From fb8460858660e27dd8af11de4627824c8851f9a2 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 30 Mar 2021 03:37:54 +0200 Subject: [PATCH] Clean sql --- htdocs/accountancy/admin/productaccount.php | 10 +++--- htdocs/accountancy/customer/card.php | 2 +- htdocs/accountancy/customer/index.php | 2 +- htdocs/accountancy/expensereport/card.php | 2 +- htdocs/accountancy/expensereport/list.php | 2 +- htdocs/accountancy/supplier/card.php | 2 +- htdocs/accountancy/supplier/index.php | 2 +- htdocs/accountancy/supplier/list.php | 2 +- htdocs/admin/menus/index.php | 8 ++--- htdocs/admin/perms.php | 4 +-- htdocs/categories/class/categorie.class.php | 2 +- htdocs/comm/propal/class/propal.class.php | 32 ++++++++++--------- htdocs/commande/class/commande.class.php | 12 ++++--- .../deplacement/class/deplacement.class.php | 6 ++-- htdocs/compta/facture/class/facture.class.php | 2 +- .../cheque/class/remisecheque.class.php | 4 +-- .../class/bonprelevement.class.php | 2 +- .../class/paymentsocialcontribution.class.php | 2 +- htdocs/compta/tva/class/paymentvat.class.php | 2 +- htdocs/contact/class/contact.class.php | 2 +- htdocs/core/actions_massactions.inc.php | 2 +- htdocs/core/class/commonobject.class.php | 10 +++--- htdocs/core/class/discount.class.php | 8 ++--- .../modules/mailings/modules_mailings.php | 4 +-- htdocs/don/class/don.class.php | 2 +- .../class/expensereport.class.php | 6 ++-- .../class/paymentexpensereport.class.php | 2 +- htdocs/fichinter/class/fichinter.class.php | 6 ++-- .../class/fournisseur.commande.class.php | 4 +-- .../fourn/class/fournisseur.facture.class.php | 2 +- .../fourn/class/fournisseur.product.class.php | 26 +++++++-------- htdocs/install/repair.php | 6 ++-- htdocs/install/upgrade2.php | 2 +- htdocs/loan/class/paymentloan.class.php | 4 +-- htdocs/loan/payment/card.php | 4 +-- htdocs/product/admin/price_rules.php | 2 +- .../stock/class/mouvementstock.class.php | 4 +-- htdocs/projet/class/project.class.php | 4 +-- htdocs/projet/class/task.class.php | 12 +++---- .../class/recruitmentjobposition.class.php | 2 +- htdocs/salaries/class/paymentsalary.class.php | 2 +- htdocs/societe/card.php | 2 +- htdocs/societe/class/societe.class.php | 2 +- .../class/supplier_proposal.class.php | 20 ++++++------ htdocs/user/class/user.class.php | 14 ++++---- 45 files changed, 130 insertions(+), 124 deletions(-) diff --git a/htdocs/accountancy/admin/productaccount.php b/htdocs/accountancy/admin/productaccount.php index c1541bd2214..26de6e5ab16 100644 --- a/htdocs/accountancy/admin/productaccount.php +++ b/htdocs/accountancy/admin/productaccount.php @@ -189,13 +189,13 @@ if ($action == 'update') { $db->begin(); if (!empty($conf->global->MAIN_PRODUCT_PERENTITY_SHARED)) { - $sql = "INSERT INTO " . MAIN_DB_PREFIX . "product_perentity (fk_product, entity, " . $accountancy_field_name . ")"; - $sql .= " VALUES (" . ((int) $productid) . ", " . ((int) $conf->entity) . ", " . $accounting->account_number . ")"; - $sql .= " ON DUPLICATE KEY UPDATE " . $accountancy_field_name . " = " . $accounting->account_number; + $sql = "INSERT INTO ".MAIN_DB_PREFIX."product_perentity (fk_product, entity, '".$db->escape($accountancy_field_name)."')"; + $sql .= " VALUES (".((int) $productid).", ".((int) $conf->entity).", '".$db->escape($accounting->account_number)."')"; + $sql .= " ON DUPLICATE KEY UPDATE ".$accountancy_field_name." = '".$db->escape($accounting->account_number)."'"; } else { $sql = " UPDATE ".MAIN_DB_PREFIX."product"; - $sql .= " SET " . $accountancy_field_name . " = " . $accounting->account_number; - $sql .= " WHERE rowid = " . ((int) $productid); + $sql .= " SET ".$accountancy_field_name." = '".$db->escape($accounting->account_number)."'"; + $sql .= " WHERE rowid = ".((int) $productid); } dol_syslog("/accountancy/admin/productaccount.php sql=".$sql, LOG_DEBUG); diff --git a/htdocs/accountancy/customer/card.php b/htdocs/accountancy/customer/card.php index 099cecc4a71..88b199e76e3 100644 --- a/htdocs/accountancy/customer/card.php +++ b/htdocs/accountancy/customer/card.php @@ -61,7 +61,7 @@ if ($action == 'ventil' && $user->rights->accounting->bind->write) { } $sql = " UPDATE ".MAIN_DB_PREFIX."facturedet"; - $sql .= " SET fk_code_ventilation = ".$codeventil; + $sql .= " SET fk_code_ventilation = ".((int) $codeventil); $sql .= " WHERE rowid = ".((int) $id); $resql = $db->query($sql); diff --git a/htdocs/accountancy/customer/index.php b/htdocs/accountancy/customer/index.php index 88a32340daa..354652c653c 100644 --- a/htdocs/accountancy/customer/index.php +++ b/htdocs/accountancy/customer/index.php @@ -207,7 +207,7 @@ if ($action == 'validatehistory') { if ($objp->aarowid_suggest > 0) { $sqlupdate = "UPDATE ".MAIN_DB_PREFIX."facturedet"; - $sqlupdate .= " SET fk_code_ventilation = ".$objp->aarowid_suggest; + $sqlupdate .= " SET fk_code_ventilation = ".((int) $objp->aarowid_suggest); $sqlupdate .= " WHERE fk_code_ventilation <= 0 AND product_type <= 2 AND rowid = ".$objp->rowid; $resqlupdate = $db->query($sqlupdate); diff --git a/htdocs/accountancy/expensereport/card.php b/htdocs/accountancy/expensereport/card.php index 200a493cfed..db270b9d2db 100644 --- a/htdocs/accountancy/expensereport/card.php +++ b/htdocs/accountancy/expensereport/card.php @@ -64,7 +64,7 @@ if ($action == 'ventil' && $user->rights->accounting->bind->write) { } $sql = " UPDATE ".MAIN_DB_PREFIX."expensereport_det"; - $sql .= " SET fk_code_ventilation = ".$codeventil; + $sql .= " SET fk_code_ventilation = ".((int) $codeventil); $sql .= " WHERE rowid = ".((int) $id); $resql = $db->query($sql); diff --git a/htdocs/accountancy/expensereport/list.php b/htdocs/accountancy/expensereport/list.php index 84cd64bb44f..c7a1dec2d94 100644 --- a/htdocs/accountancy/expensereport/list.php +++ b/htdocs/accountancy/expensereport/list.php @@ -153,7 +153,7 @@ if ($massaction == 'ventil' && $user->rights->accounting->bind->write) { $ko++; } else { $sql = " UPDATE ".MAIN_DB_PREFIX."expensereport_det"; - $sql .= " SET fk_code_ventilation = ".$monCompte; + $sql .= " SET fk_code_ventilation = ".((int) $monCompte); $sql .= " WHERE rowid = ".$monId; $accountventilated = new AccountingAccount($db); diff --git a/htdocs/accountancy/supplier/card.php b/htdocs/accountancy/supplier/card.php index eee2059c660..cd17df33776 100644 --- a/htdocs/accountancy/supplier/card.php +++ b/htdocs/accountancy/supplier/card.php @@ -64,7 +64,7 @@ if ($action == 'ventil' && $user->rights->accounting->bind->write) { } $sql = " UPDATE ".MAIN_DB_PREFIX."facture_fourn_det"; - $sql .