@@ -2620,6 +2620,7 @@ public function getExtraFieldRules($filters, $stringToSearch = 'extra_', $condit
2620
2620
}
2621
2621
} else {
2622
2622
// Extra fields
2623
+ $ ruleField = Database::escapeField ($ rule ->field );
2623
2624
if (false === strpos ($ rule ->field , '_second ' )) {
2624
2625
// No _second
2625
2626
$ original_field = str_replace ($ stringToSearch , '' , $ rule ->field );
@@ -2642,7 +2643,7 @@ public function getExtraFieldRules($filters, $stringToSearch = 'extra_', $condit
2642
2643
$ conditionArray [] = ' ( '
2643
2644
.$ this ->get_where_clause ($ rule ->field , $ rule ->op , $ rule ->data )
2644
2645
.') ' ;
2645
- $ extraFields [] = ['field ' => $ rule -> field , 'id ' => $ field_option ['id ' ]];
2646
+ $ extraFields [] = ['field ' => $ ruleField , 'id ' => $ field_option ['id ' ]];
2646
2647
}
2647
2648
break ;
2648
2649
case self ::FIELD_TYPE_TAG :
@@ -2654,7 +2655,7 @@ public function getExtraFieldRules($filters, $stringToSearch = 'extra_', $condit
2654
2655
//$where = $this->get_where_clause($rule->field, $rule->op, $rule->data, 'OR');
2655
2656
//$conditionArray[] = " ( $where ) ";
2656
2657
$ extraFields [] = [
2657
- 'field ' => $ rule -> field ,
2658
+ 'field ' => $ ruleField ,
2658
2659
'id ' => $ field_option ['id ' ],
2659
2660
'data ' => $ rule ->data ,
2660
2661
];
@@ -2668,7 +2669,7 @@ public function getExtraFieldRules($filters, $stringToSearch = 'extra_', $condit
2668
2669
$ where = $ this ->get_where_clause ($ rule ->field , $ rule ->op , $ rule ->data , 'OR ' );
2669
2670
$ conditionArray [] = " ( $ where ) " ;
2670
2671
$ extraFields [] = [
2671
- 'field ' => $ rule -> field ,
2672
+ 'field ' => $ ruleField ,
2672
2673
'id ' => $ field_option ['id ' ],
2673
2674
'data ' => $ rule ->data ,
2674
2675
];
@@ -2680,7 +2681,7 @@ public function getExtraFieldRules($filters, $stringToSearch = 'extra_', $condit
2680
2681
$ original_field = str_replace ($ stringToSearch , '' , $ my_field );
2681
2682
$ field_option = $ this ->get_handler_field_info_by_field_variable ($ original_field );
2682
2683
$ extraFields [] = [
2683
- 'field ' => $ rule -> field ,
2684
+ 'field ' => $ ruleField ,
2684
2685
'id ' => $ field_option ['id ' ],
2685
2686
];
2686
2687
}
@@ -2701,9 +2702,12 @@ public function getExtraFieldRules($filters, $stringToSearch = 'extra_', $condit
2701
2702
*/
2702
2703
public function get_where_clause ($ col , $ oper , $ val , $ conditionBetweenOptions = 'OR ' )
2703
2704
{
2705
+ $ col = Database::escapeField ($ col );
2706
+
2704
2707
if (empty ($ col )) {
2705
2708
return '' ;
2706
2709
}
2710
+
2707
2711
$ conditionBetweenOptions = in_array ($ conditionBetweenOptions , ['OR ' , 'AND ' ]) ? $ conditionBetweenOptions : 'OR ' ;
2708
2712
if ('bw ' === $ oper || 'bn ' === $ oper ) {
2709
2713
$ val .= '% ' ;
0 commit comments