Quote field names in join delete query.

Fabrik · Nov 27, 2017 · cdd4383 · cdd4383
1 parent 1d50c43
commit cdd4383
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/components/com_fabrik/models/element.php b/components/com_fabrik/models/element.php
@@ -7766,11 +7766,11 @@ protected function deleteDeselectedItems($idsToKeep, $k)
 			foreach ($idsToKeep as $parentId => $ids)
 			{
 				$query->clear();
-				$query->delete($join->table_join)->where('parent_id = ' . $parentId);
+				$query->delete($join->table_join)->where($db->quoteName('parent_id') . ' = ' . $parentId);
 
 				if (!empty($ids))
 				{
-					$query->where('id NOT IN ( ' . implode($ids, ',') . ')');
+					$query->where($db->quoteName('id') . ' NOT IN ( ' . implode($ids, ',') . ')');
 				}
 
 				$db->setQuery($query);