From 49fd4eb035247d4b005b82d7a194806fe919a502 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 14 Jan 2014 12:13:31 +0100 Subject: [PATCH] Bug 11549: Interpolate variables into SQL statements should not be allowed Signed-off-by: Sonia BOUIS --- C4/Acquisition.pm | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm index 8e1e9d4..67ea46e 100644 --- a/C4/Acquisition.pm +++ b/C4/Acquisition.pm @@ -1805,7 +1805,7 @@ sub TransferOrder { my $dbh = C4::Context->dbh; my ($query, $sth, $rv); - $query = qq{ + $query = q{ UPDATE aqorders SET datecancellationprinted = CAST(NOW() AS date) WHERE ordernumber = ? @@ -1824,7 +1824,7 @@ sub TransferOrder { WHERE ordernumber = ? }, {}, $newordernumber ); - $query = qq{ + $query = q{ UPDATE aqorders_items SET ordernumber = ? WHERE ordernumber = ? -- 1.7.2.5