= " SET fk_code_ventilation = ".$codeventil; + $sql .= " SET fk_code_ventilation = ".((int) $codeventil); $sql .= " WHERE rowid = ".((int) $id); $resql = $db->query($sql); diff --git a/htdocs/accountancy/supplier/index.php b/htdocs/accountancy/supplier/index.php index 7ef09acf91a..fc295fdafa4 100644 --- a/htdocs/accountancy/supplier/index.php +++ b/htdocs/accountancy/supplier/index.php @@ -193,7 +193,7 @@ if ($action == 'validatehistory') { if ($objp->aarowid_suggest > 0) { $sqlupdate = "UPDATE ".MAIN_DB_PREFIX."facture_fourn_det"; - $sqlupdate .= " SET fk_code_ventilation = ".$objp->aarowid_suggest; + $sqlupdate .= " SET fk_code_ventilation = ".((int) $objp->aarowid_suggest); $sqlupdate .= " WHERE fk_code_ventilation <= 0 AND product_type <= 2 AND rowid = ".$objp->rowid; $resqlupdate = $db->query($sqlupdate); diff --git a/htdocs/accountancy/supplier/list.php b/htdocs/accountancy/supplier/list.php index 13ad707af96..c322ebef9a2 100644 --- a/htdocs/accountancy/supplier/list.php +++ b/htdocs/accountancy/supplier/list.php @@ -177,7 +177,7 @@ if ($massaction == 'ventil') { $ko++; } else { $sql = " UPDATE ".MAIN_DB_PREFIX."facture_fourn_det"; - $sql .= " SET fk_code_ventilation = ".$monCompte; + $sql .= " SET fk_code_ventilation = ".((int) $monCompte); $sql .= " WHERE rowid = ".$monId; $accountventilated = new AccountingAccount($db); diff --git a/htdocs/admin/menus/index.php b/htdocs/admin/menus/index.php index 197db4c4721..1db1adf50cf 100644 --- a/htdocs/admin/menus/index.php +++ b/htdocs/admin/menus/index.php @@ -111,13 +111,13 @@ if ($action == 'up') { } $sql = "UPDATE ".MAIN_DB_PREFIX."menu as m"; - $sql .= " SET m.position = ".$previous['order']; - $sql .= " WHERE m.rowid = ".$current['rowid']; // Up the selected entry + $sql .= " SET m.position = ".((int) $previous['order']); + $sql .= " WHERE m.rowid = ".((int) $current['rowid']); // Up the selected entry dol_syslog("admin/menus/index.php ".$sql); $db->query($sql); $sql = "UPDATE ".MAIN_DB_PREFIX."menu as m"; - $sql .= " SET m.position = ".($current['order'] != $previous['order'] ? $current['order'] : $current['order'] + 1); - $sql .= " WHERE m.rowid = ".$previous['rowid']; // Descend celui du dessus + $sql .= " SET m.position = ".((int) ($current['order'] != $previous['order'] ? $current['order'] : $current['order'] + 1)); + $sql .= " WHERE m.rowid = ".((int) $previous['rowid']); // Descend celui du dessus dol_syslog("admin/menus/index.php ".$sql); $db->query($sql); } elseif ($action == 'down') { diff --git a/htdocs/admin/perms.php b/htdocs/admin/perms.php index 31304c85819..f08a1497181 100644 --- a/htdocs/admin/perms.php +++ b/htdocs/admin/perms.php @@ -159,8 +159,8 @@ if ($result) { // TODO Define familyposition $family = (!empty($modules[$obj->module]->family_position) ? $modules[$obj->module]->family_position : ''); $familyposition = 0; - $sqlupdate = 'UPDATE '.MAIN_DB_PREFIX."rights_def SET module_position = ".$modules[$obj->module]->module_position.","; - $sqlupdate .= " family_position = ".$familyposition; + $sqlupdate = 'UPDATE '.MAIN_DB_PREFIX."rights_def SET module_position = ".((int) $modules[$obj->module]->module_position).","; + $sqlupdate .= " family_position = ".((int) $familyposition); $sqlupdate .= " WHERE module_position = 0 AND module = '".$db->escape($obj->module)."'"; $db->query($sqlupdate); } diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php index 94a1b89de8f..10cc15a2dc9 100644 --- a/htdocs/categories/class/categorie.class.php +++ b/htdocs/categories/class/categorie.class.php @@ -604,7 +604,7 @@ class Categorie extends CommonObject /* FIX #1317 : Check for child category and move up 1 level*/ if (!$error) { $sql = "UPDATE ".MAIN_DB_PREFIX."categorie"; - $sql .= " SET fk_parent = ".$this->fk_parent; + $sql .= " SET fk_parent = ".((int) $this->fk_parent); $sql .= " WHERE fk_parent = ".$this->id; if (!$this->db->query($sql)) { diff --git a/htdocs/comm/propal/class/propal.class.php b/htdocs/comm/propal/class/propal.class.php index 0460caf21f5..0388768fc1f 100644 --- a/htdocs/comm/propal/class/propal.class.php +++ b/htdocs/comm/propal/class/propal.class.php @@ -1232,7 +1232,7 @@ class Propal extends CommonObject /*if (! $error && $this->fk_delivery_address) { $sql = "UPDATE ".MAIN_DB_PREFIX."propal"; - $sql.= " SET fk_delivery_address = ".$this->fk_delivery_address; + $sql.= " SET fk_delivery_address = ".((int) $this->fk_delivery_address); $sql.= " WHERE ref = '".$this->db->escape($this->ref)."'"; $sql.= " AND entity = ".setEntity($this); @@ -2203,7 +2203,7 @@ class Propal extends CommonObject $this->db->begin(); $sql = "UPDATE ".MAIN_DB_PREFIX."propal "; - $sql .= " SET fk_input_reason = ".$id; + $sql .= " SET fk_input_reason = ".((int) $id); $sql .= " WHERE rowid = ".$this->id; dol_syslog(__METHOD__, LOG_DEBUG); @@ -2322,13 +2322,13 @@ class Propal extends CommonObject $remise = trim($remise) ?trim($remise) : 0; if (!empty($user->rights->propal->creer)) { - $remise = price2num($remise); + $remise = price2num($remise, 2); $error = 0; $this->db->begin(); - $sql = "UPDATE ".MAIN_DB_PREFIX."propal SET remise_percent = ".$remise; + $sql = "UPDATE ".MAIN_DB_PREFIX."propal SET remise_percent = ".((float) $remise); $sql .= " WHERE rowid = ".$this->id." AND fk_statut = ".self::STATUS_DRAFT; dol_syslog(__METHOD__, LOG_DEBUG); @@ -2380,17 +2380,18 @@ class Propal extends CommonObject public function set_remise_absolue($user, $remise, $notrigger = 0) { // phpcs:enable - $remise = trim($remise) ?trim($remise) : 0; + if (empty($remise)) { + $remise = 0; + } + $remise = price2num($remise); if (!empty($user->rights->propal->creer)) { - $remise = price2num($remise); - $error = 0; $this->db->begin(); - $sql = "UPDATE ".MAIN_DB_PREFIX."propal "; - $sql .= " SET remise_absolue = ".$remise; + $sql = "UPDATE ".MAIN_DB_PREFIX."propal"; + $sql .= " SET remise_absolue = ".((float) $remise); $sql .= " WHERE rowid = ".