupd .= ' WHERE rowid = '.((int) $obj->rowid);
//print $sqlupd." ";
$resqlupd = $db->query($sqlupd);
if (!$resqlupd) {
@@ -4945,7 +4945,7 @@ function migrate_export_import_profiles($mode = 'export')
if ($mode == 'export') {
$sqlupd .= ", filter = '".$db->escape($newfilter)."'";
}
- $sqlupd .= ' WHERE rowid='.$obj->rowid;
+ $sqlupd .= ' WHERE rowid = '.((int) $obj->rowid);
$resultstring .= ''.$sqlupd." \n";
$resqlupd = $db->query($sqlupd);
if (!$resqlupd) {
diff --git a/htdocs/intracommreport/class/intracommreport.class.php b/htdocs/intracommreport/class/intracommreport.class.php
index 9675d1f3860..d3f34fc149b 100644
--- a/htdocs/intracommreport/class/intracommreport.class.php
+++ b/htdocs/intracommreport/class/intracommreport.class.php
@@ -437,7 +437,7 @@ class IntracommReport extends CommonObject
*/
public function getNextDeclarationNumber()
{
- $resql = $this->db->query('SELECT MAX(numero_declaration) as max_declaration_number FROM '.MAIN_DB_PREFIX.$this->table_element.' WHERE exporttype="'.$this->exporttype.'"');
+ $resql = $this->db->query('SELECT MAX(numero_declaration) as max_declaration_number FROM '.MAIN_DB_PREFIX.$this->table_element." WHERE exporttype='".$this->db->escape($this->exporttype)."'");
if ($resql) {
$res = $this->db->fetch_object($resql);
}
diff --git a/htdocs/loan/payment/card.php b/htdocs/loan/payment/card.php
index 675401e34f9..0292fbf5b2c 100644
--- a/htdocs/loan/payment/card.php
+++ b/htdocs/loan/payment/card.php
@@ -156,8 +156,8 @@ $disable_delete = 0;
$sql = 'SELECT l.rowid as id, l.label, l.paid, l.capital as capital, pl.amount_capital, pl.amount_insurance, pl.amount_interest';
$sql .= ' FROM '.MAIN_DB_PREFIX.'payment_loan as pl,'.MAIN_DB_PREFIX.'loan as l';
$sql .= ' WHERE pl.fk_loan = l.rowid';
-$sql .= ' AND l.entity = '.$conf->entity;
-$sql .= ' AND pl.rowid = '.$payment->id;
+$sql .= ' AND l.entity = '.((int) $conf->entity);
+$sql .= ' AND pl.rowid = '.((int) $payment->id);
dol_syslog("loan/payment/card.php", LOG_DEBUG);
$resql = $db->query($sql);
diff --git a/htdocs/margin/checkMargins.php b/htdocs/margin/checkMargins.php
index d12c827cc3e..1349e02d2d8 100644
--- a/htdocs/margin/checkMargins.php
+++ b/htdocs/margin/checkMargins.php
@@ -106,8 +106,8 @@ if (empty($reshook)) {
$invoicedet_id = $tmp_array[1];
if (!empty($invoicedet_id)) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.'facturedet';
- $sql .= ' SET buy_price_ht=\''.price2num($value).'\'';
- $sql .= ' WHERE rowid='.$invoicedet_id;
+ $sql .= " SET buy_price_ht = ".((float) price2num($value));
+ $sql .= ' WHERE rowid = '.((int) $invoicedet_id);
$result = $db->query($sql);
if (!$result) {
setEventMessages($db->lasterror, null, 'errors');
diff --git a/htdocs/modulebuilder/template/core/modules/modMyModule.class.php b/htdocs/modulebuilder/template/core/modules/modMyModule.class.php
index 9db4bcb9854..de9188e714d 100644
--- a/htdocs/modulebuilder/template/core/modules/modMyModule.class.php
+++ b/htdocs/modulebuilder/template/core/modules/modMyModule.class.php
@@ -456,10 +456,10 @@ class modMyModule extends DolibarrModules
}
$sql = array_merge($sql, array(
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."','".strtolower($myTmpObjectKey)."',".$conf->entity.")",
- "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".strtolower($myTmpObjectKey)."' AND entity = ".$conf->entity,
- "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".strtolower($myTmpObjectKey)."', ".$conf->entity.")"
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'standard_".strtolower($myTmpObjectKey)."' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('standard_".strtolower($myTmpObjectKey)."', '".$this->db->escape(strtolower($myTmpObjectKey))."', ".((int) $conf->entity).")",
+ "DELETE FROM ".MAIN_DB_PREFIX."document_model WHERE nom = 'generic_".strtolower($myTmpObjectKey)."_odt' AND type = '".$this->db->escape(strtolower($myTmpObjectKey))."' AND entity = ".((int) $conf->entity),
+ "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity) VALUES('generic_".strtolower($myTmpObjectKey)."_odt', '".$this->db->escape(strtolower($myTmpObjectKey))."', ".((int) $conf->entity).")"
));
}
}
diff --git a/htdocs/multicurrency/class/multicurrency.class.php b/htdocs/multicurrency/class/multicurrency.class.php
index 8c2e01f9ceb..a811a396811 100644
--- a/htdocs/multicurrency/class/multicurrency.class.php
+++ b/htdocs/multicurrency/class/multicurrency.class.php
@@ -130,7 +130,7 @@ class MultiCurrency extends CommonObject
if (empty($this->entity) || $this->entity <= 0) {
$this->entity = $conf->entity;
}
- $now = date('Y-m-d H:i:s');
+ $now = dol_now();
// Insert request
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.$this->table_element.'(';
@@ -140,11 +140,11 @@ class MultiCurrency extends CommonObject
$sql .= ' date_create,';
$sql .= ' fk_user';
$sql .= ') VALUES (';
- $sql .= ' \''.$this->db->escape($this->code).'\',';
- $sql .= ' \''.$this->db->escape($this->name).'\',';
- $sql .= ' \''.$this->entity.'\',';
- $sql .= ' \''.$now.'\',';
- $sql .= ' \''.$user->id.'\'';
+ $sql .= " '".$this->db->escape($this->code)."',";
+ $sql .= " '".$this->db->escape($this->name)."',";
+ $sql .= " ".((int) $this->entity).",";
+ $sql .= " '".$this->db->idate($now)."',";
+ $sql .= " ".((int) $user->id);
$sql .= ')';
$this->db->begin();
@@ -479,8 +479,8 @@ class MultiCurrency extends CommonObject
{
$sql = 'SELECT cr.rowid';
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element_line.' as cr';
- $sql .= ' WHERE cr.fk_multicurrency = '.((int) $this->id);
- $sql .= ' AND cr.date_sync = (SELECT MAX(cr2.date_sync) FROM '.MAIN_DB_PREFIX.$this->table_element_line.' AS cr2 WHERE cr2.fk_multicurrency = '.((int) $this->id).')';
+ $sql .= " WHERE cr.fk_multicurrency = ".((int) $this->id);
+ $sql .= " AND cr.date_sync = (SELECT MAX(cr2.date_sync) FROM ".MAIN_DB_PREFIX.$this->table_element_line." AS cr2 WHERE cr2.fk_multicurrency = ".((int) $this->id).")";
dol_syslog(__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -781,7 +781,7 @@ class CurrencyRate extends CommonObjectLine
$sql .= ' fk_multicurrency,';
$sql .= ' entity';
$sql .= ') VALUES (';
- $sql .= ' '.$this->rate.',';
+ $sql .= ' '.((float) $this->rate).',';
$sql .= " '".$this->db->idate($now)."',";
$sql .= " ".((int) $fk_multicurrency).",";
$sql .= " ".((int) $this->entity);
@@ -880,13 +880,13 @@ class CurrencyRate extends CommonObjectLine
$this->rate = price2num($this->rate);
// Update request
- $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element.' SET';
- $sql .= ' rate='.$this->rate;
+ $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element;
+ $sql .= "SET rate =".((float) $this->rate);
if (!empty($this->date_sync)) {
$sql .= ", date_sync='".$this->db->idate($this->date_sync)."'";
}
if (!empty($this->fk_multicurrency)) {
- $sql .= ', fk_multicurrency='.$this->fk_multicurrency;
+ $sql .= ', fk_multicurrency='.((int) $this->fk_multicurrency);
}
$sql .= ' WHERE rowid='.((int) $this->id);
diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index 4dcdb0df538..e51c553809d 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -1722,8 +1722,8 @@ class Product extends CommonObject
// Add new price
$sql = "INSERT INTO ".MAIN_DB_PREFIX."product_price(price_level,date_price, fk_product, fk_user_author, price, price_ttc, price_base_type,tosell, tva_tx, default_vat_code, recuperableonly,";
$sql .= " localtax1_tx, localtax2_tx, localtax1_type, localtax2_type, price_min,price_min_ttc,price_by_qty,entity,fk_price_expression) ";
- $sql .= " VALUES(".($level ? $level : 1).", '".$this->db->idate($now)."', ".$this->id.", ".$user->id.", ".price2num($this->price).", ".price2num($this->price_ttc).",'".$this->db->escape($this->price_base_type)."',".((int) $this->status).", ".price2num($this->tva_tx).", ".($this->default_vat_code ? ("'".$this->db->escape($this->default_vat_code)."'") : "null").", ".((int) $this->tva_npr).",";
- $sql .= " ".price2num($this->localtax1_tx).", ".price2num($this->localtax2_tx).", '".$this->db->escape($this->localtax1_type)."', '".$this->db->escape($this->localtax2_type)."', ".price2num($this->price_min).", ".price2num($this->price_min_ttc).", ".price2num($this->price_by_qty).", ".$conf->entity.",".($this->fk_price_expression > 0 ? ((int) $this->fk_price_expression) : 'null');
+ $sql .= " VALUES(".($level ? ((int) $level) : 1).", '".$this->db->idate($now)."', ".((int) $this->id).", ".((int) $user->id).", ".((float) price2num($this->price)).", ".((float) price2num($this->price_ttc)).",'".$this->db->escape($this->price_base_type)."',".((int) $this->status).", ".((float) price2num($this->tva_tx)).", ".($this->default_vat_code ? ("'".$this->db->escape($this->default_vat_code)."'") : "null").", ".((int) $this->tva_npr).",";
+ $sql .= " ".price2num($this->localtax1_tx).", ".price2num($this->localtax2_tx).", '".$this->db->escape($this->localtax1_type)."', '".$this->db->escape($this->localtax2_type)."', ".price2num($this->price_min).", ".price2num($this->price_min_ttc).", ".price2num($this->price_by_qty).", ".((int) $conf->entity).",".($this->fk_price_expression > 0 ? ((int) $this->fk_price_expression) : 'null');
$sql .= ")";
dol_syslog(get_class($this)."::_log_price", LOG_DEBUG);
@@ -5742,7 +5742,8 @@ class Product extends CommonObject
$label_type = 'short_label';
}
- $sql = 'select '.$label_type.', code from '.MAIN_DB_PREFIX.'c_units where rowid='.$this->fk_unit;
+ $sql = "SELECT ".$label_type.", code from ".MAIN_DB_PREFIX."c_units where rowid = ".((int) $this->fk_unit);
+
$resql = $this->db->query($sql);
if ($resql && $this->db->num_rows($resql) > 0) {
$res = $this->db->fetch_array($resql);
@@ -5750,7 +5751,7 @@ class Product extends CommonObject
$this->db->free($resql);
return $label;
} else {
- $this->error = $this->db->error().' sql='.$sql;
+ $this->error = $this->db->error();
dol_syslog(get_class($this)."::getLabelOfUnit Error ".$this->error, LOG_ERR);
return -1;
}
diff --git a/htdocs/product/class/productcustomerprice.class.php b/htdocs/product/class/productcustomerprice.class.php
index a5e2581d69b..61cba58c374 100644
--- a/htdocs/product/class/productcustomerprice.class.php
+++ b/htdocs/product/class/productcustomerprice.class.php
@@ -521,7 +521,7 @@ class Productcustomerprice extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year
- $sql .= " AND ".$key." = '".$db->escape($value)."'";
+ $sql .= " AND ".$key." = '".$this->db->escape($value)."'";
} elseif ($key == 'soc.nom') {
$sql .= " AND ".$key." LIKE '%".$this->db->escape($value)."%'";
} else {
diff --git a/htdocs/product/fournisseurs.php b/htdocs/product/fournisseurs.php
index 9451fec435e..938e8d0655c 100644
--- a/htdocs/product/fournisseurs.php
+++ b/htdocs/product/fournisseurs.php
@@ -279,16 +279,16 @@ if (empty($reshook)) {
foreach ($extrafield_values as $key => $value) {
$sql .= str_replace('options_', '', $key).', ';
}
- $sql = substr($sql, 0, strlen($sql) - 2).") VALUES (".$object->product_fourn_price_id.", ";
+ $sql = substr($sql, 0, strlen($sql) - 2).") VALUES (".((int) $object->product_fourn_price_id).", ";
