CVE-2021-41262: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" privilege. Users are advised to upgrade to version 0.9.6 as soon as possible. There are no known workarounds.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2021-12-16T19:15Z
Repository: https://github.com/galette/galette
Language: PHP
Files changed: galette/lib/Galette/Core/Db.php, galette/lib/Galette/Core/Logo.php, galette/lib/Galette/Core/MailingHistory.php, galette/lib/Galette/Core/Password.php, galette/lib/Galette/Core/Picture.php, galette/lib/Galette/DynamicFields/DynamicField.php, galette/lib/Galette/Entity/Adherent.php, galette/lib/Galette/Entity/Contribution.php, galette/lib/Galette/Entity/Entitled.php, galette/lib/Galette/Entity/Group.php, galette/lib/Galette/Entity/ImportModel.php, galette/lib/Galette/Entity/PaymentType.php, galette/lib/Galette/Entity/PdfModel.php, galette/lib/Galette/Entity/Reminder.php, galette/lib/Galette/Entity/SavedSearch.php, galette/lib/Galette/Entity/Social.php, galette/lib/Galette/Entity/Title.php, galette/lib/Galette/Entity/Transaction.php, galette/lib/Galette/Repository/Groups.php, galette/lib/Galette/Repository/Members.php
Commit date: 2021-11-09 22:47:22 +0100
Commit message: Use prepared statement rather than direct SQL

Diff: diff --git a/galette/lib/Galette/Core/Db.php b/galette/lib/Galette/Core/Db.php
index ef45d7b75..1fc4d5a76 100644
--- a/galette/lib/Galette/Core/Db.php
+++ b/galette/lib/Galette/Core/Db.php
@@ -5,11 +5,11 @@
 /**
  * Zend Db wrapper
  *
  * PHP version 5
  *
- * Copyright © 2011-2014 The Galette Team
+ * Copyright © 2011-2021 The Galette Team
  *
  * This file is part of Galette (http://galette.tuxfamily.org).
  *
  * Galette is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -26,11 +26,11 @@
  *
  * @category  Core
  * @package   Galette
  *
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2011-2014 The Galette Team
+ * @copyright 2011-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  * @since     Available since 0.7dev - 2011-07-27
  */
 
@@ -56,11 +56,11 @@ use Laminas\Db\Sql\SqlInterface;
  *
  * @category  Core
  * @name      Db
  * @package   Galette
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2011-2014 The Galette Team
+ * @copyright 2011-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://framework.zend.com/apidoc/2.2/namespaces/Zend.Db.html
  * @since     Available since 0.7dev - 2011-07-27
  *
  * @property Adapter $db
@@ -451,11 +451,11 @@ class Db
                 }
 
                 //can Galette SELECT records ?
                 try {
                     $select = $this->sql->select('galette_test');
-                    $select->where('test_id = 1');
+                    $select->where(['test_id' => 1]);
                     $res = $this->execute($select);
                     $pass = $res->count() === 1;
 
                     if ($pass) {
                         $results['select'] = true;
@@ -671,11 +671,11 @@ class Db
                 $data = array();
                 $where = array();
 
                 //build where
                 foreach ($pkeys as $k) {
-                    $where[] = $k . ' = "' . $row->$k . '"';
+                    $where[$k] = $row->$k;
                 }
 
                 //build data
                 foreach ($row as $key => $value) {
                     $data[$key] = $value;
diff --git a/galette/lib/Galette/Core/Logo.php b/galette/lib/Galette/Core/Logo.php
index c03e8dd62..a6e224177 100644
--- a/galette/lib/Galette/Core/Logo.php
+++ b/galette/lib/Galette/Core/Logo.php
@@ -5,11 +5,11 @@
 /**
  * Logo handling
  *
  * PHP version 5
  *
- * Copyright © 2009-2014 The Galette Team
+ * Copyright © 2009-2021 The Galette Team
  *
  * This file is part of Galette (http://galette.tuxfamily.org).
  *
  * Galette is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -26,11 +26,11 @@
  *
  * @category  Core
  * @package   Galette
  *
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2009-2014 The Galette Team
+ * @copyright 2009-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  * @since     Available since 0.7dev - 2009-09-13
  */
 
@@ -44,11 +44,11 @@ use Analog\Analog;
  *
  * @category  Core
  * @name      Logo
  * @package   Galette
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2009-2014 The Galette Team
+ * @copyright 2009-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  * @since     Available since 0.7dev - 2009-09-13
  */
 class Logo extends Picture
@@ -98,11 +98,11 @@ class Logo extends Picture
             array(
                 'picture',
                 'format'
             )
         );
-        $select->where(self::PK . ' = ' . $this->db_id);
+        $select->where([self::PK => $this->db_id]);
         return $select;
     }
 
     /**
      * Returns custom state
diff --git a/galette/lib/Galette/Core/MailingHistory.php b/galette/lib/Galette/Core/MailingHistory.php
index 34e2bd3fa..9a3e8d45f 100644
--- a/galette/lib/Galette/Core/MailingHistory.php
+++ b/galette/lib/Galette/Core/MailingHistory.php
@@ -354,11 +354,11 @@ class MailingHistory extends History
      */
     public static function loadFrom(Db $zdb, $id, $mailing, $new = true)
     {
         try {
             $select = $zdb->select(self::TABLE);
-            $select->where('mailing_id = ' . $id);
+            $select->where(['mailing_id' => $id]);
 
             $results = $zdb->execute($select);
             $result = $results->current();
 
             return $mailing->loadFromHistory($result, $new);
@@ -448,11 +448,11 @@ class MailingHistory extends History
                     ($this->zdb->isPostgres() ? 'false' : 0)
             );
 