$this->id." AND fk_statut = ".self::STATUS_DRAFT; dol_syslog(__METHOD__, LOG_DEBUG); @@ -2435,19 +2436,17 @@ class Propal extends CommonObject * Reopen the commercial proposal * * @param User $user Object user that close - * @param int $statut Statut + * @param int $status Status * @param string $note Comment * @param int $notrigger 1=Does not execute triggers, 0= execute triggers * @return int <0 if KO, >0 if OK */ - public function reopen($user, $statut, $note = '', $notrigger = 0) + public function reopen($user, $status, $note = '', $notrigger = 0) { - - $this->statut = $statut; $error = 0; $sql = "UPDATE ".MAIN_DB_PREFIX."propal"; - $sql .= " SET fk_statut = ".$this->statut.","; + $sql .= " SET fk_statut = ".$status.","; if (!empty($note)) { $sql .= " note_private = '".$this->db->escape($note)."',"; } @@ -2484,6 +2483,9 @@ class Propal extends CommonObject $this->db->rollback(); return -1 * $error; } else { + $this->statut = $status; + $this->status = $status; + $this->db->commit(); return 1; } @@ -2511,7 +2513,7 @@ class Propal extends CommonObject $newprivatenote = dol_concatdesc($this->note_private, $note); $sql = "UPDATE ".MAIN_DB_PREFIX."propal"; - $sql .= " SET fk_statut = ".$status.", note_private = '".$this->db->escape($newprivatenote)."', date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id; + $sql .= " SET fk_statut = ".((int) $status).", note_private = '".$this->db->escape($newprivatenote)."', date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id; $sql .= " WHERE rowid = ".$this->id; $resql = $this->db->query($sql); diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php index d6a63f83f27..2f2f0a4d81c 100644 --- a/htdocs/commande/class/commande.class.php +++ b/htdocs/commande/class/commande.class.php @@ -2468,18 +2468,20 @@ class Commande extends CommonOrder public function set_remise_absolue($user, $remise, $notrigger = 0) { // phpcs:enable - $remise = trim($remise) ?trim($remise) : 0; + if (empty($remise)) { + $remise = 0; + } + + $remise = price2num($remise); if ($user->rights->commande->creer) { $error = 0; $this->db->begin(); - $remise = price2num($remise); - $sql = 'UPDATE '.MAIN_DB_PREFIX.'commande'; - $sql .= ' SET remise_absolue = '.$remise; - $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut = '.self::STATUS_DRAFT.' ;'; + $sql .= ' SET remise_absolue = '.((float) $remise); + $sql .= ' WHERE rowid = '.$this->id.' AND fk_statut = '.self::STATUS_DRAFT; dol_syslog(__METHOD__, LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/compta/deplacement/class/deplacement.class.php b/htdocs/compta/deplacement/class/deplacement.class.php index c34d89bfa2f..5562f797130 100644 --- a/htdocs/compta/deplacement/class/deplacement.class.php +++ b/htdocs/compta/deplacement/class/deplacement.class.php @@ -239,12 +239,12 @@ class Deplacement extends CommonObject $this->db->begin(); $sql = "UPDATE ".MAIN_DB_PREFIX."deplacement "; - $sql .= " SET km = ".$this->km; // This is a distance or amount + $sql .= " SET km = ".((float) $this->km); // This is a distance or amount $sql .= " , dated = '".$this->db->idate($this->date)."'"; $sql .= " , type = '".$this->db->escape($this->type)."'"; $sql .= " , fk_statut = '".$this->db->escape($this->statut)."'"; - $sql .= " , fk_user = ".$this->fk_user; - $sql .= " , fk_user_modif = ".$user->id; + $sql .= " , fk_user = ".((int) $this->fk_user); + $sql .= " , fk_user_modif = ".((int) $user->id); $sql .= " , fk_soc = ".($this->socid > 0 ? $this->socid : 'null'); $sql .= " , note_private = ".($this->note_private ? "'".$this->db->escape($this->note_private)."'" : "null"); $sql .= " , note_public = ".($this->note_public ? "'".$this->db->escape($this->note_public)."'" : "null"); diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php index 960ff8f413f..111ace7c415 100644 --- a/htdocs/compta/facture/class/facture.class.php +++ b/htdocs/compta/facture/class/facture.class.php @@ -3804,7 +3804,7 @@ class Facture extends CommonInvoice $remise = price2num($remise); $sql = 'UPDATE '.MAIN_DB_PREFIX.'facture'; - $sql .= ' SET remise_absolue = '.$remise; + $sql .= ' SET remise_absolue = '.((float) $remise); $sql .= ' WHERE rowid = '.$this->id; $sql .= ' AND fk_statut = '.self::STATUS_DRAFT; diff --git a/htdocs/compta/paiement/cheque/class/remisecheque.class.php b/htdocs/compta/paiement/cheque/class/remisecheque.class.php index 8af9d5a6543..71e8ab10b38 100644 --- a/htdocs/compta/paiement/cheque/class/remisecheque.class.php +++ b/htdocs/compta/paiement/cheque/class/remisecheque.class.php @@ -236,8 +236,8 @@ class RemiseCheque extends CommonObject if ($checkremise) { $sql = "UPDATE ".MAIN_DB_PREFIX."bank"; - $sql .= " SET fk_bordereau = ".$this->id; - $sql .= " WHERE rowid = ".$lineid; + $sql .= " SET fk_bordereau = ".((int) $this->id); + $sql .= " WHERE rowid = ".((int) $lineid); $resql = $this->db->query($sql); if (!$resql) { diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php index 3d04cf1f6a5..3ea11463415 100644 --- a/htdocs/compta/prelevement/class/bonprelevement.class.php +++ b/htdocs/compta/prelevement/class/bonprelevement.class.php @@ -579,7 +579,7 @@ class BonPrelevement extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX."prelevement_bons "; $sql .= " SET fk_user_trans = ".$user->id; $sql .= " , date_trans = '".$this->db->idate($date)."'"; - $sql .= " , method_trans = ".$method; + $sql .= " , method_trans = ".((int) $method); $sql .= " , statut = ".self::STATUS_TRANSFERED; $sql .= " WHERE rowid = ".$this->id; $sql .= " AND entity = ".$conf->entity; diff --git a/htdocs/compta/sociales/class/paymentsocialcontribution.class.php b/htdocs/compta/sociales/class/paymentsocialcontribution.class.php index 8f7f13e6043..3207e533521 100644 --- a/htdocs/compta/sociales/class/paymentsocialcontribution.class.php +++ b/htdocs/compta/sociales/class/paymentsocialcontribution.class.php @@ -636,7 +636,7 @@ class PaymentSocialContribution extends CommonObject public function update_fk_bank($id_bank) { // phpcs:enable - $sql = "UPDATE ".MAIN_DB_PREFIX."paiementcharge SET fk_bank = ".$id_bank." WHERE rowid = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."paiementcharge SET fk_bank = ".((int) $id_bank)." WHERE rowid = ".$this->id; dol_syslog(get_class($this)."::update_fk_bank", LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/compta/tva/class/paymentvat.class.php b/htdocs/compta/tva/class/paymentvat.class.php index 9ba1bd2ed1d..f8a397bdb9a 100644 --- a/htdocs/compta/tva/class/paymentvat.class.php +++ b/htdocs/compta/tva/class/paymentvat.class.php @@ -620,7 +620,7 @@ class PaymentVAT extends CommonObject public function update_fk_bank($id_bank) { // phpcs:enable - $sql = "UPDATE ".MAIN_DB_PREFIX."payment_vat SET fk_bank = ".