Escaping variable passed to SQL WHERE clause

myflyingbox · Mar 16, 2017 · 21119f0 · 21119f0
1 parent ffaffb0
commit 21119f0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/models/LceService.php b/models/LceService.php
@@ -71,7 +71,7 @@ public static function findByCarrierId($id_carrier)
     public static function findByCode($service_code)
     {
         $sql = 'SELECT * FROM '._DB_PREFIX_.'lce_services as s
-                WHERE s.`code` = "'.$service_code.'"';
+                WHERE s.`code` = "'.pSQL($service_code).'"';
         $row = Db::getInstance(_PS_USE_SQL_SLAVE_)->getRow($sql);
         if ($row) {
             $service = new self((int) $row['id_service']);