             $update = $this->zdb->update(self::TABLE);
             $update->set($values);
-            $update->where(self::PK . ' = ' . $this->mailing->history_id);
+            $update->where([self::PK => $this->mailing->history_id]);
             $this->zdb->execute($update);
             return true;
         } catch (Throwable $e) {
             Analog::log(
                 'An error occurend updating Mailing | ' . $e->getMessage(),
diff --git a/galette/lib/Galette/Core/Password.php b/galette/lib/Galette/Core/Password.php
index 1832e37bd..728669dd1 100644
--- a/galette/lib/Galette/Core/Password.php
+++ b/galette/lib/Galette/Core/Password.php
@@ -6,11 +6,11 @@
  * Password for galette. The original code was found
  * in includes/functions.inc.php
  *
  * PHP version 5
  *
- * Copyright © 2003-2020 The Galette Team
+ * Copyright © 2003-2021 The Galette Team
  *
  * This file is part of Galette (http://galette.tuxfamily.org).
  *
  * Galette is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,11 +29,11 @@
  * @package   Galette
  *
  * @author    Frédéric Jacquot <unknown@unknow.com>
  * @author    Georges Khaznadar (password encryption, images) <unknown@unknow.com>
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2003-2014 The Galette Team
+ * @copyright 2003-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  * @since     Available since 0.7dev - 2009-02-28
  */
 
@@ -50,11 +50,11 @@ use Galette\Entity\Adherent;
  * @name      Password
  * @package   Galette
  * @author    Frédéric Jacquot <unknown@unknow.com>
  * @author    Georges Khaznadar (password encryption, images) <unknown@unknow.com>
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2009-2020 The Galette Team
+ * @copyright 2009-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  * @since     Available since 0.7dev - 2011-06-16
  */
 
@@ -93,11 +93,11 @@ class Password extends AbstractPassword
      */
     private function removeOldEntries(int $id_adh): bool
     {
         try {
             $delete = $this->zdb->delete(self::TABLE);
-            $delete->where(self::PK . ' = ' . $id_adh);
+            $delete->where([self::PK => $id_adh]);
 
             $del = $this->zdb->execute($delete);
             if ($del) {
                 Analog::log(
                     'Temporary passwords for `' . $id_adh . '` has been removed.',
diff --git a/galette/lib/Galette/Core/Picture.php b/galette/lib/Galette/Core/Picture.php
index 37091d462..4ae2eafee 100644
--- a/galette/lib/Galette/Core/Picture.php
+++ b/galette/lib/Galette/Core/Picture.php
@@ -5,11 +5,11 @@
 /**
  * Picture handling
  *
  * PHP version 5
  *
- * Copyright © 2006-2014 The Galette Team
+ * Copyright © 2006-2021 The Galette Team
  *
  * This file is part of Galette (http://galette.tuxfamily.org).
  *
  * Galette is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -27,11 +27,11 @@
  * @category  Core
  * @package   Galette
  *
  * @author    Frédéric Jacquot <unknown@unknow.com>
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2006-2014 The Galette Team
+ * @copyright 2006-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  */
 
 namespace Galette\Core;
@@ -49,11 +49,11 @@ use Galette\IO\FileTrait;
  * @name Picture
  * @category  Core
  * @package   Galette
  * @author    Frédéric Jacquot <unknown@unknow.com>
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2006-2014 The Galette Team
+ * @copyright 2006-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  */
 class Picture implements FileInterface
 {
@@ -337,13 +337,11 @@ class Picture implements FileInterface
             if ($transaction === true) {
                 $zdb->connection->beginTransaction();
             }
 
             $delete = $zdb->delete($this->tbl_prefix . $class::TABLE);
-            $delete->where(
-                $class::PK . ' = ' . $this->db_id
-            );
+            $delete->where([$class::PK => $this->db_id]);
             $del = $zdb->execute($delete);
 
             if (!$del->count() > 0) {
                 Analog::log(
                     'Unable to remove picture database entry for ' . $this->db_id,
diff --git a/galette/lib/Galette/DynamicFields/DynamicField.php b/galette/lib/Galette/DynamicFields/DynamicField.php
index 775ed2c53..d87aba0ce 100644
--- a/galette/lib/Galette/DynamicFields/DynamicField.php
+++ b/galette/lib/Galette/DynamicFields/DynamicField.php
@@ -141,11 +141,11 @@ abstract class DynamicField
      */
     public static function loadFieldType(Db $zdb, $id)
     {
         try {
             $select = $zdb->select(self::TABLE);
-            $select->where('field_id = ' . $id);
+            $select->where(['field_id' => $id]);
 
             $results = $zdb->execute($select);
             $result = $results->current();
             if ($result) {
                 $field_type = $result->field_type;
@@ -214,11 +214,11 @@ abstract class DynamicField
      */
     public function load($id)
     {
         try {
             $select = $this->zdb->select(self::TABLE);
-            $select->where(self::PK . ' = ' . $id);
+            $select->where([self::PK => $id]);
 