$id_bank." WHERE rowid = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."payment_vat SET fk_bank = ".((int) $id_bank)." WHERE rowid = ".$this->id; dol_syslog(get_class($this)."::update_fk_bank", LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php index 5e0c65e1b70..6305a01c999 100644 --- a/htdocs/contact/class/contact.class.php +++ b/htdocs/contact/class/contact.class.php @@ -1651,7 +1651,7 @@ class Contact extends CommonObject // Desactive utilisateur $sql = "UPDATE ".MAIN_DB_PREFIX."socpeople"; - $sql .= " SET statut = ".$this->statut; + $sql .= " SET statut = ".((int) $this->statut); $sql .= " WHERE rowid = ".$this->id; $result = $this->db->query($sql); diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php index 057443d09b4..13cb7126769 100644 --- a/htdocs/core/actions_massactions.inc.php +++ b/htdocs/core/actions_massactions.inc.php @@ -1321,7 +1321,7 @@ if (!$error && ($massaction == 'delete' || ($action == 'delete' && $confirm == ' } if ($objectclass == "Task" && $objecttmp->hasChildren() > 0) { - $sql = "UPDATE ".MAIN_DB_PREFIX."projet_task SET fk_task_parent = 0 WHERE fk_task_parent = ".$objecttmp->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."projet_task SET fk_task_parent = 0 WHERE fk_task_parent = ".((int) $objecttmp->id); $res = $db->query($sql); if (!$res) { diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php index 622682060cb..9406c1e3ae5 100644 --- a/htdocs/core/class/commonobject.class.php +++ b/htdocs/core/class/commonobject.class.php @@ -2649,7 +2649,7 @@ abstract class CommonObject $fieldname = 'fk_address'; } - $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ".$fieldname." = ".$id; + $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ".$fieldname." = ".((int) $id); $sql .= " WHERE rowid = ".$this->id." AND fk_statut = 0"; if ($this->db->query($sql)) { @@ -2695,7 +2695,7 @@ abstract class CommonObject dol_syslog(get_class($this).'::setShippingMethod('.$shipping_method_id.')'); $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element; - $sql .= " SET fk_shipping_method = ".$shipping_method_id; + $sql .= " SET fk_shipping_method = ".((int) $shipping_method_id); $sql .= " WHERE rowid=".((int) $this->id); $resql = $this->db->query($sql); if (!$resql) { @@ -2742,7 +2742,7 @@ abstract class CommonObject dol_syslog(get_class($this).'::setWarehouse('.$warehouse_id.')'); $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element; - $sql .= " SET fk_warehouse = ".$warehouse_id; + $sql .= " SET fk_warehouse = ".((int) $warehouse_id); $sql .= " WHERE rowid=".((int) $this->id); if ($this->db->query($sql)) { @@ -2819,7 +2819,7 @@ abstract class CommonObject dol_syslog(get_class($this).'::setBankAccount('.$fk_account.')'); $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element; - $sql .= " SET fk_account = ".$fk_account; + $sql .= " SET fk_account = ".((int) $fk_account); $sql .= " WHERE rowid=".((int) $this->id); $resql = $this->db->query($sql); @@ -8411,7 +8411,7 @@ abstract class CommonObject // If we have a field ref with a default value of (PROV) if (!$error) { if (key_exists('ref', $this->fields) && $this->fields['ref']['notnull'] > 0 && !is_null($this->fields['ref']['default']) && $this->fields['ref']['default'] == '(PROV)') { - $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ref = '(PROV".$this->id.")' WHERE (ref = '(PROV)' OR ref = '') AND rowid = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ref = '(PROV".$this->id.")' WHERE (ref = '(PROV)' OR ref = '') AND rowid = ".((int) $this->id); $resqlupdate = $this->db->query($sql); if ($resqlupdate === false) { diff --git a/htdocs/core/class/discount.class.php b/htdocs/core/class/discount.class.php index 4afcf295d40..a1c2b1fbf8c 100644 --- a/htdocs/core/class/discount.class.php +++ b/htdocs/core/class/discount.class.php @@ -421,17 +421,17 @@ class DiscountAbsolute $sql = "UPDATE ".MAIN_DB_PREFIX."societe_remise_except"; if (!empty($this->discount_type)) { if ($rowidline) { - $sql .= " SET fk_invoice_supplier_line = ".$rowidline; + $sql .= " SET fk_invoice_supplier_line = ".((int) $rowidline); } if ($rowidinvoice) { - $sql .= " SET fk_invoice_supplier = ".$rowidinvoice; + $sql .= " SET fk_invoice_supplier = ".((int) $rowidinvoice); } } else { if ($rowidline) { - $sql .= " SET fk_facture_line = ".$rowidline; + $sql .= " SET fk_facture_line = ".((int) $rowidline); } if ($rowidinvoice) { - $sql .= " SET fk_facture = ".$rowidinvoice; + $sql .= " SET fk_facture = ".((int) $rowidinvoice); } } $sql .= " WHERE rowid = ".$this->id; diff --git a/htdocs/core/modules/mailings/modules_mailings.php b/htdocs/core/modules/mailings/modules_mailings.php index cb7eb93b074..96dc6de934f 100644 --- a/htdocs/core/modules/mailings/modules_mailings.php +++ b/htdocs/core/modules/mailings/modules_mailings.php @@ -132,14 +132,14 @@ class MailingTargets // This can't be abstract as it is used for some method // phpcs:enable // Mise a jour nombre de destinataire dans table des mailings $sql = "SELECT COUNT(*) nb FROM ".MAIN_DB_PREFIX."mailing_cibles"; - $sql .= " WHERE fk_mailing = ".$mailing_id; + $sql .= " WHERE fk_mailing = ".((int) $mailing_id); $result = $this->db->query($sql); if ($result) { $obj = $this->db->fetch_object($result); $nb = $obj->nb; $sql = "UPDATE ".MAIN_DB_PREFIX."mailing"; - $sql .= " SET nbemail = ".$nb." WHERE rowid = ".$mailing_id; + $sql .= " SET nbemail = ".$nb." WHERE rowid = ".((int) $mailing_id); if (!$this->db->query($sql)) { dol_syslog($this->db->error()); $this->error = $this->db->error(); diff --git a/htdocs/don/class/don.class.php b/htdocs/don/class/don.class.php index a5fb676e314..257eb309f25 100644 --- a/htdocs/don/class/don.class.php +++ b/htdocs/don/class/don.class.php @@ -702,7 +702,7 @@ class Don extends CommonObject $this->db->begin(); - $sql = "UPDATE ".MAIN_DB_PREFIX."don SET fk_statut = 1, fk_user_valid = ".$userid." WHERE rowid = ".$id." AND fk_statut = 0"; + $sql = "UPDATE ".MAIN_DB_PREFIX."don SET fk_statut = 1, fk_user_valid = ".((int) $userid)." WHERE rowid = ".