foreach ($extrafield_values as $key => $value) {
- $sql .= '"'.$value.'", ';
+ $sql .= "'".$db->escape($value)."', ";
}
$sql = substr($sql, 0, strlen($sql) - 2).')';
} else {
// update the existing one
$sql = "UPDATE ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields SET ";
foreach ($extrafield_values as $key => $value) {
- $sql .= str_replace('options_', '', $key).' = "'.$value.'", ';
+ $sql .= str_replace('options_', '', $key)." = '".$db->escape($value)."', ";
}
$sql = substr($sql, 0, strlen($sql) - 2).' WHERE fk_object = '.((int) $object->product_fourn_price_id);
}
diff --git a/htdocs/product/inventory/class/inventory.class.php b/htdocs/product/inventory/class/inventory.class.php
index e17a1fd418f..a6d1504a42c 100644
--- a/htdocs/product/inventory/class/inventory.class.php
+++ b/htdocs/product/inventory/class/inventory.class.php
@@ -286,10 +286,10 @@ class Inventory extends CommonObject
$sql .= " AND p.fk_product_type = 0";
}
if ($this->fk_product > 0) {
- $sql .= ' AND ps.fk_product = '.$this->fk_product;
+ $sql .= ' AND ps.fk_product = '.((int) $this->fk_product);
}
if ($this->fk_warehouse > 0) {
- $sql .= ' AND ps.fk_entrepot = '.$this->fk_warehouse;
+ $sql .= ' AND ps.fk_entrepot = '.((int) $this->fk_warehouse);
}
$inventoryline = new InventoryLine($this->db);
diff --git a/htdocs/product/stats/contrat.php b/htdocs/product/stats/contrat.php
index cb7c84fc863..65302ef2c7d 100644
--- a/htdocs/product/stats/contrat.php
+++ b/htdocs/product/stats/contrat.php
@@ -127,10 +127,10 @@ if ($id > 0 || !empty($ref)) {
$now = dol_now();
$sql = "SELECT";
- $sql .= ' sum('.$db->ifsql("cd.statut=0", 1, 0).') as nb_initial,';
- $sql .= ' sum('.$db->ifsql("cd.statut=4 AND cd.date_fin_validite > '".$db->idate($now)."'", 1, 0).") as nb_running,";
- $sql .= ' sum('.$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NULL OR cd.date_fin_validite <= '".$db->idate($now)."')", 1, 0).') as nb_late,';
- $sql .= ' sum('.$db->ifsql("cd.statut=5", 1, 0).') as nb_closed,';
+ $sql .= " sum(".$db->ifsql("cd.statut=0", 1, 0).') as nb_initial,';
+ $sql .= " sum(".$db->ifsql("cd.statut=4 AND cd.date_fin_validite > '".$db->idate($now)."'", 1, 0).") as nb_running,";
+ $sql .= " sum(".$db->ifsql("cd.statut=4 AND (cd.date_fin_validite IS NULL OR cd.date_fin_validite <= '".$db->idate($now)."')", 1, 0).') as nb_late,';
+ $sql .= " sum(".$db->ifsql("cd.statut=5", 1, 0).') as nb_closed,';
$sql .= " c.rowid as rowid, c.ref, c.ref_customer, c.ref_supplier, c.date_contrat, c.statut as statut,";
$sql .= " s.nom as name, s.rowid as socid, s.code_client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
diff --git a/htdocs/product/stats/mo.php b/htdocs/product/stats/mo.php
index 5a5c33312ca..9ad400fe0de 100644
--- a/htdocs/product/stats/mo.php
+++ b/htdocs/product/stats/mo.php
@@ -127,10 +127,10 @@ if ($id > 0 || !empty($ref)) {
$now = dol_now();
$sql = "SELECT";
- $sql .= ' sum('.$db->ifsql("cd.role='toconsume'", "cd.qty", 0).') as nb_toconsume,';
- $sql .= ' sum('.$db->ifsql("cd.role='consumed'", "cd.qty", 0).') as nb_consumed,';
- $sql .= ' sum('.$db->ifsql("cd.role='toproduce'", "cd.qty", 0).') as nb_toproduce,';
- $sql .= ' sum('.$db->ifsql("cd.role='produced'", "cd.qty", 0).') as nb_produced,';
+ $sql .= " sum(".$db->ifsql("cd.role='toconsume'", "cd.qty", 0).') as nb_toconsume,';
+ $sql .= " sum(".$db->ifsql("cd.role='consumed'", "cd.qty", 0).') as nb_consumed,';
+ $sql .= " sum(".$db->ifsql("cd.role='toproduce'", "cd.qty", 0).') as nb_toproduce,';
+ $sql .= " sum(".$db->ifsql("cd.role='produced'", "cd.qty", 0).') as nb_produced,';
$sql .= " c.rowid as rowid, c.ref, c.date_valid, c.status";
//$sql .= " s.nom as name, s.rowid as socid, s.code_client";
$sql .= " FROM ".MAIN_DB_PREFIX."mrp_mo as c";
diff --git a/htdocs/product/stock/class/entrepot.class.php b/htdocs/product/stock/class/entrepot.class.php
index 04dcddb8fab..37f6f76d216 100644
--- a/htdocs/product/stock/class/entrepot.class.php
+++ b/htdocs/product/stock/class/entrepot.class.php
@@ -205,7 +205,7 @@ class Entrepot extends CommonObject
$this->db->begin();
$sql = "INSERT INTO ".MAIN_DB_PREFIX."entrepot (ref, entity, datec, fk_user_author, fk_parent, fk_project)";
- $sql .= " VALUES ('".$this->db->escape($this->label)."', ".$conf->entity.", '".$this->db->idate($now)."', ".$user->id.", ".($this->fk_parent > 0 ? $this->fk_parent : "NULL").", ".($this->fk_project > 0 ? $this->fk_project : "NULL").")";
+ $sql .= " VALUES ('".$this->db->escape($this->label)."', ".((int) $conf->entity).", '".$this->db->idate($now)."', ".((int) $user->id).", ".($this->fk_parent > 0 ? ((int) $this->fk_parent) : "NULL").", ".($this->fk_project > 0 ? ((int) $this->fk_project) : "NULL").")";
dol_syslog(get_class($this)."::create", LOG_DEBUG);
$result = $this->db->query($sql);
diff --git a/htdocs/product/stock/class/mouvementstock.class.php b/htdocs/product/stock/class/mouvementstock.class.php
index f0c7d51c86b..dd1b2202956 100644
--- a/htdocs/product/stock/class/mouvementstock.class.php
+++ b/htdocs/product/stock/class/mouvementstock.class.php
@@ -428,7 +428,7 @@ class MouvementStock extends CommonObject
$sql .= " datem, fk_product, batch, eatby, sellby,";
$sql .= " fk_entrepot, value, type_mouvement, fk_user_author, label, inventorycode, price, fk_origin, origintype, fk_projet";
$sql .= ")";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$this->product_id.", ";
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".((int) $this->product_id).", ";
$sql .= " ".($batch ? "'".$this->db->escape($batch)."'" : "null").", ";
$sql .= " ".($eatby ? "'".$this->db->idate($eatby)."'" : "null").", ";
$sql .= " ".($sellby ? "'".$this->db->idate($sellby)."'" : "null").", ";
@@ -436,7 +436,7 @@ class MouvementStock extends CommonObject
$sql .= " ".((int) $user->id).",";
$sql .= " '".$this->db->escape($label)."',";
$sql .= " ".($inventorycode ? "'".$this->db->escape($inventorycode)."'" : "null").",";
- $sql .= " ".price2num($price).",";
+ $sql .= " ".((float) price2num($price)).",";
$sql .= " ".((int) $fk_origin).",";
$sql .= " '".$this->db->escape($origintype)."',";
$sql .= " ".((int) $fk_project);
@@ -634,12 +634,7 @@ class MouvementStock extends CommonObject
$sql .= " t.sellby,";
$sql .= " t.fk_projet as fk_project";
$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
- $sql .= ' WHERE 1 = 1';
- //if (null !== $ref) {
- //$sql .= ' AND t.ref = ' . '\'' . $ref . '\'';
- //} else {
- $sql .= ' AND t.rowid = '.((int) $id);
- //}
+ $sql .= ' WHERE t.rowid = '.((int) $id);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/product/stock/list.php b/htdocs/product/stock/list.php
index cba4c43bce1..a6fef44bb05 100644
--- a/htdocs/product/stock/list.php
+++ b/htdocs/product/stock/list.php
@@ -259,7 +259,7 @@ foreach ($search as $key => $val) {
$mode_search = 2;
}
if ($search[$key] != '') {
- $sql .= natural_search((($key == 'ref') ? 't.ref' : 't.'.$class_key), $search[$key], (($key == 'status') ? 2 : $mode_search));
+ $sql .= natural_search((($key == "ref") ? "t.ref" : "t.".$class_key), $search[$key], (($key == 'status') ? 2 : $mode_search));
}
}
if ($search_all) {
diff --git a/htdocs/product/stock/replenish.php b/htdocs/product/stock/replenish.php
index ece4d8e3298..ba3011e3c0e 100644
--- a/htdocs/product/stock/replenish.php
+++ b/htdocs/product/stock/replenish.php
@@ -345,11 +345,11 @@ $sql .= ' p.desiredstock, p.seuil_stock_alerte,';
if (!empty($conf->global->STOCK_ALLOW_ADD_LIMIT_STOCK_BY_WAREHOUSE) && $fk_entrepot > 0) {
$sql .= ' pse.desiredstock as desiredstockpse, pse.seuil_stock_alerte as seuil_stock_alertepse,';
}
-$sql .= ' '.$sqldesiredtock.' as desiredstockcombined, '.$sqlalertstock.' as seuil_stock_alertecombined,';
+$sql .= " ".$sqldesiredtock." as desiredstockcombined, ".$sqlalertstock." as seuil_stock_alertecombined,";
$sql .= ' s.fk_product,';
-$sql .= ' SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").') as stock_physique';
+$sql .= " SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").') as stock_physique';
if (!empty($conf->global->STOCK_ALLOW_ADD_LIMIT_STOCK_BY_WAREHOUSE) && $fk_entrepot > 0) {
- $sql .= ', SUM('.$db->ifsql("s.reel IS NULL OR s.fk_entrepot <> ".$fk_entrepot, "0", "s.reel").') as stock_real_warehouse';
+ $sql .= ", SUM(".$db->ifsql("s.reel IS NULL OR s.fk_entrepot <> ".$fk_entrepot, "0", "s.reel").') as stock_real_warehouse';
}
// Add fields from hooks
@@ -478,45 +478,45 @@ if ($usevirtualstock) {
}
$sql .= ' HAVING (';
- $sql .= ' ('.$sqldesiredtock.' >= 0 AND ('.$sqldesiredtock.' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')';
- $sql .= ' - ('.$sqlCommandesCli.' - '.$sqlExpeditionsCli.') + ('.$sqlCommandesFourn.' - '.$sqlReceptionFourn.') + ('.$sqlProductionToProduce.' - '.$sqlProductionToConsume.')))';
+ $sql .= " (".$sqldesiredtock." >= 0 AND (".$sqldesiredtock." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").')';
+ $sql .= " - (".$sqlCommandesCli." - ".$sqlExpeditionsCli.") + (".$sqlCommandesFourn." - ".$sqlReceptionFourn.") + (".$sqlProductionToProduce." - ".$sqlProductionToConsume.")))";
$sql .= ' OR';
if ($includeproductswithoutdesiredqty == 'on') {
- $sql .= ' (('.$sqlalertstock.' >= 0 OR '.$sqlalertstock.' IS NULL) AND ('.$db->ifsql("$sqlalertstock IS NULL", "0", $sqlalertstock).' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')';
+ $sql .= " ((".$sqlalertstock." >= 0 OR ".$sqlalertstock." IS NULL) AND (".$db->ifsql($sqlalertstock." IS NULL", "0", $sqlalertstock)." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").")";
} else {
- $sql .= ' ('.$sqlalertstock.' >= 0 AND ('.$sqlalertstock.' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')';
+ $sql .= " (".$sqlalertstock." >= 0 AND (".$sqlalertstock." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").')';
}
- $sql .= ' - ('.$sqlCommandesCli.' - '.$sqlExpeditionsCli.') + ('.$sqlCommandesFourn.' - '.$sqlReceptionFourn.') + ('.$sqlProductionToProduce.' - '.$sqlProductionToConsume.')))';
- $sql .= ')';
+ $sql .= " - (".$sqlCommandesCli." - ".$sqlExpeditionsCli.") + (".$sqlCommandesFourn." - ".$sqlReceptionFourn.") + (".$sqlProductionToProduce." - ".$sqlProductionToConsume.")))";
+ $sql .= ")";
if ($salert == 'on') { // Option to see when stock is lower than alert
$sql .= ' AND (';
if ($includeproductswithoutdesiredqty == 'on') {
- $sql .= '('.$sqlalertstock.' >= 0 OR '.$sqlalertstock.' IS NULL) AND ('.$db->ifsql("$sqlalertstock IS NULL", "0", $sqlalertstock).' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')';
+ $sql .= "(".$sqlalertstock." >= 0 OR ".$sqlalertstock." IS NULL) AND (".$db->ifsql($sqlalertstock." IS NULL", "0", $sqlalertstock)." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").")";
} else {
- $sql .= $sqlalertstock.' >= 0 AND ('.$sqlalertstock.' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')';
+ $sql .= $sqlalertstock." >= 0 AND (".$sqlalertstock." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").")";
}
- $sql .= ' - ('.$sqlCommandesCli.' - '.$sqlExpeditionsCli.') + ('.$sqlCommandesFourn.' - '.$sqlReceptionFourn.') + ('.$sqlProductionToProduce.' - '.$sqlProductionToConsume.'))';