             $results = $this->zdb->execute($select);
             $result = $results->current();
 
             if ($result) {
@@ -714,13 +714,11 @@ abstract class DynamicField
                 $values['field_required'] = $this->zdb->isPostgres() ? 'false' : 0;
             }
 
             if (!$isnew) {
                 $update = $this->zdb->update(self::TABLE);
-                $update->set($values)->where(
-                    self::PK . ' = ' . $this->id
-                );
+                $update->set($values)->where([self::PK => $this->id]);
                 $this->zdb->execute($update);
             } else {
                 $values['field_type'] = $this->getType();
                 $insert = $this->zdb->insert(self::TABLE);
                 $insert->values($values);
diff --git a/galette/lib/Galette/Entity/Adherent.php b/galette/lib/Galette/Entity/Adherent.php
index c0344ad00..2113b6a55 100644
--- a/galette/lib/Galette/Entity/Adherent.php
+++ b/galette/lib/Galette/Entity/Adherent.php
@@ -471,13 +471,11 @@ class Adherent
         try {
             $id = self::PK;
             $select = $this->zdb->select(self::TABLE);
             $select->columns(
                 array($id)
-            )->where(
-                'parent_id = ' . $this->_id
-            );
+            )->where(['parent_id' => $this->_id]);
 
             $results = $this->zdb->execute($select);
 
             if ($results->count() > 0) {
                 foreach ($results as $row) {
@@ -845,11 +843,11 @@ class Adherent
      */
     public static function getSName($zdb, $id, $wid = false, $wnick = false)
     {
         try {
             $select = $zdb->select(self::TABLE);
-            $select->where(self::PK . ' = ' . $id);
+            $select->where([self::PK => $id]);
 
             $results = $zdb->execute($select);
             $row = $results->current();
             return self::getNameWithCase(
                 $row->nom_adh,
@@ -923,11 +921,11 @@ class Adherent
             $cpass = password_hash($pass, PASSWORD_BCRYPT);
 
             $update = $zdb->update(self::TABLE);
             $update->set(
                 array('mdp_adh' => $cpass)
-            )->where(self::PK . ' = ' . $id_adh);
+            )->where([self::PK => $id_adh]);
             $zdb->execute($update);
             Analog::log(
                 'Password for `' . $id_adh . '` has been updated.',
                 Analog::DEBUG
             );
@@ -1305,12 +1303,13 @@ class Adherent
                         $select = $this->zdb->select(self::TABLE);
                         $select->columns(
                             array(self::PK)
                         )->where(array('email_adh' => $value));
                         if (!empty($this->_id)) {
-                            $select->where(
-                                self::PK . ' != ' . $this->_id
+                            $select->where->notEqualTo(
+                                self::PK,
+                                $this->_id
                             );
                         }
 
                         $results = $this->zdb->execute($select);
                         if ($results->count() !== 0) {
@@ -1343,12 +1342,13 @@ class Adherent
                             $select = $this->zdb->select(self::TABLE);
                             $select->columns(
                                 array(self::PK)
                             )->where(array('login_adh' => $value));
                             if (!empty($this->_id)) {
-                                $select->where(
-                                    self::PK . ' != ' . $this->_id
+                                $select->where->notEqualTo(
+                                    self::PK,
+                                    $this->_id
                                 );
                             }
 
                             $results = $this->zdb->execute($select);
                             if (
@@ -1402,11 +1402,11 @@ class Adherent
             case 'id_statut':
                 try {
                     $this->$prop = (int)$value;
                     //check if status exists
                     $select = $this->zdb->select(Status::TABLE);
-                    $select->where(Status::PK . '= ' . $value);
+                    $select->where([Status::PK => $value]);
 
                     $results = $this->zdb->execute($select);
                     $result = $results->current();
                     if (!$result) {
                         $this->errors[] = str_replace(
@@ -1575,13 +1575,11 @@ class Adherent
                     unset($values['mdp_adh']);
                 }
 
                 $update = $this->zdb->update(self::TABLE);
                 $update->set($values);
-                $update->where(
-                    self::PK . '=' . $this->_id
-                );
+                $update->where([self::PK => $this->_id]);
 
                 $edit = $this->zdb->execute($update);
 
                 //edit == 0 does not mean there were an error, but that there
                 //were nothing to change
@@ -1627,11 +1625,11 @@ class Adherent
         try {
             $modif_date = date('Y-m-d');
             $update = $this->zdb->update(self::TABLE);
             $update->set(
                 array('date_modif_adh' => $modif_date)
-            )->where(self::PK . '=' . $this->_id);
+            )->where([self::PK => $this->_id]);
 
             $edit = $this->zdb->execute($update);
             $this->_modification_date = $modif_date;
         } catch (Throwable $e) {
             Analog::log(
diff --git a/galette/lib/Galette/Entity/Contribution.php b/galette/lib/Galette/Entity/Contribution.php
index 9c088519a..c1fb4de13 100644
--- a/galette/lib/Galette/Entity/Contribution.php
+++ b/galette/lib/Galette/Entity/Contribution.php
@@ -577,22 +577,22 @@ class Contribution
                 array('date_debut_cotis', 'date_fin_cotis')
             )->join(
                 array('ct' => PREFIX_DB . ContributionsTypes::TABLE),
                 'c.' . ContributionsTypes::PK . '=ct.' . ContributionsTypes::PK,
                 array()
-            )->where(Adherent::PK . ' = ' . $this->_member)
+            )->where([Adherent::PK => $this->_member])
                 ->where(array('cotis_extension' => new Expression('true')))
                 ->where->nest->nest
                 ->greaterThanOrEqualTo('date_debut_cotis', $this->_begin_date)
                 ->lessThan('date_debut_cotis', $this->_end_date)
                 ->unnest
                 ->or->nest
                 ->greaterThan('date_fin_cotis', $this->_begin_date)
                 ->lessThanOrEqualTo('date_fin_cotis', $this->_end_date);
 
             if ($this->id != '') {
-                $select->where(self::PK . ' != ' . $this->id);
+                $select->where->notEqualTo(self::PK, $this->id);
             }
 