((int) $id)." AND fk_statut = 0"; $resql = $this->db->query($sql); if ($resql) { diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php index 5ed3e777653..681675fd54c 100644 --- a/htdocs/expensereport/class/expensereport.class.php +++ b/htdocs/expensereport/class/expensereport.class.php @@ -1384,7 +1384,7 @@ class ExpenseReport extends CommonObject $this->db->begin(); $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element; - $sql .= " SET ref = '".$this->db->escape($this->ref)."', fk_statut = ".self::STATUS_APPROVED.", fk_user_approve = ".$fuser->id.","; + $sql .= " SET ref = '".$this->db->escape($this->ref)."', fk_statut = ".self::STATUS_APPROVED.", fk_user_approve = ".((int) $fuser->id).","; $sql .= " date_approve='".$this->db->idate($this->date_approve)."'"; $sql .= ' WHERE rowid = '.$this->id; if ($this->db->query($sql)) { @@ -1434,7 +1434,7 @@ class ExpenseReport extends CommonObject // date de refus if ($this->status != self::STATUS_REFUSED) { $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element; - $sql .= " SET ref = '".$this->db->escape($this->ref)."', fk_statut = ".self::STATUS_REFUSED.", fk_user_refuse = ".$fuser->id.","; + $sql .= " SET ref = '".$this->db->escape($this->ref)."', fk_statut = ".self::STATUS_REFUSED.", fk_user_refuse = ".((int) $fuser->id).","; $sql .= " date_refuse='".$this->db->idate($now)."',"; $sql .= " detail_refuse='".$this->db->escape($details)."',"; $sql .= " fk_user_approve = NULL"; @@ -1558,7 +1558,7 @@ class ExpenseReport extends CommonObject $this->db->begin(); $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element; - $sql .= " SET fk_statut = ".self::STATUS_CANCELED.", fk_user_cancel = ".$fuser->id; + $sql .= " SET fk_statut = ".self::STATUS_CANCELED.", fk_user_cancel = ".((int) $fuser->id); $sql .= ", date_cancel='".$this->db->idate($this->date_cancel)."'"; $sql .= " ,detail_cancel='".$this->db->escape($detail)."'"; $sql .= ' WHERE rowid = '.$this->id; diff --git a/htdocs/expensereport/class/paymentexpensereport.class.php b/htdocs/expensereport/class/paymentexpensereport.class.php index c9cf0cdaf41..c673316d491 100644 --- a/htdocs/expensereport/class/paymentexpensereport.class.php +++ b/htdocs/expensereport/class/paymentexpensereport.class.php @@ -607,7 +607,7 @@ class PaymentExpenseReport extends CommonObject public function update_fk_bank($id_bank) { // phpcs:enable - $sql = "UPDATE ".MAIN_DB_PREFIX."payment_expensereport SET fk_bank = ".$id_bank." WHERE rowid = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."payment_expensereport SET fk_bank = ".((int) $id_bank)." WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::update_fk_bank", LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/fichinter/class/fichinter.class.php b/htdocs/fichinter/class/fichinter.class.php index d23b27278a1..1fef1ed7c03 100644 --- a/htdocs/fichinter/class/fichinter.class.php +++ b/htdocs/fichinter/class/fichinter.class.php @@ -1622,7 +1622,7 @@ class FichinterLigne extends CommonObjectLine $sql = "SELECT SUM(duree) as total_duration, min(date) as dateo, max(date) as datee "; $sql .= " FROM ".MAIN_DB_PREFIX."fichinterdet"; - $sql .= " WHERE fk_fichinter=".$this->fk_fichinter; + $sql .= " WHERE fk_fichinter=".((int) $this->fk_fichinter); dol_syslog("FichinterLigne::update_total", LOG_DEBUG); $resql = $this->db->query($sql); @@ -1634,10 +1634,10 @@ class FichinterLigne extends CommonObjectLine } $sql = "UPDATE ".MAIN_DB_PREFIX."fichinter"; - $sql .= " SET duree = ".$total_duration; + $sql .= " SET duree = ".((int) $total_duration); $sql .= " , dateo = ".(!empty($obj->dateo) ? "'".$this->db->idate($obj->dateo)."'" : "null"); $sql .= " , datee = ".(!empty($obj->datee) ? "'".$this->db->idate($obj->datee)."'" : "null"); - $sql .= " WHERE rowid = ".$this->fk_fichinter; + $sql .= " WHERE rowid = ".((int) $this->fk_fichinter); dol_syslog("FichinterLigne::update_total", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php index fad9f001100..0dfb4047b4f 100644 --- a/htdocs/fourn/class/fournisseur.commande.class.php +++ b/htdocs/fourn/class/fournisseur.commande.class.php @@ -1157,7 +1157,7 @@ class CommandeFournisseur extends CommonOrder $this->db->begin(); - $sql = "UPDATE ".MAIN_DB_PREFIX."commande_fournisseur SET fk_statut = ".$statut; + $sql = "UPDATE ".MAIN_DB_PREFIX."commande_fournisseur SET fk_statut = ".((int) $statut); $sql .= " WHERE rowid = ".$this->id; dol_syslog(get_class($this)."::cancel", LOG_DEBUG); if ($this->db->query($sql)) { @@ -2306,7 +2306,7 @@ class CommandeFournisseur extends CommonOrder $this->db->begin(); $sql = "UPDATE ".MAIN_DB_PREFIX."commande_fournisseur"; - $sql .= " SET fk_statut = ".$statut; + $sql .= " SET fk_statut = ".((int) $statut); $sql .= " WHERE rowid = ".$this->id; $sql .= " AND fk_statut IN (".self::STATUS_ORDERSENT.",".self::STATUS_RECEIVED_PARTIALLY.")"; // Process running or Partially received diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php index 55988f51169..73e8be88c37 100644 --- a/htdocs/fourn/class/fournisseur.facture.class.php +++ b/htdocs/fourn/class/fournisseur.facture.class.php @@ -1465,7 +1465,7 @@ class FactureFournisseur extends CommonInvoice $this->newref = dol_sanitizeFileName($num); $sql = "UPDATE ".MAIN_DB_PREFIX."facture_fourn"; - $sql .= " SET ref='".$num."', fk_statut = 1, fk_user_valid = ".$user->id.", date_valid = '".$this->db->idate($now)."'"; + $sql .= " SET ref='".$this->db->escape($num)."', fk_statut = 1, fk_user_valid = ".((int) $user->id).", date_valid = '".$this->db->idate($now)."'"; $sql .= " WHERE rowid = ".$this->id; dol_syslog(get_class($this)."::validate", LOG_DEBUG); diff --git a/htdocs/fourn/class/fournisseur.product.class.php b/htdocs/fourn/class/fournisseur.product.class.php index 708e3e621e4..0fa34c28d81 100644 --- a/htdocs/fourn/class/fournisseur.product.class.php +++ b/htdocs/fourn/class/fournisseur.product.class.php @@ -372,15 +372,15 @@ class ProductFournisseur extends Product } } $sql = "UPDATE ".MAIN_DB_PREFIX."product_fournisseur_price"; - $sql .= " SET fk_user = ".$user->id." ,"; + $sql .= " SET fk_user = ".((int) $user->id)." ,"; $sql .= " ref_fourn = '".$this->db->escape($ref_fourn)."',"; $sql .= " desc_fourn = '".$this->db->escape($desc_fourn)."',"; - $sql .= " price = ".$buyprice.","; - $sql .= " quantity = ".$qty.","; - $sql .= " remise_percent = ".$remise_percent.","; - $sql .= " remise = ".$remise.","; - $sql .= " unitprice = ".$unitBuyPrice.","; - $sql .= " fk_availability = ".$availability.","; + $sql .