From 78c187fb99b27616e605adf5bf3c0495266d07b1 Mon Sep 17 00:00:00 2001
From: Seamus Lee <seamuslee001@gmail.com>
Date: Wed, 16 Nov 2016 06:37:04 +1100
Subject: [PATCH] CRM-19641

---
 CRM/Case/XMLProcessor/Report.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/CRM/Case/XMLProcessor/Report.php b/CRM/Case/XMLProcessor/Report.php
index b537bf6c1b1b..8f460c53e8be 100644
--- a/CRM/Case/XMLProcessor/Report.php
+++ b/CRM/Case/XMLProcessor/Report.php
@@ -666,10 +666,10 @@ public function getActivityTypeCustomSQL($activityTypeID, $dateFormat = NULL) {
           $query = "
 SELECT label, value
   FROM civicrm_option_value
- WHERE option_group_id = {$dao->optionGroupID}
+ WHERE option_group_id = %1
 ";
 
-          $option = CRM_Core_DAO::executeQuery($query);
+          $option = CRM_Core_DAO::executeQuery($query, array(1 => array($dao->optionGroupID, 'Positive')));
           while ($option->fetch()) {
             $dataType = $dao->dataType;
             if ($dataType == 'Int' || $dataType == 'Float') {
@@ -688,8 +688,9 @@ public function getActivityTypeCustomSQL($activityTypeID, $dateFormat = NULL) {
 
       foreach ($sql as $tableName => $values) {
         $columnNames = implode(',', $values);
+        $tableName = CRM_Utils_Type::escape($tableName, 'MysqlColumnNameOrAlias');
         $sql[$tableName] = "
-SELECT '{$groupTitle[$tableName]}' as groupTitle, $columnNames
+SELECT '" . CRM_Core_DAO::escapeString($groupTitle[$tableName]) . "' as groupTitle, $columnNames
 FROM   $tableName
 WHERE  entity_id = %1
 ";