             $results = $this->zdb->execute($select);
             if ($results->count() > 0) {
                 $result = $results->current();
@@ -679,13 +679,11 @@ class Contribution
                     );
                 }
             } else {
                 //we're editing an existing contribution
                 $update = $this->zdb->update(self::TABLE);
-                $update->set($values)->where(
-                    self::PK . '=' . $this->_id
-                );
+                $update->set($values)->where([self::PK => $this->_id]);
                 $edit = $this->zdb->execute($update);
 
                 //edit == 0 does not mean there were an error, but that there
                 //were nothing to change
                 if ($edit->count() > 0) {
@@ -748,11 +746,11 @@ class Contribution
 
             $update = $this->zdb->update(Adherent::TABLE);
             $update->set(
                 array('date_echeance' => $date_fin_update)
             )->where(
-                Adherent::PK . '=' . $this->_member
+                [Adherent::PK => $this->_member]
             );
             $this->zdb->execute($update);
             return true;
         } catch (Throwable $e) {
             Analog::log(
@@ -780,11 +778,11 @@ class Contribution
             if ($transaction) {
                 $this->zdb->connection->beginTransaction();
             }
 
             $delete = $this->zdb->delete(self::TABLE);
-            $delete->where(self::PK . ' = ' . $this->_id);
+            $delete->where([self::PK => $this->_id]);
             $del = $this->zdb->execute($delete);
             if ($del->count() > 0) {
                 $this->updateDeadline();
                 $this->dynamicsRemove(true);
             } else {
@@ -882,11 +880,11 @@ class Contribution
             )->join(
                 array('ct' => PREFIX_DB . ContributionsTypes::TABLE),
                 'c.' . ContributionsTypes::PK . '=ct.' . ContributionsTypes::PK,
                 array()
             )->where(
-                Adherent::PK . ' = ' . $member_id
+                [Adherent::PK => $member_id]
             )->where(
                 array('cotis_extension' => new Expression('true'))
             );
 
             $results = $zdb->execute($select);
@@ -925,11 +923,11 @@ class Contribution
             if ($c->isTransactionPartOf($trans_id)) {
                 $update = $zdb->update(self::TABLE);
                 $update->set(
                     array(Transaction::PK => null)
                 )->where(
-                    self::PK . ' = ' . $contrib_id
+                    [self::PK => $contrib_id]
                 );
                 $zdb->execute($update);
                 return true;
             } else {
                 Analog::log(
@@ -962,11 +960,11 @@ class Contribution
     {
         try {
             $update = $zdb->update(self::TABLE);
             $update->set(
                 array(Transaction::PK => $trans_id)
-            )->where(self::PK . ' = ' . $contrib_id);
+            )->where([self::PK => $contrib_id]);
 
             $zdb->execute($update);
             return true;
         } catch (Throwable $e) {
             Analog::log(
diff --git a/galette/lib/Galette/Entity/Entitled.php b/galette/lib/Galette/Entity/Entitled.php
index f59a1f88b..20e71edbb 100644
--- a/galette/lib/Galette/Entity/Entitled.php
+++ b/galette/lib/Galette/Entity/Entitled.php
@@ -124,11 +124,11 @@ abstract class Entitled
      */
     public function load($id)
     {
         try {
             $select = $this->zdb->select($this->table);
-            $select->where($this->fpk . ' = ' . $id);
+            $select->where([$this->fpk => $id]);
 
             $results = $this->zdb->execute($select);
             if ($results->count() > 0) {
                 $result = $results->current();
                 $this->loadFromRS($result);
@@ -343,11 +343,11 @@ abstract class Entitled
             return false;
         }
 
         try {
             $select = $this->zdb->select($this->table);
-            $select->where($this->fpk . '=' . $id);
+            $select->where([$this->fpk => $id]);
 
             $results = $this->zdb->execute($select);
             $result = $results->current();
 
             if (!$result) {
@@ -505,11 +505,11 @@ abstract class Entitled
                 $this->fthird  => $extra
             );
 
             $update = $this->zdb->update($this->table);
             $update->set($values);
-            $update->where($this->fpk . ' = ' . $id);
+            $update->where([$this->fpk => $id]);
 
             $ret = $this->zdb->execute($update);
 
             if ($oldlabel != $label) {
                 $this->deleteTranslation($oldlabel);
@@ -554,11 +554,11 @@ abstract class Entitled
         }
 
         try {
             $this->zdb->connection->beginTransaction();
             $delete = $this->zdb->delete($this->table);
-            $delete->where($this->fpk . ' = ' . $id);
+            $delete->where([$this->fpk => $id]);
 
             $this->zdb->execute($delete);
             $this->deleteTranslation($ret->{$this->flabel});
 
             Analog::log(
@@ -588,11 +588,11 @@ abstract class Entitled
      */
     public function isUsed($id)
     {
         try {
             $select = $this->zdb->select($this->used);
-            $select->where($this->fpk . ' = ' . $id);
+            $select->where([$this->fpk => $id]);
 
             $results = $this->zdb->execute($select);
             $result = $results->current();
 
             if ($result !== null) {
diff --git a/galette/lib/Galette/Entity/Group.php b/galette/lib/Galette/Entity/Group.php
index 088a5f29c..8603ad8fb 100644
--- a/galette/lib/Galette/Entity/Group.php
+++ b/galette/lib/Galette/Entity/Group.php
@@ -177,13 +177,13 @@ class Group
                 $select = $zdb->select(Adherent::TABLE, 'a');
                 $select->join(
                     array('g' => $join),
                     'g.' . Adherent::PK . '=a.' . Adherent::PK,
                     array()
-                )->where(
-                    'g.' . self::PK . ' = ' . $this->id
-                )->order(
+                )->where([
+                    'g.' . self::PK => $this->id
+                ])->order(
                     'nom_adh ASC',
                     'prenom_adh ASC'
                 );
 