= " price = ".((float) $buyprice).","; + $sql .= " quantity = ".((float) $qty).","; + $sql .= " remise_percent = ".((float) $remise_percent).","; + $sql .= " remise = ".((float) $remise).","; + $sql .= " unitprice = ".((float) $unitBuyPrice).","; + $sql .= " fk_availability = ".((int) $availability).","; $sql .= " multicurrency_price = ".(isset($multicurrency_buyprice) ? "'".$this->db->escape(price2num($multicurrency_buyprice))."'" : 'null').","; $sql .= " multicurrency_unitprice = ".(isset($multicurrency_unitBuyPrice) ? "'".$this->db->escape(price2num($multicurrency_unitBuyPrice))."'" : 'null').","; $sql .= " multicurrency_tx = ".(isset($multicurrency_tx) ? "'".$this->db->escape($multicurrency_tx)."'" : '1').","; @@ -394,16 +394,16 @@ class ProductFournisseur extends Product //$sql.= " localtax1_type=".($localtaxtype1!=''?"'".$this->db->escape($localtaxtype1)."'":"'0'").","; //$sql.= " localtax2_type=".($localtaxtype2!=''?"'".$this->db->escape($localtaxtype2)."'":"'0'").","; $sql .= " default_vat_code=".($newdefaultvatcode ? "'".$this->db->escape($newdefaultvatcode)."'" : "null").","; - $sql .= " info_bits = ".$newnpr.","; - $sql .= " charges = ".$charges.","; // deprecated - $sql .= " delivery_time_days = ".($delivery_time_days != '' ? $delivery_time_days : 'null').","; + $sql .= " info_bits = ".((int) $newnpr).","; + $sql .= " charges = ".((float) $charges).","; // deprecated + $sql .= " delivery_time_days = ".($delivery_time_days != '' ? ((int) $delivery_time_days) : 'null').","; $sql .= " supplier_reputation = ".(empty($supplier_reputation) ? 'NULL' : "'".$this->db->escape($supplier_reputation)."'").","; $sql .= " barcode = ".(empty($barcode) ? 'NULL' : "'".$this->db->escape($barcode)."'").","; $sql .= " fk_barcode_type = ".(empty($fk_barcode_type) ? 'NULL' : "'".$this->db->escape($fk_barcode_type)."'"); if (!empty($conf->global->PRODUCT_USE_SUPPLIER_PACKAGING)) { $sql .= ", packaging = ".(empty($packaging) ? 1 : $packaging); } - $sql .= " WHERE rowid = ".$this->product_fourn_price_id; + $sql .= " WHERE rowid = ".((int) $this->product_fourn_price_id); // TODO Add price_base_type and price_ttc dol_syslog(get_class($this).'::update_buyprice update knowing id of line = product_fourn_price_id = '.$this->product_fourn_price_id, LOG_DEBUG); @@ -885,8 +885,8 @@ class ProductFournisseur extends Product $expression_id = $expression_id != 0 ? $expression_id : 'NULL'; $sql = "UPDATE ".MAIN_DB_PREFIX."product_fournisseur_price"; - $sql .= " SET fk_supplier_price_expression = ".$expression_id; - $sql .= " WHERE rowid = ".$this->product_fourn_price_id; + $sql .= " SET fk_supplier_price_expression = ".((int) $expression_id); + $sql .= " WHERE rowid = ".((int) $this->product_fourn_price_id); dol_syslog(get_class($this)."::setSupplierPriceExpression", LOG_DEBUG); diff --git a/htdocs/install/repair.php b/htdocs/install/repair.php index 1d695f40249..9357128d050 100644 --- a/htdocs/install/repair.php +++ b/htdocs/install/repair.php @@ -933,14 +933,14 @@ if ($ok && GETPOST('clean_product_stock_batch', 'alpha')) { } if ($methodtofix == 'updatestock') { // Method 2 - print ' -> Update qty of product_stock with qty = '.($obj->reelbatch ? $obj->reelbatch : '0').' for ps.rowid = '.$obj->psrowid; + print ' -> Update qty of product_stock with qty = '.($obj->reelbatch ? ((float) $obj->reelbatch) : '0').' for ps.rowid = '.((int) $obj->psrowid); if (GETPOST('clean_product_stock_batch') == 'confirmed') { $error = 0; $db->begin(); $sql2 = "UPDATE ".MAIN_DB_PREFIX."product_stock"; - $sql2 .= " SET reel = ".($obj->reelbatch ? $obj->reelbatch : '0')." WHERE rowid = ".$obj->psrowid; + $sql2 .= " SET reel = ".($obj->reelbatch ? ((float) $obj->reelbatch) : '0')." WHERE rowid = ".((int) $obj->psrowid); $resql2 = $db->query($sql2); if ($resql2) { // We update product_stock, so we must fill p.stock into product too. @@ -1027,7 +1027,7 @@ if ($ok && GETPOST('set_empty_time_spent_amount', 'alpha')) { if (GETPOST('set_empty_time_spent_amount') == 'confirmed') { $sql2 = "UPDATE ".MAIN_DB_PREFIX."projet_task_time"; - $sql2 .= " SET thm = ".$obj->user_thm." WHERE thm IS NULL AND fk_user = ".$obj->user_id; + $sql2 .= " SET thm = ".$obj->user_thm." WHERE thm IS NULL AND fk_user = ".((int) $obj->user_id); $resql2 = $db->query($sql2); if (!$resql2) { $error++; diff --git a/htdocs/install/upgrade2.php b/htdocs/install/upgrade2.php index d613e4a18b0..ec322733c7d 100644 --- a/htdocs/install/upgrade2.php +++ b/htdocs/install/upgrade2.php @@ -678,7 +678,7 @@ function migrate_paiements($db, $langs, $conf) $res += $db->query($sql); - $sql = "UPDATE ".MAIN_DB_PREFIX."paiement SET fk_facture = 0 WHERE rowid = ".$row[$i][0]; + $sql = "UPDATE ".MAIN_DB_PREFIX."paiement SET fk_facture = 0 WHERE rowid = ".((int) $row[$i][0]); $res += $db->query($sql); diff --git a/htdocs/loan/class/paymentloan.class.php b/htdocs/loan/class/paymentloan.class.php index c7f1940943b..cf0a8e87f63 100644 --- a/htdocs/loan/class/paymentloan.class.php +++ b/htdocs/loan/class/paymentloan.class.php @@ -594,12 +594,12 @@ class PaymentLoan extends CommonObject public function update_fk_bank($id_bank) { // phpcs:enable - $sql = "UPDATE ".MAIN_DB_PREFIX."payment_loan SET fk_bank = ".$id_bank." WHERE rowid = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."payment_loan SET fk_bank = ".((int) $id_bank)." WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::update_fk_bank", LOG_DEBUG); $result = $this->db->query($sql); if ($result) { - $this->fk_bank = $id_bank; + $this->fk_bank = ((int) $id_bank); return 1; } else { $this->error = $this->db->error(); diff --git a/htdocs/loan/payment/card.php b/htdocs/loan/payment/card.php index cf4466bb0da..675401e34f9 100644 --- a/htdocs/loan/payment/card.php +++ b/htdocs/loan/payment/card.php @@ -58,7 +58,7 @@ if ($id > 0) { if ($action == 'confirm_delete' && $confirm == 'yes' && $user->rights->loan->delete) { $db->begin(); - $sql = "UPDATE ".MAIN_DB_PREFIX."loan_schedule SET fk_bank = 0 WHERE fk_bank = ".$payment->fk_bank; + $sql = "UPDATE ".MAIN_DB_PREFIX."loan_schedule SET fk_bank = 0 WHERE fk_bank = ".((int) $payment->fk_bank); $db->query($sql); $fk_loan = $payment->fk_loan; @@ -66,7 +66,7 @@ if ($action == 'confirm_delete' && $confirm == 'yes' && $user->rights->loan->del $result = $payment->delete($user); if ($result > 0) { $db->commit(); - header("Location: ".DOL_URL_ROOT."