- $sql .= ')';
+ $sql .= " - (".$sqlCommandesCli." - ".$sqlExpeditionsCli.") + (".$sqlCommandesFourn." - ".$sqlReceptionFourn.") + (".$sqlProductionToProduce." - ".$sqlProductionToConsume."))";
+ $sql .= ")";
$alertchecked = 'checked';
}
} else {
$sql .= ' HAVING (';
- $sql .= '('.$sqldesiredtock.' >= 0 AND ('.$sqldesiredtock.' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')))';
+ $sql .= "(".$sqldesiredtock." >= 0 AND (".$sqldesiredtock." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").")))";
$sql .= ' OR';
if ($includeproductswithoutdesiredqty == 'on') {
- $sql .= ' (('.$sqlalertstock.' >= 0 OR '.$sqlalertstock.' IS NULL) AND ('.$db->ifsql("$sqlalertstock IS NULL", "0", $sqlalertstock).' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')))';
+ $sql .= " ((".$sqlalertstock." >= 0 OR ".$sqlalertstock." IS NULL) AND (".$db->ifsql($sqlalertstock." IS NULL", "0", $sqlalertstock)." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").')))';
} else {
- $sql .= ' ('.$sqlalertstock.' >= 0 AND ('.$sqlalertstock.' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").')))';
+ $sql .= " (".$sqlalertstock." >= 0 AND (".$sqlalertstock." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").')))';
}
$sql .= ')';
if ($salert == 'on') { // Option to see when stock is lower than alert
- $sql .= ' AND (';
+ $sql .= " AND (";
if ($includeproductswithoutdesiredqty == 'on') {
- $sql .= ' ('.$sqlalertstock.' >= 0 OR '.$sqlalertstock.' IS NULL) AND ('.$db->ifsql("$sqlalertstock IS NULL", "0", $sqlalertstock).' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").'))';
+ $sql .= " (".$sqlalertstock." >= 0 OR ".$sqlalertstock." IS NULL) AND (".$db->ifsql($sqlalertstock." IS NULL", "0", $sqlalertstock)." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel")."))";
} else {
- $sql .= ' '.$sqlalertstock.' >= 0 AND ('.$sqlalertstock.' > SUM('.$db->ifsql("s.reel IS NULL", "0", "s.reel").'))';
+ $sql .= " ".$sqlalertstock." >= 0 AND (".$sqlalertstock." > SUM(".$db->ifsql("s.reel IS NULL", "0", "s.reel").'))';
}
$sql .= ')';
$alertchecked = 'checked';
@@ -802,7 +802,7 @@ while ($i < ($limit ? min($num, $limit) : $num)) {
$sql = 'SELECT label,description';
$sql .= ' FROM '.MAIN_DB_PREFIX.'product_lang';
$sql .= ' WHERE fk_product = '.((int) $objp->rowid);
- $sql .= ' AND lang = "'.$langs->getDefaultLang().'"';
+ $sql .= " AND lang = '".$db->escape($langs->getDefaultLang())."'";
$sql .= ' LIMIT 1';
$resqlm = $db->query($sql);
diff --git a/htdocs/product/stock/stockatdate.php b/htdocs/product/stock/stockatdate.php
index 4892004db72..83c57a4a81d 100644
--- a/htdocs/product/stock/stockatdate.php
+++ b/htdocs/product/stock/stockatdate.php
@@ -272,7 +272,7 @@ if (empty($conf->global->STOCK_SUPPORTS_SERVICES)) {
$sql .= " AND p.fk_product_type = 0";
}
if (!empty($canvas)) {
- $sql .= ' AND p.canvas = "'.$db->escape($canvas).'"';
+ $sql .= " AND p.canvas = '".$db->escape($canvas)."'";
}
if ($fk_warehouse > 0) {
$sql .= ' GROUP BY p.rowid, p.ref, p.label, p.description, p.price, p.price_ttc, p.price_base_type, p.fk_product_type, p.desiredstock, p.seuil_stock_alerte,';
@@ -488,7 +488,7 @@ while ($i < ($limit ? min($num, $limit) : $num)) {
$sql = 'SELECT label,description';
$sql .= ' FROM '.MAIN_DB_PREFIX.'product_lang';
$sql .= ' WHERE fk_product = '.((int) $objp->rowid);
- $sql .= ' AND lang = "'.$langs->getDefaultLang().'"';
+ $sql .= " AND lang = '".$db->escape($langs->getDefaultLang())."'";
$sql .= ' LIMIT 1';
$resqlm = $db->query($sql);
diff --git a/htdocs/projet/class/projectstats.class.php b/htdocs/projet/class/projectstats.class.php
index f437c8a5e10..1439ecd5f20 100644
--- a/htdocs/projet/class/projectstats.class.php
+++ b/htdocs/projet/class/projectstats.class.php
@@ -165,15 +165,15 @@ class ProjectStats extends Stats
$sqlwhere[] = ' t.entity IN ('.getEntity('project').')';
if (!empty($this->userid)) {
- $sqlwhere[] = ' t.fk_user_resp='.$this->userid;
+ $sqlwhere[] = ' t.fk_user_resp = '.((int) $this->userid);
}
// Forced filter on socid is similar to forced filter on project. TODO Use project assignement to allow to not use filter on project
if (!empty($this->socid)) {
- $sqlwhere[] = ' t.fk_soc='.$this->socid;
+ $sqlwhere[] = ' t.fk_soc = '.((int) $this->socid);
}
if (!empty($this->year) && empty($this->yearmonth)) {
- $sqlwhere[] = " date_format(t.datec,'%Y')='".$this->db->escape($this->year)."'";
+ $sqlwhere[] = " date_format(t.datec,'%Y') = '".$this->db->escape($this->year)."'";
}
if (!empty($this->yearmonth)) {
$sqlwhere[] = " t.datec BETWEEN '".$this->db->idate(dol_get_first_day($this->yearmonth))."' AND '".$this->db->idate(dol_get_last_day($this->yearmonth))."'";
diff --git a/htdocs/projet/class/taskstats.class.php b/htdocs/projet/class/taskstats.class.php
index 1eb6fda915f..594ad38d723 100644
--- a/htdocs/projet/class/taskstats.class.php
+++ b/htdocs/projet/class/taskstats.class.php
@@ -142,11 +142,11 @@ class TaskStats extends Stats
$sqlwhere[] = ' t.entity IN ('.getEntity('project').')';
if (!empty($this->userid)) {
- $sqlwhere[] = ' t.fk_user_resp='.$this->userid;
+ $sqlwhere[] = ' t.fk_user_resp = '.((int) $this->userid);
}
// Forced filter on socid is similar to forced filter on project. TODO Use project assignement to allow to not use filter on project
if (!empty($this->socid)) {
- $sqlwhere[] = ' p.fk_soc='.$this->socid; // Link on thirdparty is on project, not on task
+ $sqlwhere[] = ' p.fk_soc = '.((int) $this->socid); // Link on thirdparty is on project, not on task
}
if (!empty($this->year) && empty($this->yearmonth)) {
$sqlwhere[] = " date_format(t.datec,'%Y')='".$this->db->escape($this->year)."'";
diff --git a/htdocs/public/emailing/mailing-read.php b/htdocs/public/emailing/mailing-read.php
index ea9eeb377e7..7fac6ff323e 100644
--- a/htdocs/public/emailing/mailing-read.php
+++ b/htdocs/public/emailing/mailing-read.php
@@ -128,13 +128,13 @@ if (!empty($tag)) {
//Update status communication of thirdparty prospect
if ($obj->source_id > 0 && $obj->source_type == 'thirdparty' && $obj->entity) {
- $sql = "UPDATE ".MAIN_DB_PREFIX.'societe SET fk_stcomm = 3 WHERE fk_stcomm <> -1 AND entity = '.$obj->entity.' AND rowid = '.((int) $obj->source_id);
+ $sql = "UPDATE ".MAIN_DB_PREFIX.'societe SET fk_stcomm = 3 WHERE fk_stcomm <> -1 AND entity = '.((int) $obj->entity).' AND rowid = '.((int) $obj->source_id);
$resql = $db->query($sql);
}
//Update status communication of contact prospect
if ($obj->source_id > 0 && $obj->source_type == 'contact' && $obj->entity) {
- $sql = "UPDATE ".MAIN_DB_PREFIX.'societe SET fk_stcomm = 3 WHERE fk_stcomm <> -1 AND entity = '.$obj->entity.' AND rowid IN (SELECT sc.fk_soc FROM '.MAIN_DB_PREFIX.'socpeople AS sc WHERE sc.rowid = '.((int) $obj->source_id).')';
+ $sql = "UPDATE ".MAIN_DB_PREFIX.'societe SET fk_stcomm = 3 WHERE fk_stcomm <> -1 AND entity = '.((int) $obj->entity).' AND rowid IN (SELECT sc.fk_soc FROM '.MAIN_DB_PREFIX.'socpeople AS sc WHERE sc.rowid = '.((int) $obj->source_id).')';
$resql = $db->query($sql);
}
}
diff --git a/htdocs/public/emailing/mailing-unsubscribe.php b/htdocs/public/emailing/mailing-unsubscribe.php
index 6648bafd07a..76a73e8de05 100644
--- a/htdocs/public/emailing/mailing-unsubscribe.php
+++ b/htdocs/public/emailing/mailing-unsubscribe.php
@@ -149,7 +149,7 @@ if (!empty($tag) && ($unsuscrib == '1')) {
*/
// Update status communication of email (new usage)
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."mailing_unsubscribe (date_creat, entity, email, unsubscribegroup, ip) VALUES ('".$db->idate(dol_now())."', ".$db->escape($obj->entity).", '".$db->escape($obj->email)."', '', '".$db->escape(getUserRemoteIP())."')";
+ $sql = "INSERT INTO ".MAIN_DB_PREFIX."mailing_unsubscribe (date_creat, entity, email, unsubscribegroup, ip) VALUES ('".$db->idate(dol_now())."', ".((int) $obj->entity).", '".$db->escape($obj->email)."', '', '".$db->escape(getUserRemoteIP())."')";
$resql = $db->query($sql);
//if (! $resql) dol_print_error($db); No test on errors, may fail if already unsubscribed
diff --git a/htdocs/public/payment/paymentok.php b/htdocs/public/payment/paymentok.php
index e65f3ef31fc..f39d6735dad 100644
--- a/htdocs/public/payment/paymentok.php
+++ b/htdocs/public/payment/paymentok.php
@@ -585,7 +585,7 @@ if ($ispaymentok) {
}
} else {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."societe_account (fk_soc, login, key_account, site, site_account, status, entity, date_creation, fk_user_creat)";
- $sql .= " VALUES (".$object->fk_soc.", '', '".$db->escape($stripecu)."', 'stripe', '".$db->escape($stripearrayofkeysbyenv[$servicestatus]['publishable_key'])."', ".$servicestatus.", ".$conf->entity.", '".$db->idate(dol_now())."', 0)";
+ $sql .= " VALUES (".((int) $object->fk_soc).", '', '".$db->escape($stripecu)."', 'stripe', '".$db->escape($stripearrayofkeysbyenv[$servicestatus]['publishable_key'])."', ".((int) $servicestatus).", ".((int) $conf->entity).", '".$db->idate(dol_now())."', 0)";
$resql = $db->query($sql);
if (!$resql) { // should not happen
$error++;
diff --git a/htdocs/public/recruitment/index.php b/htdocs/public/recruitment/index.php
index e576d5abde2..840fd1f4d8f 100644
--- a/htdocs/public/recruitment/index.php
+++ b/htdocs/public/recruitment/index.php
@@ -273,13 +273,13 @@ if ($display_ticket_list) {
}
}
}
- $sql .= " ORDER BY ".$sortfield.' '.$sortorder;
+ $sql .= $db->order($sortfield, $sortorder);
$resql = $db->query($sql);
if ($resql) {
$num_total = $db->num_rows($resql);
if (!empty($limit)) {
- $sql .= ' '.$db->plimit($limit + 1, $offset);
+ $sql .= $db->plimit($limit + 1, $offset);
}
$resql = $db->query($sql);
diff --git a/htdocs/public/ticket/list.php b/htdocs/public/ticket/list.php
index 5fea0ee94a1..87b0a68ede3 100644
--- a/htdocs/public/ticket/list.php
+++ b/htdocs/public/ticket/list.php
@@ -374,13 +374,13 @@ if ($action == "view_ticketlist") {
}
}
//$sql .= " GROUP BY t.track_id";
- $sql .= " ORDER BY ".$sortfield.' '.$sortorder;
+ $sql .= $db->order($sortfield, $sortorder);
$resql = $db->query($sql);
if ($resql) {
$num_total = $db->num_rows($resql);
if (!empty($limit)) {
- $sql .= ' '.$db->plimit($limit + 1, $offset);
+ $sql .= $db->plimit($limit + 1, $offset);
}
$resql = $db->query($sql);
diff --git a/htdocs/reception/list.php b/htdocs/reception/list.php
index 3541a1b8065..7f4a820bf41 100644
--- a/htdocs/reception/list.php
+++ b/htdocs/reception/list.php
@@ -506,7 +506,7 @@ foreach ($search_array_options as $key => $val) {
$mode = 2; // Search on a foreign key int
}
if ($crit != '' && (!in_array($typ, array('select', 'sellist')) || $crit != '0')) {
- $sql .= natural_search('ef.'.$tmpkey, $crit, $mode);
+ $sql .= natural_search("ef.".$tmpkey, $crit, $mode);
}
}
// Add where from hooks
diff --git a/htdocs/societe/admin/societe.php b/htdocs/societe/admin/societe.php
index c87289da390..b9b2046fd90 100644
--- a/htdocs/societe/admin/societe.php
+++ b/htdocs/societe/admin/societe.php
@@ -115,7 +115,7 @@ if ($action == 'set') {
$type = 'company';
