Merge pull request #9395 from seamuslee001/CRM-19641

CRM-19641
civicrm · Nov 15, 2016 · 1d3a357 · 1d3a357
2 parents 47494d2 + 78c187f
commit 1d3a357
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/CRM/Case/XMLProcessor/Report.php b/CRM/Case/XMLProcessor/Report.php
@@ -666,10 +666,10 @@ public function getActivityTypeCustomSQL($activityTypeID, $dateFormat = NULL) {
           $query = "
 SELECT label, value
   FROM civicrm_option_value
- WHERE option_group_id = {$dao->optionGroupID}
+ WHERE option_group_id = %1
 ";
 
-          $option = CRM_Core_DAO::executeQuery($query);
+          $option = CRM_Core_DAO::executeQuery($query, array(1 => array($dao->optionGroupID, 'Positive')));
           while ($option->fetch()) {
             $dataType = $dao->dataType;
             if ($dataType == 'Int' || $dataType == 'Float') {
@@ -688,8 +688,9 @@ public function getActivityTypeCustomSQL($activityTypeID, $dateFormat = NULL) {
 
       foreach ($sql as $tableName => $values) {
         $columnNames = implode(',', $values);
+        $tableName = CRM_Utils_Type::escape($tableName, 'MysqlColumnNameOrAlias');
         $sql[$tableName] = "
-SELECT '{$groupTitle[$tableName]}' as groupTitle, $columnNames
+SELECT '" . CRM_Core_DAO::escapeString($groupTitle[$tableName]) . "' as groupTitle, $columnNames
 FROM   $tableName
 WHERE  entity_id = %1
 ";