/loan/card.php?id=".$fk_loan); + header("Location: ".DOL_URL_ROOT."/loan/card.php?id=".urlencode($fk_loan)); exit; } else { setEventMessages($payment->error, $payment->errors, 'errors'); diff --git a/htdocs/product/admin/price_rules.php b/htdocs/product/admin/price_rules.php index fada766f065..2166ada6138 100644 --- a/htdocs/product/admin/price_rules.php +++ b/htdocs/product/admin/price_rules.php @@ -86,7 +86,7 @@ if ($action == 'update') { if (!$db->query($sql)) { //If we could not create, then we try updating $sql = "UPDATE ".MAIN_DB_PREFIX."product_pricerules"; - $sql .= " SET fk_level = ".$db->escape($i_fk_level).", var_percent = ".$i_var_percent.", var_min_percent = ".$i_var_min_percent." WHERE level = ".$i; + $sql .= " SET fk_level = ".$db->escape($i_fk_level).", var_percent = ".$i_var_percent.", var_min_percent = ".$i_var_min_percent." WHERE level = ".((int) $i); if (!$db->query($sql)) { setEventMessages($langs->trans('ErrorSavingChanges'), null, 'errors'); diff --git a/htdocs/product/stock/class/mouvementstock.class.php b/htdocs/product/stock/class/mouvementstock.class.php index 8b2d729c29c..102e3ba1700 100644 --- a/htdocs/product/stock/class/mouvementstock.class.php +++ b/htdocs/product/stock/class/mouvementstock.class.php @@ -604,9 +604,9 @@ class MouvementStock extends CommonObject // $sql = "UPDATE ".MAIN_DB_PREFIX."product SET pmp = ".$newpmp.", stock = ".$this->db->ifsql("stock IS NULL", 0, "stock") . " + ".$qty; // $sql.= " WHERE rowid = ".$fk_product; // Update pmp + denormalized fields because we change content of produt_stock. Warning: Do not use "SET p.stock", does not works with pgsql - $sql = "UPDATE ".MAIN_DB_PREFIX."product as p SET pmp = ".$newpmp.","; + $sql = "UPDATE ".MAIN_DB_PREFIX."product as p SET pmp = ".((float) $newpmp).","; $sql .= " stock=(SELECT SUM(ps.reel) FROM ".MAIN_DB_PREFIX."product_stock as ps WHERE ps.fk_product = p.rowid)"; - $sql .= " WHERE rowid = ".$fk_product; + $sql .= " WHERE rowid = ".((int) $fk_product); dol_syslog(get_class($this)."::_create update AWP", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php index 8bf9c727f4e..792d2fd00de 100644 --- a/htdocs/projet/class/project.class.php +++ b/htdocs/projet/class/project.class.php @@ -771,7 +771,7 @@ class Project extends CommonObject 'actioncomm'=>'fk_project', 'mrp_mo'=>'fk_project' ); foreach ($listoftables as $key => $value) { - $sql = "UPDATE ".MAIN_DB_PREFIX.$key." SET ".$value." = NULL where ".$value." = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX.$key." SET ".$value." = NULL where ".$value." = ".((int) $this->id); $resql = $this->db->query($sql); if (!$resql) { $this->errors[] = $this->db->lasterror(); @@ -1033,7 +1033,7 @@ class Project extends CommonObject $this->db->begin(); $sql = "UPDATE ".MAIN_DB_PREFIX."projet"; - $sql .= " SET fk_statut = ".self::STATUS_CLOSED.", fk_user_close = ".$user->id.", date_close = '".$this->db->idate($now)."'"; + $sql .= " SET fk_statut = ".self::STATUS_CLOSED.", fk_user_close = ".((int) $user->id).", date_close = '".$this->db->idate($now)."'"; $sql .= " WHERE rowid = ".$this->id; $sql .= " AND fk_statut = ".self::STATUS_VALIDATED; diff --git a/htdocs/projet/class/task.class.php b/htdocs/projet/class/task.class.php index 091409539a8..7916f79fdeb 100644 --- a/htdocs/projet/class/task.class.php +++ b/htdocs/projet/class/task.class.php @@ -1197,11 +1197,11 @@ class Task extends CommonObject if ($ret > 0) { // Recalculate amount of time spent for task and update denormalized field $sql = "UPDATE ".MAIN_DB_PREFIX."projet_task"; - $sql .= " SET duration_effective = (SELECT SUM(task_duration) FROM ".MAIN_DB_PREFIX."projet_task_time as ptt where ptt.fk_task = ".$this->id.")"; + $sql .= " SET duration_effective = (SELECT SUM(task_duration) FROM ".MAIN_DB_PREFIX."projet_task_time as ptt where ptt.fk_task = ".((int) $this->id).")"; if (isset($this->progress)) { - $sql .= ", progress = ".$this->progress; // Do not overwrite value if not provided + $sql .= ", progress = ".((float) $this->progress); // Do not overwrite value if not provided } - $sql .= " WHERE rowid = ".$this->id; + $sql .= " WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::addTimeSpent", LOG_DEBUG); if (!$this->db->query($sql)) { @@ -1210,8 +1210,8 @@ class Task extends CommonObject } $sql = "UPDATE ".MAIN_DB_PREFIX."projet_task_time"; - $sql .= " SET thm = (SELECT thm FROM ".MAIN_DB_PREFIX."user WHERE rowid = ".$this->timespent_fk_user.")"; // set average hour rate of user - $sql .= " WHERE rowid = ".$tasktime_id; + $sql .= " SET thm = (SELECT thm FROM ".MAIN_DB_PREFIX."user WHERE rowid = ".((int) $this->timespent_fk_user).")"; // set average hour rate of user + $sql .= " WHERE rowid = ".((int) $tasktime_id); dol_syslog(get_class($this)."::addTimeSpent", LOG_DEBUG); if (!$this->db->query($sql)) { @@ -1552,7 +1552,7 @@ class Task extends CommonObject $newDuration = $this->timespent_duration - $this->timespent_old_duration; $sql = "UPDATE ".MAIN_DB_PREFIX."projet_task"; - $sql .= " SET duration_effective = (SELECT SUM(task_duration) FROM ".MAIN_DB_PREFIX."projet_task_time as ptt where ptt.fk_task = ".$this->db->escape($this->id).")"; + $sql .= " SET duration_effective = (SELECT SUM(task_duration) FROM ".MAIN_DB_PREFIX."projet_task_time as ptt where ptt.fk_task = ".((int) $this->id).")"; $sql .= " WHERE rowid = ".$this->id; dol_syslog(get_class($this)."::updateTimeSpent", LOG_DEBUG); diff --git a/htdocs/recruitment/class/recruitmentjobposition.class.php b/htdocs/recruitment/class/recruitmentjobposition.class.php index d82e2265e7e..68fb7a1fea6 100644 --- a/htdocs/recruitment/class/recruitmentjobposition.class.php +++ b/htdocs/recruitment/class/recruitmentjobposition.class.php @@ -670,7 +670,7 @@ class RecruitmentJobPosition extends CommonObject $newprivatenote = dol_concatdesc($this->note_private, $note); $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element; - $sql .= " SET status = ".$status.", note_private = '".$this->db->escape($newprivatenote)."'"; + $sql .= " SET status = ".((int) $status).", note_private = '".$this->db->escape($newprivatenote)."'"; //$sql .= ", date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id; $sql .= " WHERE rowid = ".