dolibarr/htdocs/core/modules/import
MDW ab8daf516f
Qual: Remove SQL injection suppressions from Phan baseline (#39450)
* Qual: Remove SQL injection suppressions from Phan baseline

# Qual: Remove SQL injection suppressions from Phan baseline

- Removed SqlInjection suppressions from baseline.txt
- Removed SqlInjectionUnquotedEscape suppressions from baseline.txt

* Qual: Improve SQL query escaping and formatting in contact list

# Qual: Improve SQL query escaping and formatting in contact list

Improved the SQL query escaping for compatibility with SqlInjection.

Does not fix the inappropriate/incomplete escaping through usage of the 'escapeforlike' for REGEX or PGSQL '~'.

* Qual: Add SQLInjection suppression comments

# Qual: Add SQLInjection suppression comments

Added SQLInjection suppression directives:
- In modules_import.class.php, for json_encode operations.
- In html.formproduct.class.php, for expression "sanitized" by $db->order().
- In html.formwebportal.class.php, for the WHERE clause conditions (supposes safe argument).

---------

Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2026-08-11 02:21:54 +02:00
..
import_csv.modules.php NEW Strings are trimed when doing import. 2026-05-04 17:10:12 +02:00
import_xlsx.modules.php Debug v24 2026-08-06 00:55:26 +02:00
modules_import.class.php Qual: Remove SQL injection suppressions from Phan baseline (#39450) 2026-08-11 02:21:54 +02:00