                 $results = $zdb->execute($select);
@@ -229,14 +229,14 @@ class Group
             if (!$this->login->isAdmin() && !$this->login->isStaff()) {
                 $select->join(
                     array('b' => PREFIX_DB . self::GROUPSMANAGERS_TABLE),
                     'a.' . self::PK . '=b.' . self::PK,
                     array()
-                )->where('b.' . Adherent::PK . ' = ' . $this->login->id);
+                )->where(['b.' . Adherent::PK => $this->login->id]);
             }
 
-            $select->where('parent_group = ' . $this->id)
+            $select->where(['parent_group' => $this->id])
                 ->order('group_name ASC');
 
             $results = $zdb->execute($select);
             $groups = array();
             $grppk = self::PK;
@@ -293,28 +293,22 @@ class Group
                     Analog::INFO
                 );
 
                 //delete members
                 $delete = $zdb->delete(self::GROUPSUSERS_TABLE);
-                $delete->where(
-                    self::PK . ' = ' . $this->id
-                );
+                $delete->where([self::PK => $this->id]);
                 $zdb->execute($delete);
 
                 //delete managers
                 $delete = $zdb->delete(self::GROUPSMANAGERS_TABLE);
-                $delete->where(
-                    self::PK . ' = ' . $this->id
-                );
+                $delete->where([self::PK => $this->id]);
                 $zdb->execute($delete);
             }
 
             //delete group itself
             $delete = $zdb->delete(self::TABLE);
-            $delete->where(
-                self::PK . ' = ' . $this->id
-            );
+            $delete->where([self::PK => $this->id]);
             $zdb->execute($delete);
 
             //commit all changes
             if ($transaction) {
                 $zdb->connection->commit();
@@ -369,11 +363,11 @@ class Group
         try {
             $update = $zdb->update(self::TABLE);
             $update->set(
                 array('parent_group' => new Expression('NULL'))
             )->where(
-                self::PK . ' = ' . $this->id
+                [self::PK => $this->id]
             );
 
             $edit = $zdb->execute($update);
 
             //edit == 0 does not mean there were an error, but that there
@@ -445,11 +439,11 @@ class Group
             } else {
                 //we're editing an existing group
                 $update = $zdb->update(self::TABLE);
                 $update
                     ->set($values)
-                    ->where(self::PK . '=' . $this->id);
+                    ->where([self::PK => $this->id]);
 
                 $edit = $zdb->execute($update);
 
                 //edit == 0 does not mean there were an error, but that there
                 //were nothing to change
@@ -726,13 +720,11 @@ class Group
         try {
             $zdb->connection->beginTransaction();
 
             //first, remove current groups members
             $delete = $zdb->delete(self::GROUPSUSERS_TABLE);
-            $delete->where(
-                self::PK . ' = ' . $this->id
-            );
+            $delete->where([self::PK => $this->id]);
             $zdb->execute($delete);
 
             Analog::log(
                 'Group members has been removed for `' . $this->group_name .
                 '`, we can now store new ones.',
@@ -816,13 +808,11 @@ class Group
         try {
             $zdb->connection->beginTransaction();
 
             //first, remove current groups managers
             $delete = $zdb->delete(self::GROUPSMANAGERS_TABLE);
-            $delete->where(
-                self::PK . ' = ' . $this->id
-            );
+            $delete->where([self::PK => $this->id]);
             $zdb->execute($delete);
 
             Analog::log(
                 'Group managers has been removed for `' . $this->group_name .
                 '`, we can now store new ones.',
diff --git a/galette/lib/Galette/Entity/ImportModel.php b/galette/lib/Galette/Entity/ImportModel.php
index 1c79023c1..4b7f1d6b8 100644
--- a/galette/lib/Galette/Entity/ImportModel.php
+++ b/galette/lib/Galette/Entity/ImportModel.php
@@ -173,11 +173,11 @@ class ImportModel
                 }
             } else {
                 //we're editing an existing model
                 $update = $zdb->update(self::TABLE);
                 $update->set($values);
-                $update->where(self::PK . '=' . $this->id);
+                $update->where([self::PK => $this->id]);
                 $zdb->execute($update);
                 return true;
             }
         } catch (Throwable $e) {
             Analog::log(
diff --git a/galette/lib/Galette/Entity/PaymentType.php b/galette/lib/Galette/Entity/PaymentType.php
index 5d0d72864..d5a111776 100644
--- a/galette/lib/Galette/Entity/PaymentType.php
+++ b/galette/lib/Galette/Entity/PaymentType.php
@@ -98,11 +98,11 @@ class PaymentType
      */
     private function load($id)
     {
         try {
             $select = $this->zdb->select(self::TABLE);
-            $select->limit(1)->where(self::PK . ' = ' . $id);
+            $select->limit(1)->where([self::PK => $id]);
 
             $results = $this->zdb->execute($select);
             $res = $results->current();
 
             $this->id = $id;
@@ -147,13 +147,11 @@ class PaymentType
                     $this->deleteTranslation($this->old_name);
                     $this->addTranslation($this->name);
                 }
 