$this->id; diff --git a/htdocs/salaries/class/paymentsalary.class.php b/htdocs/salaries/class/paymentsalary.class.php index dc7e310d560..dcb50dac49a 100644 --- a/htdocs/salaries/class/paymentsalary.class.php +++ b/htdocs/salaries/class/paymentsalary.class.php @@ -570,7 +570,7 @@ class PaymentSalary extends CommonObject public function update_fk_bank($id_bank) { // phpcs:enable - $sql = "UPDATE ".MAIN_DB_PREFIX."payment_salary SET fk_bank = ".$id_bank." WHERE rowid = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."payment_salary SET fk_bank = ".((int) $id_bank)." WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::update_fk_bank", LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php index fd4fde95243..2a5f2b84a53 100644 --- a/htdocs/societe/card.php +++ b/htdocs/societe/card.php @@ -792,7 +792,7 @@ if (empty($reshook)) { // Update linked member if (!$error && $object->fk_soc > 0) { $sql = "UPDATE ".MAIN_DB_PREFIX."adherent"; - $sql .= " SET fk_soc = NULL WHERE fk_soc = ".$id; + $sql .= " SET fk_soc = NULL WHERE fk_soc = ".((int) $socid); if (!$object->db->query($sql)) { $error++; $object->error .= $object->db->lasterror(); diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php index 954ebe94673..7746001dea7 100644 --- a/htdocs/societe/class/societe.class.php +++ b/htdocs/societe/class/societe.class.php @@ -1985,7 +1985,7 @@ class Societe extends CommonObject $newclient = 3; //If prospect, we keep prospect tag } $sql = "UPDATE ".MAIN_DB_PREFIX."societe"; - $sql .= " SET client = ".$newclient; + $sql .= " SET client = ".((int) $newclient); $sql .= " WHERE rowid = ".$this->id; $resql = $this->db->query($sql); diff --git a/htdocs/supplier_proposal/class/supplier_proposal.class.php b/htdocs/supplier_proposal/class/supplier_proposal.class.php index ecd506e2cb4..bbb06f2a2da 100644 --- a/htdocs/supplier_proposal/class/supplier_proposal.class.php +++ b/htdocs/supplier_proposal/class/supplier_proposal.class.php @@ -1541,13 +1541,13 @@ class SupplierProposal extends CommonObject $remise = trim($remise) ?trim($remise) : 0; if (!empty($user->rights->supplier_proposal->creer)) { - $remise = price2num($remise); + $remise = price2num($remise, 2); - $sql = "UPDATE ".MAIN_DB_PREFIX."supplier_proposal SET remise_percent = ".$remise; + $sql = "UPDATE ".MAIN_DB_PREFIX."supplier_proposal SET remise_percent = ".((float) $remise); $sql .= " WHERE rowid = ".$this->id." AND fk_statut = 0"; if ($this->db->query($sql)) { - $this->remise_percent = $remise; + $this->remise_percent = ((float) $remise); $this->update_price(1); return 1; } else { @@ -1569,13 +1569,15 @@ class SupplierProposal extends CommonObject public function set_remise_absolue($user, $remise) { // phpcs:enable - $remise = trim($remise) ?trim($remise) : 0; + if (empty($remise)) { + $remise = 0; + } + + $remise = price2num($remise); if (!empty($user->rights->supplier_proposal->creer)) { - $remise = price2num($remise); - $sql = "UPDATE ".MAIN_DB_PREFIX."supplier_proposal "; - $sql .= " SET remise_absolue = ".$remise; + $sql .= " SET remise_absolue = ".((float) $remise); $sql .= " WHERE rowid = ".$this->id." AND fk_statut = 0"; if ($this->db->query($sql)) { @@ -1608,7 +1610,7 @@ class SupplierProposal extends CommonObject $error = 0; $sql = "UPDATE ".MAIN_DB_PREFIX."supplier_proposal"; - $sql .= " SET fk_statut = ".$this->statut.","; + $sql .= " SET fk_statut = ".((int) $this->statut).","; if (!empty($note)) { $sql .= " note_private = '".$this->db->escape($note)."',"; } @@ -1669,7 +1671,7 @@ class SupplierProposal extends CommonObject $this->db->begin(); $sql = "UPDATE ".MAIN_DB_PREFIX."supplier_proposal"; - $sql .= " SET fk_statut = ".$status.", note_private = '".$this->db->escape($note)."', date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id; + $sql .= " SET fk_statut = ".((int) $status).", note_private = '".$this->db->escape($note)."', date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id; $sql .= " WHERE rowid = ".$this->id; $resql = $this->db->query($sql); diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index c1224285c7c..f01198f1ca8 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -1110,16 +1110,14 @@ class User extends CommonObject // Check parameters if ($this->statut == $status) { return 0; - } else { - $this->statut = $status; } $this->db->begin(); // Save in database $sql = "UPDATE ".MAIN_DB_PREFIX."user"; - $sql .= " SET statut = ".$this->statut; - $sql .= " WHERE rowid = ".$this->id; + $sql .= " SET statut = ".((int) $status); + $sql .= " WHERE rowid = ".((int) $this->id); $result = $this->db->query($sql); dol_syslog(get_class($this)."::setstatus", LOG_DEBUG); @@ -1136,6 +1134,8 @@ class User extends CommonObject $this->db->rollback(); return -$error; } else { + $this->status = $status; + $this->statut = $status; $this->db->commit(); return 1; } @@ -1199,7 +1199,7 @@ class User extends CommonObject // If contact, remove link if ($this->contact_id > 0) { - $sql = "UPDATE ".MAIN_DB_PREFIX."socpeople SET fk_user_creat = null WHERE rowid = ".$this->contact_id; + $sql = "UPDATE ".MAIN_DB_PREFIX."socpeople SET fk_user_creat = null WHERE rowid = ".((int) $this->contact_id); if (!$error && !$this->db->query($sql)) { $error++; $this->error = $this->db->lasterror(); @@ -1737,7 +1737,7 @@ class User extends CommonObject // If user is linked to a member, remove old link to this member if ($this->fk_member > 0) { dol_syslog(get_class($this)."::update remove link with member. We will recreate it later", LOG_DEBUG); - $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member = NULL where fk_member = ".$this->fk_member; + $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member = NULL where fk_member = ".((int) $this->fk_member); $resql = $this->db->query($sql); if (!$resql) { $this->error = $this->db->error(); $this->db->rollback(); return -5; @@ -1745,7 +1745,7 @@ class User extends CommonObject } // Set link to user dol_syslog(get_class($this)."::update set link with member", LOG_DEBUG); - $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member =".($this->fk_member > 0 ? $this->fk_member : 'null')." where rowid = ".$this->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."user SET fk_member =".($this->fk_member > 0 ? ((int) $this->fk_member) : 'null')." where rowid = ".((int) $this->id); $resql = $this->db->query($sql); if (!$resql) { $this->error = $this->db->error(); $this->db->rollback(); return -5;