$sql = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity, libelle, description)";
- $sql .= " VALUES ('".$db->escape($value)."','".$db->escape($type)."',".$conf->entity.", ";
+ $sql .= " VALUES ('".$db->escape($value)."', '".$db->escape($type)."', ".((int) $conf->entity).", ";
$sql .= ($label ? "'".$db->escape($label)."'" : 'null').", ";
$sql .= (!empty($scandir) ? "'".$db->escape($scandir)."'" : "null");
$sql .= ")";
@@ -130,7 +130,7 @@ if ($action == 'set') {
if ($action == 'del') {
$type = 'company';
$sql = "DELETE FROM ".MAIN_DB_PREFIX."document_model";
- $sql .= " WHERE nom='".$db->escape($value)."' AND type='".$db->escape($type)."' AND entity=".$conf->entity;
+ $sql .= " WHERE nom='".$db->escape($value)."' AND type='".$db->escape($type)."' AND entity=".((int) $conf->entity);
$resql = $db->query($sql);
if (!$resql) {
dol_print_error($db);
@@ -151,12 +151,12 @@ if ($action == 'setdoc') {
$sql_del = "DELETE FROM ".MAIN_DB_PREFIX."document_model";
$sql_del .= " WHERE nom = '".$db->escape(GETPOST('value', 'alpha'))."'";
$sql_del .= " AND type = '".$db->escape($type)."'";
- $sql_del .= " AND entity = ".$conf->entity;
+ $sql_del .= " AND entity = ".((int) $conf->entity);
dol_syslog("societe.php ".$sql);
$result1 = $db->query($sql_del);
$sql = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity, libelle, description)";
- $sql .= " VALUES ('".$db->escape($value)."', '".$db->escape($type)."', ".$conf->entity.", ";
+ $sql .= " VALUES ('".$db->escape($value)."', '".$db->escape($type)."', ".((int) $conf->entity).", ";
$sql .= ($label ? "'".$db->escape($label)."'" : 'null').", ";
$sql .= (!empty($scandir) ? "'".$db->escape($scandir)."'" : "null");
$sql .= ")";
diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php
index d7dde07af5f..74e08914f3f 100644
--- a/htdocs/societe/class/societe.class.php
+++ b/htdocs/societe/class/societe.class.php
@@ -890,7 +890,7 @@ class Societe extends CommonObject
$sql .= ", accountancy_code_buy";
$sql .= ", accountancy_code_sell";
}
- $sql .= ") VALUES ('".$this->db->escape($this->name)."', '".$this->db->escape($this->name_alias)."', ".$this->db->escape($this->entity).", '".$this->db->idate($now)."'";
+ $sql .= ") VALUES ('".$this->db->escape($this->name)."', '".$this->db->escape($this->name_alias)."', ".((int) $this->entity).", '".$this->db->idate($now)."'";
$sql .= ", ".(!empty($user->id) ? ((int) $user->id) : "null");
$sql .= ", ".(!empty($this->typent_id) ? ((int) $this->typent_id) : "null");
$sql .= ", ".(!empty($this->canvas) ? "'".$this->db->escape($this->canvas)."'" : "null");
@@ -2372,7 +2372,7 @@ class Societe extends CommonObject
$sql = "INSERT INTO ".MAIN_DB_PREFIX."societe_prices";
$sql .= " (datec, fk_soc, price_level, fk_user_author)";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$this->id.", ".((int) $price_level).", ".$user->id.")";
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".((int) $this->id).", ".((int) $price_level).", ".((int) $user->id).")";
if (!$this->db->query($sql)) {
dol_print_error($this->db);
@@ -3388,7 +3388,7 @@ class Societe extends CommonObject
$sql = 'SELECT s.parent';
$sql .= ' FROM '.MAIN_DB_PREFIX.'societe as s';
- $sql .= ' WHERE rowid = '.$idparent;
+ $sql .= ' WHERE rowid = '.((int) $idparent);
$resql = $this->db->query($sql);
if ($resql) {
$obj = $this->db->fetch_object($resql);
@@ -3875,7 +3875,7 @@ class Societe extends CommonObject
// phpcs:enable
if ($categorie_id > 0 && $this->id > 0) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."categorie_fournisseur (fk_categorie, fk_soc) ";
- $sql .= " VALUES (".$categorie_id.", ".$this->id.")";
+ $sql .= " VALUES (".((int) $categorie_id).", ".((int) $this->id).")";
if ($resql = $this->db->query($sql)) {
return 0;
diff --git a/htdocs/societe/paymentmodes.php b/htdocs/societe/paymentmodes.php
index 664d7d36255..f80bebd9bf5 100644
--- a/htdocs/societe/paymentmodes.php
+++ b/htdocs/societe/paymentmodes.php
@@ -587,7 +587,7 @@ if (empty($reshook)) {
$tokenstring['stripe_user_id'] = $stripesup->id;
$tokenstring['type'] = $stripesup->type;
$sql = "INSERT INTO ".MAIN_DB_PREFIX."oauth_token (service, fk_soc, entity, tokenstring)";
- $sql .= " VALUES ('".$db->escape($service)."', ".$object->id.", ".$conf->entity.", '".$db->escape(json_encode($tokenstring))."')";
+ $sql .= " VALUES ('".$db->escape($service)."', ".((int) $object->id).", ".((int) $conf->entity).", '".$db->escape(json_encode($tokenstring))."')";
// TODO Add site and site_account on oauth_token table
} catch (Exception $e) {
$error++;
diff --git a/htdocs/stripe/class/stripe.class.php b/htdocs/stripe/class/stripe.class.php
index c671ac9c396..9324d7d3a5d 100644
--- a/htdocs/stripe/class/stripe.class.php
+++ b/htdocs/stripe/class/stripe.class.php
@@ -246,7 +246,7 @@ class Stripe extends CommonObject
// Create customer in Dolibarr
$sql = "INSERT INTO ".MAIN_DB_PREFIX."societe_account (fk_soc, login, key_account, site, site_account, status, entity, date_creation, fk_user_creat)";
- $sql .= " VALUES (".$object->id.", '', '".$this->db->escape($customer->id)."', 'stripe', '".$this->db->escape($stripearrayofkeysbyenv[$status]['publishable_key'])."', ".$status.", ".$conf->entity.", '".$this->db->idate(dol_now())."', ".$user->id.")";
+ $sql .= " VALUES (".((int) $object->id).", '', '".$this->db->escape($customer->id)."', 'stripe', '".$this->db->escape($stripearrayofkeysbyenv[$status]['publishable_key'])."', ".((int) $status).", ".((int) $conf->entity).", '".$this->db->idate(dol_now())."', ".((int) $user->id).")";
$resql = $this->db->query($sql);
if (!$resql) {
$this->error = $this->db->lasterror();
@@ -509,7 +509,7 @@ class Stripe extends CommonObject
if (!$paymentintentalreadyexists) {
$now = dol_now();
$sql = "INSERT INTO ".MAIN_DB_PREFIX."prelevement_facture_demande (date_demande, fk_user_demande, ext_payment_id, fk_facture, sourcetype, entity, ext_payment_site, amount)";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$user->id.", '".$this->db->escape($paymentintent->id)."', ".$object->id.", '".$this->db->escape($object->element)."', ".$conf->entity.", '".$this->db->escape($service)."', ".$amount.")";
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".((int) $user->id).", '".$this->db->escape($paymentintent->id)."', ".((int) $object->id).", '".$this->db->escape($object->element)."', ".((int) $conf->entity).", '".$this->db->escape($service)."', ".((float) $amount).")";
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
@@ -675,7 +675,7 @@ class Stripe extends CommonObject
{
$now=dol_now();
$sql = "INSERT INTO " . MAIN_DB_PREFIX . "prelevement_facture_demande (date_demande, fk_user_demande, ext_payment_id, fk_facture, sourcetype, entity, ext_payment_site)";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$user->id.", '".$this->db->escape($setupintent->id)."', ".$object->id.", '".$this->db->escape($object->element)."', " . $conf->entity . ", '" . $this->db->escape($service) . "', ".$amount.")";
+ $sql .= " VALUES ('".$this->db->idate($now)."', ".((int) $user->id).", '".$this->db->escape($setupintent->id)."', ".((int) $object->id).", '".$this->db->escape($object->element)."', " . ((int) $conf->entity) . ", '" . $this->db->escape($service) . "', ".((float) $amount).")";
$resql = $this->db->query($sql);
if (! $resql)
{
diff --git a/htdocs/supplier_proposal/list.php b/htdocs/supplier_proposal/list.php
index a3ab70c8c5a..71cd1c1fa69 100644
--- a/htdocs/supplier_proposal/list.php
+++ b/htdocs/supplier_proposal/list.php
@@ -376,7 +376,7 @@ if ($search_montant_ttc != '') {
$sql .= natural_search("sp.total_ttc", $search_montant_ttc, 1);
}
if ($search_multicurrency_code != '') {
- $sql .= ' AND sp.multicurrency_code = "'.$db->escape($search_multicurrency_code).'"';
+ $sql .= " AND sp.multicurrency_code = '".$db->escape($search_multicurrency_code)."'";
}
if ($search_multicurrency_tx != '') {
$sql .= natural_search('sp.multicurrency_tx', $search_multicurrency_tx, 1);
diff --git a/htdocs/takepos/invoice.php b/htdocs/takepos/invoice.php
index 95167ed3b51..96b06d09271 100644
--- a/htdocs/takepos/invoice.php
+++ b/htdocs/takepos/invoice.php
@@ -629,9 +629,10 @@ if ($action == "delete") {
}
$sql = "UPDATE ".MAIN_DB_PREFIX."facture";
- $sql .= " SET fk_soc=".$conf->global->{'CASHDESK_ID_THIRDPARTY'.$_SESSION["takeposterminal"]}.", ";
+ $varforconst = 'CASHDESK_ID_THIRDPARTY'.$_SESSION["takeposterminal"];
+ $sql .= " SET fk_soc = ".((int) $conf->global->$varforconst).", ";
$sql .= " datec = '".$db->idate(dol_now())."'";
- $sql .= " WHERE ref='(PROV-POS".$db->escape($_SESSION["takeposterminal"]."-".$place).")'";
+ $sql .= " WHERE ref = '(PROV-POS".$db->escape($_SESSION["takeposterminal"]."-".$place).")'";
$resql1 = $db->query($sql);
if ($resdeletelines && $resql1) {
diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php
index a53d649c2b3..9bf53fb5271 100644
--- a/htdocs/ticket/class/ticket.class.php
+++ b/htdocs/ticket/class/ticket.class.php
@@ -734,7 +734,7 @@ class Ticket extends CommonObject
$sql .= " AND t.fk_soc = ".((int) $user->socid);
}
- $sql .= " ORDER BY ".$sortfield.' '.$sortorder;
+ $sql .= $this->db->order($sortfield, $sortorder);
if (!empty($limit)) {
$sql .= $this->db->plimit($limit + 1, $offset);
}
@@ -2132,124 +2132,6 @@ class Ticket extends CommonObject
return $array_contact;
}
- /**
- * Send message
- *
- * @param string $subject Subject
- * @param string $texte Message to send
- * @return int <0 if KO, or number of changes if OK
- */
- public function messageSend($subject, $texte)
- {
- global $conf, $langs, $mysoc, $dolibarr_main_url_root;
-
- $langs->load("other");
-
- dol_syslog(get_class($this)."::message_send action=$action, socid=$socid, texte=$texte, objet_type=$objet_type, objet_id=$objet_id, file=$file");
-
- $internal_contacts = $this->getIdContact('internal', 'SUPPORTTEC');
- $external_contacts = $this->getIdContact('external', 'SUPPORTTEC');
-
- if ($result) {
- $num = $this->db->num_rows($result);
- $i = 0;
- while ($i < $num) { // For each notification couple defined (third party/actioncode)
- $obj = $this->db->fetch_object($result);
-
- $sendto = $obj->firstname." ".$obj->lastname." <".$obj->email.">";
- $actiondefid = $obj->adid;
-
- if (dol_strlen($sendto)) {
- include_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
- $application = ($conf->global->MAIN_APPLICATION_TITLE ? $conf->global->MAIN_APPLICATION_TITLE : 'Dolibarr ERP/CRM');
-
- $subject = '['.$application.'] '.$langs->transnoentitiesnoconv("DolibarrNotification");
-
- $message = $langs->transnoentities("YouReceiveMailBecauseOfNotification", $application, $mysoc->name)."\n";
- $message .= $langs->transnoentities("YouReceiveMailBecauseOfNotification2", $application, $mysoc->name)."\n";
- $message .= "\n";
- $message .= $texte;
- // Add link
- $link = '';
- switch ($objet_type) {
- case 'ficheinter':
- $link = '/fichinter/card.php?id='.$objet_id;
- break;
- case 'propal':
- $link = '/comm/propal.php?id='.$objet_id;
- break;
- case 'facture':
- $link = '/compta/facture/card.php?facid='.$objet_id;
- break;
- case 'order':
- $link = '/commande/card.php?facid='.$objet_id;