                 $update = $this->zdb->update(self::TABLE);
-                $update->set($data)->where(
-                    self::PK . '=' . $this->id
-                );
+                $update->set($data)->where([self::PK => $this->id]);
                 $this->zdb->execute($update);
             } else {
                 $insert = $this->zdb->insert(self::TABLE);
                 $insert->values($data);
                 $add = $this->zdb->execute($insert);
@@ -189,13 +187,11 @@ class PaymentType
             throw new \RuntimeException(_T("You cannot delete system payment types!"));
         }
 
         try {
             $delete = $this->zdb->delete(self::TABLE);
-            $delete->where(
-                self::PK . ' = ' . $id
-            );
+            $delete->where([self::PK => $id]);
             $this->zdb->execute($delete);
             $this->deleteTranslation($this->name);
             Analog::log(
                 'Payment type #' . $id . ' (' . $this->name
                 . ') deleted successfully.',
diff --git a/galette/lib/Galette/Entity/PdfModel.php b/galette/lib/Galette/Entity/PdfModel.php
index 492196419..ba559f82b 100644
--- a/galette/lib/Galette/Entity/PdfModel.php
+++ b/galette/lib/Galette/Entity/PdfModel.php
@@ -134,11 +134,11 @@ abstract class PdfModel
         global $login;
 
         try {
             $select = $this->zdb->select(self::TABLE);
             $select->limit(1)
-                ->where(self::PK . ' = ' . $id);
+                ->where([self::PK => $id]);
 
             $results = $this->zdb->execute($select);
 
             $count = $results->count();
             if ($count === 0) {
@@ -229,11 +229,11 @@ abstract class PdfModel
 
         try {
             if ($this->id !== null) {
                 $update = $this->zdb->update(self::TABLE);
                 $update->set($data)->where(
-                    self::PK . '=' . $this->id
+                    [self::PK => $this->id]
                 );
                 $this->zdb->execute($update);
             } else {
                 $data['model_name'] = $this->name;
                 $insert = $this->zdb->insert(self::TABLE);
diff --git a/galette/lib/Galette/Entity/Reminder.php b/galette/lib/Galette/Entity/Reminder.php
index c949aef84..e7443c615 100644
--- a/galette/lib/Galette/Entity/Reminder.php
+++ b/galette/lib/Galette/Entity/Reminder.php
@@ -109,11 +109,11 @@ class Reminder
     {
         global $zdb;
         try {
             $select = $zdb->select(self::TABLE);
             $select->limit(1)
-                ->where(self::PK . ' = ' . $id);
+                ->where([self::PK => $id]);
 
             $results = $zdb->execute($select);
             $this->loadFromRs($results->current());
         } catch (Throwable $e) {
             Analog::log(
diff --git a/galette/lib/Galette/Entity/SavedSearch.php b/galette/lib/Galette/Entity/SavedSearch.php
index 2452a3e9a..3dba26aa8 100644
--- a/galette/lib/Galette/Entity/SavedSearch.php
+++ b/galette/lib/Galette/Entity/SavedSearch.php
@@ -100,15 +100,15 @@ class SavedSearch
      */
     private function load($id)
     {
         try {
             $select = $this->zdb->select(self::TABLE);
-            $select->limit(1)->where(self::PK . ' = ' . $id);
+            $select->limit(1)->where([self::PK => $id]);
             if ($this->login->isSuperAdmin()) {
                 $select->where(Adherent::PK . ' IS NULL');
             } else {
-                $select->where(Adherent::PK . ' = ' . (int)$this->login->id);
+                $select->where([Adherent::PK => $this->login->id]);
             }
 
             $results = $this->zdb->execute($select);
             $res = $results->current();
 
@@ -221,13 +221,11 @@ class SavedSearch
     public function remove()
     {
         $id = (int)$this->id;
         try {
             $delete = $this->zdb->delete(self::TABLE);
-            $delete->where(
-                self::PK . ' = ' . $id
-            );
+            $delete->where([self::PK => $id]);
             $this->zdb->execute($delete);
             Analog::log(
                 'Saved search #' . $id . ' (' . $this->name
                 . ') deleted successfully.',
                 Analog::INFO
diff --git a/galette/lib/Galette/Entity/Social.php b/galette/lib/Galette/Entity/Social.php
index 1084bb3e1..1c4bceeda 100644
--- a/galette/lib/Galette/Entity/Social.php
+++ b/galette/lib/Galette/Entity/Social.php
@@ -112,11 +112,11 @@ class Social
      */
     private function load(int $id): void
     {
         try {
             $select = $this->zdb->select(self::TABLE);
-            $select->limit(1)->where(self::PK . ' = ' . $id);
+            $select->limit(1)->where([self::PK => $id]);
 
             $results = $this->zdb->execute($select);
             $res = $results->current();
             $this->loadFromRs($res);
         } catch (Throwable $e) {
@@ -197,11 +197,11 @@ class Social
     {
         try {
             if ($this->id !== null && $this->id > 0) {
                 $update = $this->zdb->update(self::TABLE);
                 $update->set(['url' => $this->url])->where(
-                    self::PK . '=' . $this->id
+                    [self::PK => $this->id]
                 );
                 $this->zdb->execute($update);
             } else {
                 $insert = $this->zdb->insert(self::TABLE);
                 $id_adh = $this->{Adherent::PK} > 0 ? $this->{Adherent::PK} : new Expression('NULL');
diff --git a/galette/lib/Galette/Entity/Title.php b/galette/lib/Galette/Entity/Title.php
index 1fb7a41ad..3218522f0 100644
--- a/galette/lib/Galette/Entity/Title.php
+++ b/galette/lib/Galette/Entity/Title.php
@@ -89,11 +89,11 @@ class Title
     private function load($id)
     {
         global $zdb;
         try {
             $select = $zdb->select(self::TABLE);
-            $select->limit(1)->where(self::PK . ' = ' . $id);
+            $select->limit(1)->where([self::PK => $id]);
 
