Security fixes 24

interface/orders/procedure_stats.php

@@ -1,13 +1,27 @@
 <?php
-// Copyright (C) 2010-2013 Rod Roark <[email protected]>
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License
-// as published by the Free Software Foundation; either version 2
-// of the License, or (at your option) any later version.
-
-// This module creates statistical reports related to lab tests and
-// other procedure orders.
+/**
+ * This module creates statistical reports related to lab tests and
+ * other procedure orders.
+ *
+ * Copyright (C) 2010-2013 Rod Roark <[email protected]>
+ * Copyright (C) 2015 Roberto Vasquez <[email protected]>
+ *
+ * LICENSE: This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http:https://opensource.org/licenses/gpl-license.php>;.
+ *
+ * @package OpenEMR
+ * @author Rod Roark <[email protected]>
+ * @author Roberto Vasquez <[email protected]>
+ * @link http:https://www.open-emr.org
+ */
 
 require_once("../globals.php");
 require_once("../../library/patient.inc");
@@ -390,6 +404,9 @@ function process_result_code($row) {
 
  // This gets us all results, with encounter and patient
  // info attached and grouped by patient and encounter.
+
+ $sqlBindArray = array();
+
  $query = "SELECT " .
  "po.patient_id, po.encounter_id, po.date_ordered, " .
  "po.provider_id, pd.regdate, " .
@@ -410,14 +427,18 @@ function process_result_code($row) {
  // "JOIN procedure_type AS pto ON pto.procedure_type_id = pc.procedure_type_id " .
  "JOIN procedure_type AS ptr ON ptr.lab_id = po.lab_id AND ptr.procedure_code = ps.result_code " .
  "AND ptr.procedure_type LIKE 'res%' " .
- "WHERE po.date_ordered IS NOT NULL AND po.date_ordered >= '$from_date' " .
- "AND po.date_ordered <= '$to_date' ";
+ "WHERE po.date_ordered IS NOT NULL AND po.date_ordered >= ? " .
+ "AND po.date_ordered <= ? ";
+
+ array_push($sqlBindArray, $from_date, $to_date);
+
  if ($form_facility) {
- $query .= "AND fe.facility_id = '$form_facility' ";
+ $query .= "AND fe.facility_id = ? ";
+ array_push($sqlBindArray, $form_facility);
  }
  $query .= "ORDER BY fe.pid, fe.encounter, ps.result_code"; // needed?
 
- $res = sqlStatement($query);
+ $res = sqlStatement($query, $sqlBindArray);
 
  while ($row = sqlFetchArray($res)) {
  process_result_code($row);