From 9c04d93b560598fc24e81c8d1f7b6ea298918c46 Mon Sep 17 00:00:00 2001 From: FusionPBX Date: Tue, 29 Nov 2016 11:05:42 -0700 Subject: [PATCH] Update extension.php --- app/extensions/resources/classes/extension.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/app/extensions/resources/classes/extension.php b/app/extensions/resources/classes/extension.php index 3e302a6b74..b468774095 100644 --- a/app/extensions/resources/classes/extension.php +++ b/app/extensions/resources/classes/extension.php @@ -84,10 +84,14 @@ if (!class_exists('extension')) { public function exists($extension) { $sql = "select extension_uuid from v_extensions "; - $sql .= "where domain_uuid = '".$this->domain_uuid."' "; - $sql .= "and (extension = '$extension' or number_alias = '$extension') "; + $sql .= "where domain_uuid = :domain_uuid "; + $sql .= "and (extension = :extension or number_alias = :extension) "; $sql .= "and enabled = 'true' "; - $result = $this->db->query($sql)->fetchAll(PDO::FETCH_ASSOC); + $prep_statement = $this->db->prepare(check_sql($sql)); + $prep_statement->bindParam(':domain_uuid', $this->domain_uuid); + $prep_statement->bindParam(':extension', $extension); + $prep_statement->execute(); + $result = $prep_statement->fetchAll(PDO::FETCH_NAMED); if (count($result) > 0) { return true; }