- break;
- case 'order_supplier':
- $link = '/fourn/commande/card.php?facid='.$objet_id;
- break;
- }
- // Define $urlwithroot
- $urlwithouturlroot = preg_replace('/'.preg_quote(DOL_URL_ROOT, '/').'$/i', '', trim($dolibarr_main_url_root));
- $urlwithroot = $urlwithouturlroot.DOL_URL_ROOT; // This is to use external domain name found into config file
- //$urlwithroot=DOL_MAIN_URL_ROOT; // This is to use same domain name than current
- if ($link) {
- $message .= "\n".$urlwithroot.$link;
- }
-
- $filename = basename($file);
-
- $mimefile = dol_mimetype($file);
-
- $msgishtml = 0;
-
- $replyto = $conf->notification->email_from;
-
- $message = dol_nl2br($message);
-
- if (!empty($conf->global->TICKET_DISABLE_MAIL_AUTOCOPY_TO)) {
- $old_MAIN_MAIL_AUTOCOPY_TO = $conf->global->MAIN_MAIL_AUTOCOPY_TO;
- $conf->global->MAIN_MAIL_AUTOCOPY_TO = '';
- }
- $mailfile = new CMailFile(
- $subject,
- $sendto,
- $replyto,
- $message,
- array($file),
- array($mimefile),
- array($filename[count($filename) - 1]),
- '',
- '',
- 0,
- $msgishtml
- );
-
- if ($mailfile->sendfile()) {
- $now = dol_now();
- $sendto = htmlentities($sendto);
-
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."notify (daten, fk_action, fk_contact, objet_type, objet_id, email)";
- $sql .= " VALUES ('".$this->db->idate($now)."', ".$actiondefid.", ".$obj->cid.", '".$this->db->escape($objet_type)."', ".$objet_id.", '".$this->db->escape($obj->email)."')";
- dol_syslog("Notify::send sql=".$sql);
- if (!$this->db->query($sql)) {
- dol_print_error($this->db);
- }
- } else {
- $this->error = $mailfile->error;
- //dol_syslog("Notify::send ".$this->error, LOG_ERR);
- }
- if (!empty($conf->global->TICKET_DISABLE_MAIL_AUTOCOPY_TO)) {
- $conf->global->MAIN_MAIL_AUTOCOPY_TO = $old_MAIN_MAIL_AUTOCOPY_TO;
- }
- }
- $i++;
- }
- return $i;
- } else {
- $this->error = $this->db->error();
- return -1;
- }
- }
/**
* Get array of all contacts for a ticket
diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php
index f22882b1852..db2d4583177 100644
--- a/htdocs/user/class/user.class.php
+++ b/htdocs/user/class/user.class.php
@@ -1355,7 +1355,7 @@ class User extends CommonObject
// Insert into database
$sql = "INSERT INTO ".MAIN_DB_PREFIX."user (datec, login, ldap_sid, entity)";
- $sql .= " VALUES('".$this->db->idate($this->datec)."','".$this->db->escape($this->login)."','".$this->db->escape($this->ldap_sid)."',".$this->db->escape($this->entity).")";
+ $sql .= " VALUES('".$this->db->idate($this->datec)."', '".$this->db->escape($this->login)."', '".$this->db->escape($this->ldap_sid)."', ".((int) $this->entity).")";
$result = $this->db->query($sql);
dol_syslog(get_class($this)."::create", LOG_DEBUG);
@@ -3587,13 +3587,11 @@ class User extends CommonObject
$sql = 'SELECT rowid';
$sql .= ' FROM '.MAIN_DB_PREFIX.'user';
-
if (!empty($conf->global->AGENDA_DISABLE_EXACT_USER_EMAIL_COMPARE_FOR_EXTERNAL_CALENDAR)) {
- $sql .= ' WHERE email LIKE "%'.$email.'%"';
+ $sql .= " WHERE email LIKE '%".$this->db->escape($email)."%'";
} else {
- $sql .= ' WHERE email = "'.$email.'"';
+ $sql .= " WHERE email = '".$this->db->escape($email)."'";
}
-
$sql .= ' LIMIT 1';
$resql = $this->db->query($sql);
diff --git a/htdocs/user/notify/card.php b/htdocs/user/notify/card.php
index a0cc0128b4c..14067af9a08 100644
--- a/htdocs/user/notify/card.php
+++ b/htdocs/user/notify/card.php
@@ -100,7 +100,7 @@ if ($action == 'add') {
$sql .= " WHERE fk_user=".((int) $id)." AND fk_action=".((int) $actionid);
if ($db->query($sql)) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec, fk_user, fk_action)";
- $sql .= " VALUES ('".$db->idate($now)."', ".((int) $id).", ".$actionid.")";
+ $sql .= " VALUES ('".$db->idate($now)."', ".((int) $id).", ".((int) $actionid).")";
if (!$db->query($sql)) {
$error++;
diff --git a/htdocs/variants/class/ProductCombination.class.php b/htdocs/variants/class/ProductCombination.class.php
index 29cfdf731f9..d4fc03724d0 100644
--- a/htdocs/variants/class/ProductCombination.class.php
+++ b/htdocs/variants/class/ProductCombination.class.php
@@ -942,7 +942,7 @@ class ProductCombination
$sql .= ' FROM '.MAIN_DB_PREFIX.'product_attribute_combination pac';
$sql .= ' INNER JOIN '.MAIN_DB_PREFIX.'product_attribute_combination2val pac2v ON pac2v.fk_prod_combination=pac.rowid';
$sql .= ' INNER JOIN '.MAIN_DB_PREFIX.'product_attribute_value pav ON pav.rowid=pac2v.fk_prod_attr_val';
- $sql .= ' WHERE pac.fk_product_child='.$prod_child;
+ $sql .= ' WHERE pac.fk_product_child='.((int) $prod_child);
$resql = $this->db->query($sql);
if ($resql) {
diff --git a/htdocs/website/class/website.class.php b/htdocs/website/class/website.class.php
index 893cd9a6bf1..f48fada2eb9 100644
--- a/htdocs/website/class/website.class.php
+++ b/htdocs/website/class/website.class.php
@@ -1138,7 +1138,7 @@ class Website extends CommonObject
return -1;
}
- dol_delete_dir_recursive($conf->website->dir_temp.'/'.$object->ref);
+ dol_delete_dir_recursive($conf->website->dir_temp."/".$object->ref);
dol_mkdir($conf->website->dir_temp.'/'.$object->ref);
$filename = basename($pathtofile);
@@ -1183,7 +1183,7 @@ class Website extends CommonObject
dolCopyDir($conf->website->dir_temp.'/'.$object->ref.'/medias/image/websitekey', $conf->website->dir_output.'/'.$object->ref.'/medias/image/'.$object->ref, 0, 1); // Medias can be shared, do not overwrite if exists
dolCopyDir($conf->website->dir_temp.'/'.$object->ref.'/medias/js/websitekey', $conf->website->dir_output.'/'.$object->ref.'/medias/js/'.$object->ref, 0, 1); // Medias can be shared, do not overwrite if exists
- $sqlfile = $conf->website->dir_temp.'/'.$object->ref.'/website_pages.sql';
+ $sqlfile = $conf->website->dir_temp."/".$object->ref.'/website_pages.sql';
$result = dolReplaceInFile($sqlfile, $arrayreplacement);
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index ffda0802c51..c80c09c7727 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -2378,7 +2378,7 @@ if ($action == 'generatesitemaps' && $usercanedit) {
// Add "has translation pages"
$sql = 'SELECT rowid as id, lang, pageurl from '.MAIN_DB_PREFIX.'website_page';
- $sql .= ' WHERE status = '.WebsitePage::STATUS_VALIDATED.' AND fk_page IN ('.$db->sanitize($objp->rowid.($translationof ? ', '.$translationof : '')).")";
+ $sql .= " WHERE status = ".((int) WebsitePage::STATUS_VALIDATED).' AND fk_page IN ('.$db->sanitize($objp->rowid.($translationof ? ", ".$translationof : "")).")";
$resqlhastrans = $db->query($sql);
if ($resqlhastrans) {
$num_rows_hastrans = $db->num_rows($resqlhastrans);
@@ -2857,7 +2857,7 @@ if (!GETPOST('hide_websitemenu')) {
$pagepreviousid = 0;
$pagenextid = 0;
if ($pageid) {
- $sql = 'SELECT MAX(rowid) as pagepreviousid FROM '.MAIN_DB_PREFIX.'website_page WHERE rowid < '.$pageid.' AND fk_website = '.((int) $object->id);
+ $sql = "SELECT MAX(rowid) as pagepreviousid FROM ".MAIN_DB_PREFIX."website_page WHERE rowid < ".((int) $pageid)." AND fk_website = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -2867,7 +2867,7 @@ if (!GETPOST('hide_websitemenu')) {
} else {
dol_print_error($db);
}
- $sql = 'SELECT MIN(rowid) as pagenextid FROM '.MAIN_DB_PREFIX.'website_page WHERE rowid > '.$pageid.' AND fk_website = '.((int) $object->id);
+ $sql = "SELECT MIN(rowid) as pagenextid FROM ".MAIN_DB_PREFIX."website_page WHERE rowid > ".((int) $pageid)." AND fk_website = ".((int) $object->id);
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
@@ -3829,7 +3829,7 @@ if ($action == 'editmeta' || $action == 'createcontainer') { // Edit properties
print '
';
if ($action != 'createcontainer') {
// Has translation pages
- $sql = 'SELECT rowid, lang from '.MAIN_DB_PREFIX.'website_page where fk_page = '.$objectpage->id;
+ $sql = 'SELECT rowid, lang from '.MAIN_DB_PREFIX.'website_page where fk_page = '.((int) $objectpage->id);
$resql = $db->query($sql);
if ($resql) {
$num_rows = $db->num_rows($resql);
From acf0386a9bbe84e1b774c71abfd915a0f113f4da Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 03:14:48 +0200
Subject: [PATCH 107/953] Fix css
---
htdocs/core/class/html.formticket.class.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/core/class/html.formticket.class.php b/htdocs/core/class/html.formticket.class.php
index f4e076640c4..76789ebe6de 100644
--- a/htdocs/core/class/html.formticket.class.php
+++ b/htdocs/core/class/html.formticket.class.php
@@ -1050,7 +1050,7 @@ class FormTicket
}
// Subject
- print ''.$langs->trans('Subject').' ';
+ print ''.$langs->trans('Subject').' ';
print ' ref.'] '.$langs->trans('TicketNewMessage').'" />';
print ' ';
From c932ea0710a8905b7966394ef0d5dc8753855832 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 05:06:14 +0200
Subject: [PATCH 108/953] Fix syntax error
---
htdocs/install/upgrade.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/install/upgrade.php b/htdocs/install/upgrade.php
index 7f4a8ac7bad..129ee9d7827 100644
--- a/htdocs/install/upgrade.php
+++ b/htdocs/install/upgrade.php
@@ -270,7 +270,7 @@ if (!GETPOST('action', 'aZ09') || preg_match('/upgrade/i', GETPOST('action', 'aZ
$values = $db->fetch_array($resql);
$i = 0;
$createsql = $values[1];
- $reg = aray();
+ $reg = array();
while (preg_match('/CONSTRAINT `(0_[0-9a-zA-Z]+|[_0-9a-zA-Z]+_ibfk_[0-9]+)`/i', $createsql, $reg) && $i < 100) {
$sqldrop = "ALTER TABLE ".$val." DROP FOREIGN KEY ".$reg[1];
$resqldrop = $db->query($sqldrop);
From 1b859fe72357dedefc68bd663f83ef6b794ccb6b Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 05:24:53 +0200
Subject: [PATCH 109/953] Fix warning
---
htdocs/comm/action/class/actioncomm.class.php | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index b7530e788a8..df73c6a70f7 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -585,12 +585,15 @@ class ActionComm extends CommonObject
//dol_syslog(var_export($this->userassigned, true));
$already_inserted = array();
foreach ($this->userassigned as $key => $val) {
- if (!is_array($val)) { // For backward compatibility when val=id
+ // Common value with new behavior is to have $val = array('id'=>iduser, 'transparency'=>0|1) and $this->userassigned is an array of iduser => $val.
+ if (!is_array($val)) { // For backward compatibility when $val='id'.
$val = array('id'=>$val);
}
if ($val['id'] > 0) {
- if (!empty($already_inserted[$val['id']])) continue;
+ if (!empty($already_inserted[$val['id']])) {
+ continue;
+ }
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
$sql .= " VALUES(".((int) $this->id).", 'user', ".((int) $val['id']).", ".(empty($val['mandatory']) ? '0' : ((int) $val['mandatory'])).", ".(empty($val['transparency']) ? '0' : ((int) $val['transparency'])).", ".(empty($val['answer_status']) ? '0' : ((int) $val['answer_status'])).")";
@@ -612,7 +615,10 @@ class ActionComm extends CommonObject
if (!empty($this->socpeopleassigned)) {
$already_inserted = array();
foreach ($this->socpeopleassigned as $id => $val) {
- if (!empty($already_inserted[$val['id']])) continue;
+ // Common value with new behavior is to have $val = iduser and $this->socpeopleassigned is an array of iduser => $val.