             $results = $zdb->execute($select);
             $res = $results->current();
 
             $this->id = $id;
@@ -143,13 +143,11 @@ class Title
             'long_label'    => $this->long
         );
         try {
             if ($this->id !== null && $this->id > 0) {
                 $update = $zdb->update(self::TABLE);
-                $update->set($data)->where(
-                    self::PK . '=' . $this->id
-                );
+                $update->set($data)->where([self::PK => $this->id]);
                 $zdb->execute($update);
             } else {
                 $insert = $zdb->insert(self::TABLE);
                 $insert->values($data);
                 $add = $zdb->execute($insert);
@@ -185,13 +183,11 @@ class Title
             throw new \RuntimeException(_T("You cannot delete Mr. or Mrs. titles!"));
         }
 
         try {
             $delete = $zdb->delete(self::TABLE);
-            $delete->where(
-                self::PK . ' = ' . $id
-            );
+            $delete->where([self::PK => $id]);
             $zdb->execute($delete);
             Analog::log(
                 'Title #' . $id . ' (' . $this->short
                 . ') deleted successfully.',
                 Analog::INFO
diff --git a/galette/lib/Galette/Entity/Transaction.php b/galette/lib/Galette/Entity/Transaction.php
index 321db6e38..08caee36c 100644
--- a/galette/lib/Galette/Entity/Transaction.php
+++ b/galette/lib/Galette/Entity/Transaction.php
@@ -152,11 +152,11 @@ class Transaction
      */
     public function load($id)
     {
         try {
             $select = $this->zdb->select(self::TABLE, 't');
-            $select->where(self::PK . ' = ' . $id);
+            $select->where([self::PK => $id]);
             $select->join(
                 array('a' => PREFIX_DB . Adherent::TABLE),
                 't.' . Adherent::PK . '=a.' . Adherent::PK,
                 array()
             );
@@ -233,13 +233,11 @@ class Transaction
                 $rem = $c->remove($cids, $hist, false);
             }
 
             //remove transaction itself
             $delete = $this->zdb->delete(self::TABLE);
-            $delete->where(
-                self::PK . ' = ' . $this->_id
-            );
+            $delete->where([self::PK => $this->_id]);
             $del = $this->zdb->execute($delete);
             if ($del->count() > 0) {
                 $this->dynamicsRemove(true);
             } else {
                 Analog::log(
@@ -455,13 +453,11 @@ class Transaction
                     );
                 }
             } else {
                 //we're editing an existing transaction
                 $update = $this->zdb->update(self::TABLE);
-                $update->set($values)->where(
-                    self::PK . '=' . $this->_id
-                );
+                $update->set($values)->where([self::PK => $this->_id]);
                 $edit = $this->zdb->execute($update);
                 //edit == 0 does not mean there were an error, but that there
                 //were nothing to change
                 if ($edit->count() > 0) {
                     $hist->add(
@@ -512,11 +508,11 @@ class Transaction
             $select = $this->zdb->select(Contribution::TABLE);
             $select->columns(
                 array(
                     'sum' => new Expression('SUM(montant_cotis)')
                 )
-            )->where(self::PK . ' = ' . $this->_id);
+            )->where([self::PK => $this->_id]);
 
             $results = $this->zdb->execute($select);
             $result = $results->current();
             $dispatched_amount = $result->sum;
             return (double)$dispatched_amount;
@@ -545,11 +541,11 @@ class Transaction
             $select = $this->zdb->select(Contribution::TABLE);
             $select->columns(
                 array(
                     'sum' => new Expression('SUM(montant_cotis)')
                 )
-            )->where(self::PK . ' = ' . $this->_id);
+            )->where([self::PK => $this->_id]);
 
             $results = $this->zdb->execute($select);
             $result = $results->current();
             $dispatched_amount = $result->sum;
             return (double)$this->_amount - (double)$dispatched_amount;
diff --git a/galette/lib/Galette/Repository/Groups.php b/galette/lib/Galette/Repository/Groups.php
index 5fa8cf987..9839f6db8 100644
--- a/galette/lib/Galette/Repository/Groups.php
+++ b/galette/lib/Galette/Repository/Groups.php
@@ -5,11 +5,11 @@
 /**
  * Groups entity
  *
  * PHP version 5
  *
- * Copyright © 2011-2014 The Galette Team
+ * Copyright © 2011-2021 The Galette Team
  *
  * This file is part of Galette (http://galette.tuxfamily.org).
  *
  * Galette is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -26,11 +26,11 @@
  *
  * @category  Repository
  * @package   Galette
  *
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2011-2014 The Galette Team
+ * @copyright 2011-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  * @since     Available since 0.7dev - 2011-10-25
  */
 
@@ -50,11 +50,11 @@ use Galette\Core\Db;
  *
  * @category  Repository
  * @name      Groups
  * @package   Galette
  * @author    Johan Cwiklinski <johan@x-tnd.be>
- * @copyright 2011-2014 The Galette Team
+ * @copyright 2011-2021 The Galette Team
  * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
  * @link      http://galette.tuxfamily.org
  * @since     Available since 0.7dev - 2011-10-25
  */
 class Groups
@@ -134,11 +134,11 @@ class Groups
             if (!$this->login->isAdmin() && !$this->login->isStaff() && $full === true) {
                 $select->join(
                     array('c' => PREFIX_DB . Group::GROUPSMANAGERS_TABLE),
                     'a.' . Group::PK . '=c.' . Group::PK,
                     array()
-                )->where('c.' . Adherent::PK . ' = ' . $this->login->id);
+                )->where(['c.' . Adherent::PK => $this->login->id]);
             }
 
             if ($full !== true) {
                 $select->where('parent_group IS NULL');
             }
@@ -273,13 +273,11 @@ class Groups
                 $table = Group::GROUPSUSERS_TABLE;
             }
 
