From 5d8289e2c0563e7cf7595d2c97d3261bd0b9d9b9 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <danydb@noalyss.eu>
Date: Mon, 11 Sep 2017 19:01:26 +0200
Subject: [PATCH] SQL : protection injection

---
 include/class/anc_plan.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/class/anc_plan.class.php b/include/class/anc_plan.class.php
index 78b5715b0..e3c85d645 100644
--- a/include/class/anc_plan.class.php
+++ b/include/class/anc_plan.class.php
@@ -66,8 +66,8 @@ class Anc_Plan
     {
         if ( $this->id==0) return;
 
-        $sql="select pa_name,pa_description from plan_analytique where pa_id=".$this->id;
-        $ret= $this->db->exec_sql($sql);
+        $sql="select pa_name,pa_description from plan_analytique where pa_id=$1";
+        $ret= $this->db->exec_sql($sql,array($this->id));
         if ( Database::num_row($ret) == 0)
         {
             return;