+ if (!empty($already_inserted[$id])) {
+ continue;
+ }
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
$sql .= " VALUES(".((int) $this->id).", 'socpeople', ".((int) $id).", 0, 0, 0)";
@@ -623,7 +629,7 @@ class ActionComm extends CommonObject
dol_syslog('Error to process socpeopleassigned: ' . $this->db->lasterror(), LOG_ERR);
$this->errors[] = $this->db->lasterror();
} else {
- $already_inserted[$val['id']] = true;
+ $already_inserted[$id] = true;
}
}
}
From 5c5b429dec32c5d980fa6751be5cf882c8ad49f3 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 05:33:19 +0200
Subject: [PATCH 110/953] Better error management of client WS unit test
---
test/phpunit/WebservicesInvoicesTest.php | 3 ++-
test/phpunit/WebservicesOrdersTest.php | 4 ++--
test/phpunit/WebservicesOtherTest.php | 4 ++--
test/phpunit/WebservicesProductsTest.php | 4 ++--
test/phpunit/WebservicesThirdpartyTest.php | 4 ++--
test/phpunit/WebservicesUserTest.php | 4 ++--
6 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/test/phpunit/WebservicesInvoicesTest.php b/test/phpunit/WebservicesInvoicesTest.php
index f6f499357a4..a077b34e208 100644
--- a/test/phpunit/WebservicesInvoicesTest.php
+++ b/test/phpunit/WebservicesInvoicesTest.php
@@ -414,7 +414,7 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
$result=0;
}
if (! $result || ! empty($result['faultstring'])) {
- print $this->soapclient->error_str;
+ print 'Error: '.$this->soapclient->error_str;
print "\n \n";
print $this->soapclient->request;
print "\n \n";
@@ -422,6 +422,7 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
print "\n";
}
+ print __METHOD__." count(result)=".(is_array($result) ? count($result) : 0)."\n";
print __METHOD__." result=".$result['result']['result_code'].$result['result']['result_label']."\n";
$this->assertEquals('OK', $result['result']['result_code']);
$this->assertEquals('ref-phpunit-2', $result['ref_ext']);
diff --git a/test/phpunit/WebservicesOrdersTest.php b/test/phpunit/WebservicesOrdersTest.php
index 9ffa00226e0..45d0bdcccbe 100644
--- a/test/phpunit/WebservicesOrdersTest.php
+++ b/test/phpunit/WebservicesOrdersTest.php
@@ -175,7 +175,7 @@ class WebservicesOrdersTest extends PHPUnit\Framework\TestCase
}
if (! $result || ! empty($result['faultstring'])) {
//var_dump($soapclient);
- print $soapclient->error_str;
+ print 'Error: '.$soapclient->error_str;
print "\n \n";
print $soapclient->request;
print "\n \n";
@@ -183,7 +183,7 @@ class WebservicesOrdersTest extends PHPUnit\Framework\TestCase
print "\n";
}
- print __METHOD__." count(result)=".count($result)."\n";
+ print __METHOD__." count(result)=".(is_array($result) ? count($result) : 0)."\n";
$this->assertEquals('OK', $result['result']['result_code']);
return $result;
diff --git a/test/phpunit/WebservicesOtherTest.php b/test/phpunit/WebservicesOtherTest.php
index 0e788a195a7..df1e0fa76a1 100644
--- a/test/phpunit/WebservicesOtherTest.php
+++ b/test/phpunit/WebservicesOtherTest.php
@@ -180,7 +180,7 @@ class WebservicesOtherTest extends PHPUnit\Framework\TestCase
}
if (! $result) {
//var_dump($soapclient);
- print $soapclient->error_str;
+ print 'Error: '.$soapclient->error_str;
print "\n \n";
print $soapclient->request;
print "\n \n";
@@ -212,7 +212,7 @@ class WebservicesOtherTest extends PHPUnit\Framework\TestCase
print "\n";
}
- print __METHOD__." count(result)=".count($result)."\n";
+ print __METHOD__." count(result)=".(is_array($result) ? count($result) : 0)."\n";
$this->assertEquals("SOAP-ENV:Client: Operation 'methodthatdoesnotexists' is not defined in the WSDL for this service", $soapclient->error_str);
return $result;
diff --git a/test/phpunit/WebservicesProductsTest.php b/test/phpunit/WebservicesProductsTest.php
index a31d147b9d7..c12323dbec7 100644
--- a/test/phpunit/WebservicesProductsTest.php
+++ b/test/phpunit/WebservicesProductsTest.php
@@ -322,7 +322,7 @@ class WebservicesProductsTest extends PHPUnit\Framework\TestCase
}
if (! $result || ! empty($result['faultstring']) || $result['result']['result_code'] != 'OK') {
//var_dump($soapclient);
- print $soapclient->error_str;
+ print 'Error: '.$soapclient->error_str;
print "\n \n";
print $soapclient->request;
print "\n \n";
@@ -330,7 +330,7 @@ class WebservicesProductsTest extends PHPUnit\Framework\TestCase
print "\n";
}
- print __METHOD__." count(result)=".count($result)."\n";
+ print __METHOD__." count(result)=".(is_array($result) ? count($result) : 0)."\n";
$this->assertEquals('OK', $result['result']['result_code']);
return 0;
diff --git a/test/phpunit/WebservicesThirdpartyTest.php b/test/phpunit/WebservicesThirdpartyTest.php
index fe9b15cee50..285b8456ffb 100644
--- a/test/phpunit/WebservicesThirdpartyTest.php
+++ b/test/phpunit/WebservicesThirdpartyTest.php
@@ -394,7 +394,7 @@ class WebservicesThirdpartyTest extends PHPUnit\Framework\TestCase
$result=0;
}
if (! $result || ! empty($result['faultstring'])) {
- print $this->soapclient->error_str;
+ print 'Error: '.$this->soapclient->error_str;
print "\n \n";
print $this->soapclient->request;
print "\n \n";
@@ -402,7 +402,7 @@ class WebservicesThirdpartyTest extends PHPUnit\Framework\TestCase
print "\n";
}
- print __METHOD__." result=".$result['result']['result_code']."\n";
+ print __METHOD__." count(result)=".(is_array($result) ? count($result) : 0)."\n";
$this->assertEquals('OK', $result['result']['result_code']);
return $result;
diff --git a/test/phpunit/WebservicesUserTest.php b/test/phpunit/WebservicesUserTest.php
index e3072844580..8b9ae2739a6 100644
--- a/test/phpunit/WebservicesUserTest.php
+++ b/test/phpunit/WebservicesUserTest.php
@@ -182,7 +182,7 @@ class WebservicesUserTest extends PHPUnit\Framework\TestCase
}
if (! $result) {
//var_dump($soapclient);
- print $soapclient->error_str;
+ print 'Error: '.$soapclient->error_str;
print "\n \n";
print $soapclient->request;
print "\n \n";
@@ -213,7 +213,7 @@ class WebservicesUserTest extends PHPUnit\Framework\TestCase
print "\n";
}
- print __METHOD__." count(result)=".count($result)."\n";
+ print __METHOD__." count(result)=".(is_array($result) ? count($result) : 0)."\n";
$this->assertEquals('NOT_FOUND', $result['result']['result_code'], 'Test on ref that does not exists');
return $result;
From 99b1a59a1e806813f28f822a1632e51724d686ec Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 05:38:12 +0200
Subject: [PATCH 111/953] Fix warning event late on tab Resources
---
htdocs/resource/element_resource.php | 2 ++
1 file changed, 2 insertions(+)
diff --git a/htdocs/resource/element_resource.php b/htdocs/resource/element_resource.php
index 83a8d58d410..4d0736c5f64 100644
--- a/htdocs/resource/element_resource.php
+++ b/htdocs/resource/element_resource.php
@@ -281,6 +281,8 @@ $form = new Form($db);
$pagetitle = $langs->trans('ResourceElementPage');
llxHeader('', $pagetitle, '');
+$now = dol_now();
+$delay_warning = $conf->global->MAIN_DELAY_ACTIONS_TODO * 24 * 60 * 60;
// Load available resource, declared by modules
$ret = count($object->available_resources);
From aab6281ba610071b745f62861aa11ab86acf7b50 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 05:38:40 +0200
Subject: [PATCH 112/953] Clean code
---
htdocs/comm/action/document.php | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/htdocs/comm/action/document.php b/htdocs/comm/action/document.php
index eb1ac59cfe0..4c4d44c3a6e 100644
--- a/htdocs/comm/action/document.php
+++ b/htdocs/comm/action/document.php
@@ -108,6 +108,8 @@ $help_url = 'EN:Module_Agenda_En|FR:Module_Agenda|ES:M&omodulodulo_Agenda';
llxHeader('', $langs->trans("Agenda"), $help_url);
+$now = dol_now();
+$delay_warning = $conf->global->MAIN_DELAY_ACTIONS_TODO * 24 * 60 * 60;
if ($object->id > 0) {
$result1 = $object->fetch($id);
@@ -135,9 +137,6 @@ if ($object->id > 0) {
$head = actions_prepare_head($object);
- $now = dol_now();
- $delay_warning = $conf->global->MAIN_DELAY_ACTIONS_TODO * 24 * 60 * 60;
-
print dol_get_fiche_head($head, 'documents', $langs->trans("Action"), -1, 'action');
$linkback = img_picto($langs->trans("BackToList"), 'object_list', 'class="hideonsmartphone pictoactionview"');
From 64c4e25c0237e59bda595e9ff5ccc9cc32ceeffd Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 05:24:53 +0200
Subject: [PATCH 113/953] Fix warning
---
htdocs/comm/action/class/actioncomm.class.php | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index d5a0c427352..6bfa9de9926 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -585,12 +585,15 @@ class ActionComm extends CommonObject
//dol_syslog(var_export($this->userassigned, true));
$already_inserted = array();
foreach ($this->userassigned as $key => $val) {
- if (!is_array($val)) { // For backward compatibility when val=id
+ // Common value with new behavior is to have $val = array('id'=>iduser, 'transparency'=>0|1) and $this->userassigned is an array of iduser => $val.
+ if (!is_array($val)) { // For backward compatibility when $val='id'.
$val = array('id'=>$val);
}
if ($val['id'] > 0) {
- if (!empty($already_inserted[$val['id']])) continue;
+ if (!empty($already_inserted[$val['id']])) {
+ continue;
+ }
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
$sql .= " VALUES(".$this->id.", 'user', ".$val['id'].", ".(empty($val['mandatory']) ? '0' : $val['mandatory']).", ".(empty($val['transparency']) ? '0' : $val['transparency']).", ".(empty($val['answer_status']) ? '0' : $val['answer_status']).")";
@@ -612,7 +615,10 @@ class ActionComm extends CommonObject
if (!empty($this->socpeopleassigned)) {
$already_inserted = array();
foreach ($this->socpeopleassigned as $id => $val) {
- if (!empty($already_inserted[$val['id']])) continue;
+ // Common value with new behavior is to have $val = iduser and $this->socpeopleassigned is an array of iduser => $val.
+ if (!empty($already_inserted[$id])) {
+ continue;
+ }
$sql = "INSERT INTO ".MAIN_DB_PREFIX."actioncomm_resources(fk_actioncomm, element_type, fk_element, mandatory, transparency, answer_status)";
$sql .= " VALUES(".$this->id.", 'socpeople', ".$id.", 0, 0, 0)";
@@ -623,7 +629,7 @@ class ActionComm extends CommonObject
dol_syslog('Error to process socpeopleassigned: ' . $this->db->lasterror(), LOG_ERR);
$this->errors[] = $this->db->lasterror();
} else {
- $already_inserted[$val['id']] = true;
+ $already_inserted[$id] = true;
}
}
}
From 700138815927ee1dfc7c1cbe7de7e246d2a4d368 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 05:38:12 +0200
Subject: [PATCH 114/953] Fix warning event late on tab Resources
---
htdocs/resource/element_resource.php | 2 ++
1 file changed, 2 insertions(+)
diff --git a/htdocs/resource/element_resource.php b/htdocs/resource/element_resource.php
index 83a8d58d410..4d0736c5f64 100644
--- a/htdocs/resource/element_resource.php
+++ b/htdocs/resource/element_resource.php
@@ -281,6 +281,8 @@ $form = new Form($db);
$pagetitle = $langs->trans('ResourceElementPage');
llxHeader('', $pagetitle, '');
+$now = dol_now();
+$delay_warning = $conf->global->MAIN_DELAY_ACTIONS_TODO * 24 * 60 * 60;
// Load available resource, declared by modules
$ret = count($object->available_resources);
From f825d3fda4e46b8408a37009545744b354d7ee10 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 13:27:55 +0200
Subject: [PATCH 115/953] Trans
---
htdocs/compta/facture/list.php | 2 +-
htdocs/langs/en_US/bills.lang | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/htdocs/compta/facture/list.php b/htdocs/compta/facture/list.php
index 2b8a65445ba..a54797323a3 100644
--- a/htdocs/compta/facture/list.php
+++ b/htdocs/compta/facture/list.php
@@ -430,7 +430,7 @@ if ($action == 'makepayment_confirm' && $user->rights->facture->paiement) {
}
}
if (empty($errorpayment)) {
- setEventMessage($langs->trans('RegisterPaymentAndClasiffiedPayedDone', $facture->ref));
+ setEventMessage($langs->trans('PaymentRegisteredAndInvoiceSetToPaid', $facture->ref));
}
}
}
diff --git a/htdocs/langs/en_US/bills.lang b/htdocs/langs/en_US/bills.lang
index c37b58fee8c..203b0201f9b 100644
--- a/htdocs/langs/en_US/bills.lang
+++ b/htdocs/langs/en_US/bills.lang
@@ -593,4 +593,4 @@ SituationTotalProgress=Total progress %d %%
SearchUnpaidInvoicesWithDueDate=Search unpaid invoices with a due date = %s
RegisterPaymentAndClasiffiedPayed=Enter payment and classify 'Paid'
NoPaymentAvailable=No payment available for %s
-RegisterPaymentAndClasiffiedPayedDone=Payment registered and classify 'Paid' done for invoice %s
+PaymentRegisteredAndInvoiceSetToPaid=Payment registered and invoice %s set to paid
From b2791c31030d5054d32313aadaa39d1033c48f5c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 13:36:47 +0200
Subject: [PATCH 116/953] Fix generate the phpunit file from modulebuilder
---
htdocs/modulebuilder/index.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/modulebuilder/index.php b/htdocs/modulebuilder/index.php
index 0a05266b6ff..2c684d77da1 100644
--- a/htdocs/modulebuilder/index.php
+++ b/htdocs/modulebuilder/index.php
@@ -383,7 +383,7 @@ if ($dirins && $action == 'initphpunit' && !empty($module)) {
