diff --git a/htdocs/core/class/html.formother.class.php b/htdocs/core/class/html.formother.class.php index e5b3f8fbb6e..3d639d0dfcb 100644 --- a/htdocs/core/class/html.formother.class.php +++ b/htdocs/core/class/html.formother.class.php @@ -71,9 +71,11 @@ class FormOther public function select_export_model($selected = '', $htmlname = 'exportmodelid', $type = '', $useempty = 0, $fk_user = null) { // phpcs:enable - $sql = "SELECT rowid, label"; + global $conf; + + $sql = "SELECT rowid, label, fk_user"; $sql .= " FROM ".MAIN_DB_PREFIX."export_model"; - $sql .= " WHERE type = '".$type."'"; + $sql .= " WHERE type = '".$this->db->escape($type)."'"; if (!empty($fk_user)) $sql .= " AND fk_user IN (0, ".$fk_user.")"; // An export model $sql .= " ORDER BY rowid"; $result = $this->db->query($sql); @@ -99,6 +101,11 @@ class FormOther print ''; $i++; }