$modulename = ucfirst($module); // Force first letter in uppercase
$objectname = $tabobj;
- dol_mkdir($dirins.'/'.strtolower($module).'/class');
+ dol_mkdir($dirins.'/'.strtolower($module).'/test/phpunit');
$srcdir = DOL_DOCUMENT_ROOT.'/modulebuilder/template';
$srcfile = $srcdir.'/test/phpunit/MyObjectTest.php';
$destfile = $dirins.'/'.strtolower($module).'/test/phpunit/'.strtolower($objectname).'Test.php';
From 1fec53e7f2e5a0c0cabaff64242d6d292b7e3954 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 13:36:47 +0200
Subject: [PATCH 117/953] Fix generate the phpunit file from modulebuilder
---
htdocs/modulebuilder/index.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/modulebuilder/index.php b/htdocs/modulebuilder/index.php
index f8ca876eafc..be8e4481681 100644
--- a/htdocs/modulebuilder/index.php
+++ b/htdocs/modulebuilder/index.php
@@ -383,7 +383,7 @@ if ($dirins && $action == 'initphpunit' && !empty($module)) {
$modulename = ucfirst($module); // Force first letter in uppercase
$objectname = $tabobj;
- dol_mkdir($dirins.'/'.strtolower($module).'/class');
+ dol_mkdir($dirins.'/'.strtolower($module).'/test/phpunit');
$srcdir = DOL_DOCUMENT_ROOT.'/modulebuilder/template';
$srcfile = $srcdir.'/test/phpunit/MyObjectTest.php';
$destfile = $dirins.'/'.strtolower($module).'/test/phpunit/'.strtolower($objectname).'Test.php';
From 20d0b0c56409f202a7210245f2dbc964dc07d9f2 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 13:56:59 +0200
Subject: [PATCH 118/953] Fix link in some tooltips
---
htdocs/modulebuilder/index.php | 11 +++++++----
htdocs/theme/eldy/global.inc.php | 4 ++++
htdocs/theme/md/style.css.php | 4 ++++
3 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/htdocs/modulebuilder/index.php b/htdocs/modulebuilder/index.php
index be8e4481681..ed090618855 100644
--- a/htdocs/modulebuilder/index.php
+++ b/htdocs/modulebuilder/index.php
@@ -2218,7 +2218,8 @@ if ($module == 'initmodule') {
if ($action != 'editfile' || empty($file)) {
print '';
- $htmlhelp = $langs->trans("DictionariesDefDescTooltip", ''.$langs->trans('Setup').' - '.$langs->trans('Dictionaries').' ');
+ $htmlhelp = $langs->trans("DictionariesDefDescTooltip", '{s1}');
+ $htmlhelp = str_replace('{s1}', ''.$langs->trans('Setup').' - '.$langs->trans('Dictionaries').' ', $htmlhelp);
print $form->textwithpicto($langs->trans("DictionariesDefDesc"), $htmlhelp, 1, 'help', '', 0, 2, 'helpondesc').' ';
print ' ';
print ' ';
@@ -3002,7 +3003,8 @@ if ($module == 'initmodule') {
if ($action != 'editfile' || empty($file)) {
print '';
- $htmlhelp = $langs->trans("MenusDefDescTooltip", ''.$langs->trans('Setup').' - '.$langs->trans('Menus').' ');
+ $htmlhelp = $langs->trans("MenusDefDescTooltip", '{s1}');
+ $htmlhelp = str_replace('{s1}', ''.$langs->trans('Setup').' - '.$langs->trans('Menus').' ', $htmlhelp);
print $form->textwithpicto($langs->trans("MenusDefDesc"), $htmlhelp, 1, 'help', '', 0, 2, 'helpondesc').' ';
print ' ';
print ' ';
@@ -3134,7 +3136,8 @@ if ($module == 'initmodule') {
if ($action != 'editfile' || empty($file)) {
print '';
- $htmlhelp = $langs->trans("PermissionsDefDescTooltip", ''.$langs->trans('DefaultPermissions').' ');
+ $htmlhelp = $langs->trans("PermissionsDefDescTooltip", '{s1}');
+ $htmlhelp = str_replace('{s1}', ''.$langs->trans('DefaultRights').' ', $htmlhelp);
print $form->textwithpicto($langs->trans("PermissionsDefDesc"), $htmlhelp, 1, 'help', '', 0, 2, 'helpondesc').' ';
print ' ';
print ' ';
@@ -3601,7 +3604,7 @@ if ($module == 'initmodule') {
$cronjobs = $moduleobj->cronjobs;
if ($action != 'editfile' || empty($file)) {
- print ''.str_replace('{s1}', ''.$langs->transnoentities('CronList').' ', $langs->trans("CronJobDefDesc", '{s1}')).' ';
+ print ''.str_replace('{s1}', ''.$langs->transnoentities('CronList').' ', $langs->trans("CronJobDefDesc", '{s1}')).' ';
print ' ';
print ' '.$langs->trans("DescriptorFile").' : '.$pathtofile.' ';
diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php
index 58e19d36a22..50490fa119f 100644
--- a/htdocs/theme/eldy/global.inc.php
+++ b/htdocs/theme/eldy/global.inc.php
@@ -295,6 +295,10 @@ input.buttonpayment, button.buttonpayment, div.buttonpayment {
cursor: pointer;
max-width: 350px;
}
+.nofocusvisible:focus-visible {
+ outline: none;
+}
+
div.buttonpayment input:focus {
color: #008;
}
diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php
index ef7e69c0538..1a18bbf6882 100644
--- a/htdocs/theme/md/style.css.php
+++ b/htdocs/theme/md/style.css.php
@@ -473,6 +473,10 @@ input.buttonpayment, button.buttonpayment, div.buttonpayment {
white-space: normal;
color: #888 !important;
}
+.nofocusvisible:focus-visible {
+ outline: none;
+}
+
div.buttonpayment input {
background-color: unset;
border-bottom: unset;
From afb8a86aff2d9f2526e274befb2f36b6d8b543e5 Mon Sep 17 00:00:00 2001
From: BENKE Charlene <1179011+defrance@users.noreply.github.com>
Date: Sat, 28 Aug 2021 14:14:48 +0200
Subject: [PATCH 119/953] Clean code (line in double)
---
htdocs/fourn/facture/paiement.php | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/htdocs/fourn/facture/paiement.php b/htdocs/fourn/facture/paiement.php
index b5bc33b78c0..fcbfdcf7b45 100644
--- a/htdocs/fourn/facture/paiement.php
+++ b/htdocs/fourn/facture/paiement.php
@@ -10,6 +10,7 @@
* Copyright (C) 2015 Juanjo Menent
* Copyright (C) 2017 Alexandre Spangaro
* Copyright (C) 2018-2020 Frédéric France
+ * Copyright (C) 2021 Charlene Benke
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -291,8 +292,6 @@ if (empty($reshook)) {
$paiement->num_payment = GETPOST('num_paiement', 'alphanohtml');
$paiement->note_private = GETPOST('comment', 'alpha');
- $paiement->num_payment = $paiement->num_payment;
- $paiement->note_private = $paiement->note_private;
if (!$error) {
$paiement_id = $paiement->create($user, (GETPOST('closepaidinvoices') == 'on' ? 1 : 0), $thirdparty);
From 45515fa8b2ef3313409af55466902cb0a24e95e7 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 14:28:50 +0200
Subject: [PATCH 120/953] fix css
---
htdocs/theme/eldy/global.inc.php | 2 +-
htdocs/theme/md/style.css.php | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php
index 50490fa119f..79977faac6a 100644
--- a/htdocs/theme/eldy/global.inc.php
+++ b/htdocs/theme/eldy/global.inc.php
@@ -296,7 +296,7 @@ input.buttonpayment, button.buttonpayment, div.buttonpayment {
max-width: 350px;
}
.nofocusvisible:focus-visible {
- outline: none;
+ outline: none;
}
div.buttonpayment input:focus {
diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php
index 1a18bbf6882..0d8851208f6 100644
--- a/htdocs/theme/md/style.css.php
+++ b/htdocs/theme/md/style.css.php
@@ -474,7 +474,7 @@ input.buttonpayment, button.buttonpayment, div.buttonpayment {
color: #888 !important;
}
.nofocusvisible:focus-visible {
- outline: none;
+ outline: none;
}
div.buttonpayment input {
From f359bfaaf2f8544af93ced8a156c3b933bf3398d Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 14:31:56 +0200
Subject: [PATCH 121/953] Update emailcollector.class.php
---
.../class/emailcollector.class.php | 24 +------------------
1 file changed, 1 insertion(+), 23 deletions(-)
diff --git a/htdocs/emailcollector/class/emailcollector.class.php b/htdocs/emailcollector/class/emailcollector.class.php
index 88cb4bcc1d2..a77938ceb79 100644
--- a/htdocs/emailcollector/class/emailcollector.class.php
+++ b/htdocs/emailcollector/class/emailcollector.class.php
@@ -35,32 +35,10 @@ require_once DOL_DOCUMENT_ROOT.'/commande/class/commande.class.php'; // customer
require_once DOL_DOCUMENT_ROOT.'/expedition/class/expedition.class.php'; // Shipment
require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.facture.class.php'; // supplier invoice
require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.commande.class.php'; // supplier order
-include_once DOL_DOCUMENT_ROOT.'/supplier_proposal/class/supplier_proposal.class.php'; // supplier proposal
+require_once DOL_DOCUMENT_ROOT.'/supplier_proposal/class/supplier_proposal.class.php'; // supplier proposal
require_once DOL_DOCUMENT_ROOT."/reception/class/reception.class.php"; // reception
//require_once DOL_DOCUMENT_ROOT.'/holiday/class/holiday.class.php'; // Holidays (leave request)
//require_once DOL_DOCUMENT_ROOT.'/expensereport/class/expensereport.class.php'; // expernse report
-/*
-if (!empty($conf->propal->enabled)) {
-}
-if (!empty($conf->commande->enabled)) {
-}
-if (!empty($conf->expedition->enabled)) {
-}
-if (!empty($conf->facture->enabled)) {
- require_once DOL_DOCUMENT_ROOT.'/compta/facture/class/facture.class.php';
-}
-if (!empty($conf->facture->enabled)) {
- require_once DOL_DOCUMENT_ROOT.'/compta/facture/class/facture-rec.class.php';
-}
-if (!empty($conf->contrat->enabled)) {
- require_once DOL_DOCUMENT_ROOT.'/contrat/class/contrat.class.php';
-}
-if (!empty($conf->adherent->enabled)) {
- require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php';
-}
-if (!empty($conf->ficheinter->enabled)) { //files
- require_once DOL_DOCUMENT_ROOT.'/fichinter/class/fichinter.class.php';
-}*/
/**
From d98390e6757de87331fc51db270303bc492a8b2c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 14:42:31 +0200
Subject: [PATCH 122/953] Update api_orders.class.php
---
htdocs/commande/class/api_orders.class.php | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index 2510e793018..88fed4bce63 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -970,18 +970,17 @@ class Orders extends DolibarrApi
/**
* Get the shipments of an order
*
- *
* @param int $id Id of the order
*
* @url GET {id}/shipment
*
+ * @return array
+ *
* @throws RestException 401
* @throws RestException 404
* @throws RestException 500
- *
- * @return array
*/
- public function getOrderShipements($id)
+ public function getOrderShipments($id)
{
require_once DOL_DOCUMENT_ROOT.'/expedition/class/expedition.class.php';
if (!DolibarrApiAccess::$user->rights->expedition->lire) {
From 3585259b555ea6b11bb60e8f97dfa408074d03d5 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 14:43:17 +0200
Subject: [PATCH 123/953] Update api_orders.class.php
---
htdocs/commande/class/api_orders.class.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index 88fed4bce63..743c0633ffa 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -1036,7 +1036,7 @@ class Orders extends DolibarrApi
*
* @return int
*/
- public function createOrderShipement($id, $warehouse_id)
+ public function createOrderShipment($id, $warehouse_id)
{
require_once DOL_DOCUMENT_ROOT.'/expedition/class/expedition.class.php';
if (!DolibarrApiAccess::$user->rights->expedition->creer) {
From 049992aed47900fe5354416ed1949d908c5767ea Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 14:44:13 +0200
Subject: [PATCH 124/953] Update api_orders.class.php
---
htdocs/commande/class/api_orders.class.php | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index 743c0633ffa..d625f2acbf1 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -1030,11 +1030,11 @@ class Orders extends DolibarrApi
*
* @url POST {id}/shipment/{warehouse_id}
*
+ * @return int
+ *
* @throws RestException 401
* @throws RestException 404
* @throws RestException 500
- *
- * @return int
*/
public function createOrderShipment($id, $warehouse_id)
{
From 0e38e1e2c4de780d81c11a6c7bd18408cf7c0fc5 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 14:51:49 +0200
Subject: [PATCH 125/953] NEW Add hook hookGetEntity. Change name and param of
hook
---
htdocs/core/class/hookmanager.class.php | 2 +-
htdocs/core/lib/functions.lib.php | 9 +++++----
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/htdocs/core/class/hookmanager.class.php b/htdocs/core/class/hookmanager.class.php
index d158ec2fa70..40610ce5d6f 100644
--- a/htdocs/core/class/hookmanager.class.php
+++ b/htdocs/core/class/hookmanager.class.php
@@ -189,7 +189,7 @@ class HookManager
'formConfirm',
'getAccessForbiddenMessage',
'getDirList',
- 'functionGetEntity',
+ 'hookGetEntity',
'getFormMail',
'getFormatedCustomerRef',
'getFormatedSupplierRef',
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 604e2035d95..483e890e369 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -104,7 +104,7 @@ function getDoliDBInstance($type, $host, $user, $pass, $name, $port)
*/
function getEntity($element, $shared = 1, $currentobject = null)
{
- global $conf, $mc, $hookmanager, $object;
+ global $conf, $mc, $hookmanager, $object, $action;
// fix different element names (France to English)
switch ($element) {
@@ -129,12 +129,13 @@ function getEntity($element, $shared = 1, $currentobject = null)
// Manipulate entities to query on the fly
$parameters = array(
- 'object' => $object,
- 'currentobject' => $currentobject,
'element' => $element,
'shared' => $shared,
+ 'object' => $object,
+ 'currentobject' => $currentobject,
+ 'out' => $out
);
- $reshook = $hookmanager->executeHooks('functionGetEntity', $parameters, $out, $element); // Note that $action and $object may have been modified by some hooks
+ $reshook = $hookmanager->executeHooks('hookGetEntity', $parameters, $currentobject, $action); // Note that $action and $object may have been modified by some hooks
if (is_numeric($reshook)) {
if ($reshook == 0 && !empty($hookmanager->resprints)) {
From c509e3bc432b111f952e1ebeb826f785b8d4fa42 Mon Sep 17 00:00:00 2001
From: lmarcouiller
Date: Thu, 26 Aug 2021 10:32:29 +0200
Subject: [PATCH 126/953] FIx error 500 on restler api PHP 8.0
---
htdocs/ticket/class/api_tickets.class.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/ticket/class/api_tickets.class.php b/htdocs/ticket/class/api_tickets.class.php
index e104d425bf4..f3a9c738aac 100644
--- a/htdocs/ticket/class/api_tickets.class.php
+++ b/htdocs/ticket/class/api_tickets.class.php
@@ -17,7 +17,7 @@
use Luracast\Restler\RestException;
-require 'ticket.class.php';
+require_once DOL_DOCUMENT_ROOT.'/ticket/class/ticket.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/ticket.lib.php';
From 28752ddca47490c38f45f6e66c42e9ad68e590bd Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 15:19:54 +0200
Subject: [PATCH 127/953] Fix concat
---
htdocs/projet/tasks/time.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/projet/tasks/time.php b/htdocs/projet/tasks/time.php
index c438f8c133a..634b3c136d9 100644
--- a/htdocs/projet/tasks/time.php
+++ b/htdocs/projet/tasks/time.php
@@ -463,7 +463,7 @@ if ($action == 'confirm_generateinvoice') {
$arrayoftasks[$object->timespent_id]['totalvaluetodivideby3600'] = $object->timespent_duration * $object->timespent_thm;
$arrayoftasks[$object->timespent_id]['note'] = $ftask->ref.' - '.$ftask->label.' - '.$username.($object->timespent_note ? ' - '.$object->timespent_note : ''); // TODO Add user name in note
if (!empty($conf->global->PROJECT_TIME_SPENT_INTO_INVOICE_ADD_TIME_DT)) {
- $arrayoftasks[$object->timespent_id]['note'] = "\n";
+ $arrayoftasks[$object->timespent_id]['note'] .= "\n";
if (!empty($object->timespent_withhour)) {
$arrayoftasks[$object->timespent_id]['note'] .= $langs->trans("Date") . ': ' . dol_print_date($object->timespent_datehour);
} else {
From 6b8f6acf32d76427b606200b2a52a6553d07acf5 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 15:26:06 +0200
Subject: [PATCH 128/953] Update card.php
---
htdocs/contrat/card.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php
index d07176d1670..232d5e0798b 100644
--- a/htdocs/contrat/card.php
+++ b/htdocs/contrat/card.php
@@ -1089,7 +1089,7 @@ if ($action == 'create') {
print ''.$langs->trans('ThirdParty').' ';
if ($socid > 0) {
print '';
- print $soc->getNomUrl(1, 'customer');
+ print $soc->getNomUrl(1);
print ' ';
print ' ';
} else {
From fae0b3c8bec15fe415561005ae7b98d2d98e8629 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 15:26:36 +0200
Subject: [PATCH 129/953] Update card.php
---
htdocs/contrat/card.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php
index 232d5e0798b..470895a2c22 100644
--- a/htdocs/contrat/card.php
+++ b/htdocs/contrat/card.php
@@ -1296,7 +1296,7 @@ if ($action == 'create') {
$morehtmlref .= $form->editfieldkey("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $user->rights->contrat->creer, 'string', '', 0, 1);
$morehtmlref .= $form->editfieldval("RefSupplier", 'ref_supplier', $object->ref_supplier, $object, $user->rights->contrat->creer, 'string', '', null, null, '', 1, 'getFormatedSupplierRef');
// Thirdparty
- $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1, 'customer');
+ $morehtmlref .= ' '.$langs->trans('ThirdParty').' : '.$object->thirdparty->getNomUrl(1);
if (empty($conf->global->MAIN_DISABLE_OTHER_LINK) && $object->thirdparty->id > 0) {
$morehtmlref .= ' ('.$langs->trans("OtherContracts").' )';
}
From faf1d52d9190747648c5a6fcbff3cf31a1fcb2de Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 16:32:22 +0200
Subject: [PATCH 130/953] Update card.php
---
htdocs/expedition/card.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/expedition/card.php b/htdocs/expedition/card.php
index c4ec3504383..e020758fbbb 100644
--- a/htdocs/expedition/card.php
+++ b/htdocs/expedition/card.php
@@ -717,7 +717,7 @@ if (empty($reshook)) {
unset($_POST[$qty]);
}
}
- } else { // both product batch and stock are not activated.
+ } elsif (empty($conf->stock->enabled) && empty($conf->productbatch->enabled)) { // both product batch and stock are not activated.
$qty = "qtyl".$line_id;
$line->id = $line_id;
$line->qty = GETPOST($qty, 'int');
From 2ddebc123ab8eb67f1561555532a6b42d73a1ebf Mon Sep 17 00:00:00 2001
From: stickler-ci
Date: Sat, 28 Aug 2021 14:32:44 +0000
Subject: [PATCH 131/953] Fixing style errors.
---
htdocs/expedition/card.php | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/htdocs/expedition/card.php b/htdocs/expedition/card.php
index e020758fbbb..e8455c906ef 100644
--- a/htdocs/expedition/card.php
+++ b/htdocs/expedition/card.php
@@ -717,15 +717,15 @@ if (empty($reshook)) {
unset($_POST[$qty]);
}
}
- } elsif (empty($conf->stock->enabled) && empty($conf->productbatch->enabled)) { // both product batch and stock are not activated.
+ } elsif(empty($conf->stock->enabled) && empty($conf->productbatch->enabled)) { // both product batch and stock are not activated.
$qty = "qtyl".$line_id;
$line->id = $line_id;
$line->qty = GETPOST($qty, 'int');
$line->entrepot_id = 0;
- if ($line->update($user) < 0) {
- setEventMessages($line->error, $line->errors, 'errors');
- $error++;
- }
+ if ($line->update($user) < 0) {
+ setEventMessages($line->error, $line->errors, 'errors');
+ $error++;
+ }
unset($_POST[$qty]);
}
} else {
From 31ca781236bcb96a0c9812d6a20787e1b2a4805c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 16:34:38 +0200
Subject: [PATCH 132/953] Update card.php
---
htdocs/expedition/card.php | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/htdocs/expedition/card.php b/htdocs/expedition/card.php
index e8455c906ef..8ab667780f0 100644
--- a/htdocs/expedition/card.php
+++ b/htdocs/expedition/card.php
@@ -717,7 +717,7 @@ if (empty($reshook)) {
unset($_POST[$qty]);
}
}
- } elsif(empty($conf->stock->enabled) && empty($conf->productbatch->enabled)) { // both product batch and stock are not activated.
+ } elseif (empty($conf->stock->enabled) && empty($conf->productbatch->enabled)) { // both product batch and stock are not activated.
$qty = "qtyl".$line_id;
$line->id = $line_id;
$line->qty = GETPOST($qty, 'int');
@@ -2262,7 +2262,7 @@ if ($action == 'create') {
print ' ';
print '';
}
- } else { // both product batch and stock are not activated.
+ } elseif (empty($conf->stock->enabled) && empty($conf->productbatch->enabled)) { // both product batch and stock are not activated.
print '';
print '';
// Qty to ship or shipped
From e60cf96c8eb669904c91e68fa845325c10832c80 Mon Sep 17 00:00:00 2001
From: stickler-ci
Date: Sat, 28 Aug 2021 14:35:01 +0000
Subject: [PATCH 133/953] Fixing style errors.
---
htdocs/expedition/card.php | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/htdocs/expedition/card.php b/htdocs/expedition/card.php
index 8ab667780f0..d4ea2fa006c 100644
--- a/htdocs/expedition/card.php
+++ b/htdocs/expedition/card.php
@@ -722,10 +722,10 @@ if (empty($reshook)) {
$line->id = $line_id;
$line->qty = GETPOST($qty, 'int');
$line->entrepot_id = 0;
- if ($line->update($user) < 0) {
- setEventMessages($line->error, $line->errors, 'errors');
- $error++;
- }
+ if ($line->update($user) < 0) {
+ setEventMessages($line->error, $line->errors, 'errors');
+ $error++;
+ }
unset($_POST[$qty]);
}
} else {
From 11497d4bf0c0f28d0dc5afaf2cfd5454ce922f84 Mon Sep 17 00:00:00 2001
From: henrynopo
Date: Sat, 28 Aug 2021 22:38:17 +0800
Subject: [PATCH 134/953] Update card.php
---
htdocs/compta/facture/card.php | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
index 0386b30dcc5..2f56ef3b3a7 100644
--- a/htdocs/compta/facture/card.php
+++ b/htdocs/compta/facture/card.php
@@ -5071,7 +5071,7 @@ if ($action == 'create') {
}
print '';
print '';
- print ''.price($resteapayeraffiche).' ';
+ print ''.price($resteapayeraffiche).' ';
// Remainder to pay Multicurrency
if ($object->multicurrency_code != $conf->currency || $object->multicurrency_tx != 1) {
@@ -5084,11 +5084,9 @@ if ($action == 'create') {
}
print '';
print ' ';
- print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($object->multicurrency_tx*$resteapayeraffiche, 'MT')).' ';
+ print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($object->multicurrency_tx*$resteapayeraffiche, 'MT')).' ';
}
- print ' ';
-
// Retained warranty : usualy use on construction industry
if (!empty($object->situation_final) && !empty($object->retained_warranty) && $displayWarranty) {
// Billed - retained warranty
@@ -5127,7 +5125,7 @@ if ($action == 'create') {
print ' ('.$langs->trans('ExcessPaid').')';
}
print ' : ';
- print ''.price($sign * $resteapayeraffiche).' ';
+ print ''.price($sign * $resteapayeraffiche).' ';
// Remainder to pay back Multicurrency
if ($object->multicurrency_code != $conf->currency || $object->multicurrency_tx != 1) {
@@ -5140,11 +5138,9 @@ if ($action == 'create') {
}
print '';
print '';
- print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($sign * $object->multicurrency_tx * $resteapayeraffiche, 'MT')).' ';
+ print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($sign * $object->multicurrency_tx * $resteapayeraffiche, 'MT')).' ';
}
- print ' ';
-
// Sold credit note
// print ''.$langs->trans('TotalTTC').' : ';
// print ''.price($sign *
From 444786b34fce30ff83f9d82ef702678d73f6be4d Mon Sep 17 00:00:00 2001
From: henrynopo
Date: Sat, 28 Aug 2021 22:52:06 +0800
Subject: [PATCH 135/953] Update card.php
---
htdocs/fourn/facture/card.php | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index 660401e9131..5558bb26207 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -3236,7 +3236,7 @@ if ($action == 'create') {
}
print '';
print ' ';
- print ''.price($resteapayeraffiche).' ';
+ print ''.price($resteapayeraffiche).' ';
// Remainder to pay Multicurrency
if ($object->multicurrency_code != $conf->currency || $object->multicurrency_tx != 1) {
@@ -3249,10 +3249,9 @@ if ($action == 'create') {
}
print '';
print '';
- print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($object->multicurrency_tx*$resteapayeraffiche, 'MT')).' ';
+ print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($object->multicurrency_tx*$resteapayeraffiche, 'MT')).' ';
}
-
- print ' ';
+
} else // Credit note
{
$cssforamountpaymentcomplete = 'amountpaymentneutral';
@@ -3275,7 +3274,7 @@ if ($action == 'create') {
}
print '';
print '';
- print ''.price($sign * $resteapayeraffiche).' ';
+ print ''.price($sign * $resteapayeraffiche).' ';
// Remainder to pay back Multicurrency
if ($object->multicurrency_code != $conf->currency || $object->multicurrency_tx != 1) {
@@ -3288,11 +3287,9 @@ if ($action == 'create') {
}
print '';
print '';
- print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($sign * $object->multicurrency_tx * $resteapayeraffiche, 'MT')).' ';
+ print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($sign * $object->multicurrency_tx * $resteapayeraffiche, 'MT')).' ';
}
-
- print ' ';
-
+
// Sold credit note
// print ''.$langs->trans('TotalTTC').' : ';
// print ''.price($sign *
From 63427638d85d734d6b847dd742a43267e151854b Mon Sep 17 00:00:00 2001
From: stickler-ci
Date: Sat, 28 Aug 2021 14:54:16 +0000
Subject: [PATCH 136/953] Fixing style errors.
---
htdocs/fourn/facture/card.php | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index 5558bb26207..ce1e6a06136 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -3251,7 +3251,6 @@ if ($action == 'create') {
print ' ';
print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($object->multicurrency_tx*$resteapayeraffiche, 'MT')).' ';
}
-
} else // Credit note
{
$cssforamountpaymentcomplete = 'amountpaymentneutral';
@@ -3275,7 +3274,7 @@ if ($action == 'create') {
print '';
print '';
print ''.price($sign * $resteapayeraffiche).' ';
-
+
// Remainder to pay back Multicurrency
if ($object->multicurrency_code != $conf->currency || $object->multicurrency_tx != 1) {
print '';
@@ -3289,7 +3288,7 @@ if ($action == 'create') {
print ' ';
print ''.(!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency).' '.price(price2num($sign * $object->multicurrency_tx * $resteapayeraffiche, 'MT')).' ';
}
-
+
// Sold credit note
// print ''.$langs->trans('TotalTTC').' : ';
// print ''.price($sign *
From bb94ea73340b345d0abbe700ab41fd9f2f8c25ac Mon Sep 17 00:00:00 2001
From: Laurent Destailleur
Date: Sat, 28 Aug 2021 17:17:39 +0200
Subject: [PATCH 137/953] Fix debug car reception: Fill/reset link, colspan,
translation
---
htdocs/core/class/commonobject.class.php | 2 +-
htdocs/expedition/card.php | 34 +++++++++++++++---------
2 files changed, 23 insertions(+), 13 deletions(-)
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index 5df73f49f5c..cd7ea1af73c 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -7496,7 +7496,7 @@ abstract class CommonObject
if ($display_type == 'card') {
$out .= '