             //first, remove current groups members
             $delete = $zdb->delete($table);
-            $delete->where(
-                Adherent::PK . ' = ' . $adh->id
-            );
+            $delete->where([Adherent::PK => $adh->id]);
             $zdb->execute($delete);
 
             $msg = null;
             if ($manager === true) {
                 $msg = 'Member `' . $adh->sname . '` has been detached from groups he manages';
diff --git a/galette/lib/Galette/Repository/Members.php b/galette/lib/Galette/Repository/Members.php
index 424fea671..235cabe66 100644
--- a/galette/lib/Galette/Repository/Members.php
+++ b/galette/lib/Galette/Repository/Members.php
@@ -639,11 +639,11 @@ class Members
                         array()
                     )->join(
                         array('m' => PREFIX_DB . Group::GROUPSMANAGERS_TABLE),
                         'gr.' . Group::PK . '=m.' . Group::PK,
                         array()
-                    )->where('m.' . Adherent::PK . ' = ' . $login->id);
+                    )->where(['m.' . Adherent::PK => $login->id]);
                     break;
                 case self::SHOW_PUBLIC_LIST:
                     if ($photos) {
                         $select->join(
                             array('picture' => PREFIX_DB . Picture::TABLE),
@@ -729,12 +729,12 @@ class Members
                         [
                             'item_id'   => 'item_id',
                             'val'       => 'field_val'
                         ]
                     );
-                    $subselect->where('df.field_form = \'adh\'');
-                    $subselect->where('df.field_id = ' . $df);
+                    $subselect->where(['df.field_form' => 'adh']);
+                    $subselect->where(['df.field_id' => $df]);
                     $select->join(
                         array('df' . $df => $subselect),
                         'a.id_adh = df' . $df . '.item_id',
                         array(),
                         $select::JOIN_LEFT
@@ -1153,11 +1153,11 @@ class Members
                     array('gs' => PREFIX_DB . Group::TABLE),
                     'gs.' . Group::PK . '=g.' . Group::PK,
                     array(),
                     $select::JOIN_LEFT
                 )->where(
-                    '(g.' . Group::PK . ' = ' . $this->filters->group_filter .
+                    '(g.' . Group::PK . ' = ' . $zdb->platform->quoteValue($this->filters->group_filter) .
                     ' OR gs.parent_group = NULL OR gs.parent_group = ' .
                     $this->filters->group_filter . ')'
                 );
             }
 

Vulnerable code:  * Copyright © 2011-2014 The Galette Team
 * @copyright 2011-2014 The Galette Team
 * @copyright 2011-2014 The Galette Team
                    $select->where('test_id = 1');
                    $where[] = $k . ' = "' . $row->$k . '"';
 * Copyright © 2009-2014 The Galette Team
 * @copyright 2009-2014 The Galette Team
 * @copyright 2009-2014 The Galette Team
        $select->where(self::PK . ' = ' . $this->db_id);
            $select->where('mailing_id = ' . $id);
            $update->where(self::PK . ' = ' . $this->mailing->history_id);
 * Copyright © 2003-2020 The Galette Team
 * @copyright 2003-2014 The Galette Team
 * @copyright 2009-2020 The Galette Team
            $delete->where(self::PK . ' = ' . $id_adh);
 * Copyright © 2006-2014 The Galette Team
 * @copyright 2006-2014 The Galette Team
 * @copyright 2006-2014 The Galette Team
            $delete->where(
                $class::PK . ' = ' . $this->db_id
            );
            $select->where('field_id = ' . $id);
            $select->where(self::PK . ' = ' . $id);
                $update->set($values)->where(
                    self::PK . ' = ' . $this->id
                );
            )->where(
                'parent_id = ' . $this->_id
            );
            $select->where(self::PK . ' = ' . $id);
            )->where(self::PK . ' = ' . $id_adh);
                            $select->where(
                                self::PK . ' != ' . $this->_id
                                $select->where(
                                    self::PK . ' != ' . $this->_id
                    $select->where(Status::PK . '= ' . $value);
                $update->where(
                    self::PK . '=' . $this->_id
                );
            )->where(self::PK . '=' . $this->_id);
            )->where(Adherent::PK . ' = ' . $this->_member)
                $select->where(self::PK . ' != ' . $this->id);
                $update->set($values)->where(
                    self::PK . '=' . $this->_id
                );
                Adherent::PK . '=' . $this->_member
            $delete->where(self::PK . ' = ' . $this->_id);
                Adherent::PK . ' = ' . $member_id
                    self::PK . ' = ' . $contrib_id
            )->where(self::PK . ' = ' . $contrib_id);
            $select->where($this->fpk . ' = ' . $id);
            $select->where($this->fpk . '=' . $id);
            $update->where($this->fpk . ' = ' . $id);
            $delete->where($this->fpk . ' = ' . $id);
            $select->where($this->fpk . ' = ' . $id);
                )->where(
                    'g.' . self::PK . ' = ' . $this->id
                )->order(
                )->where('b.' . Adherent::PK . ' = ' . $this->login->id);
            $select->where('parent_group = ' . $this->id)
                $delete->where(
                    self::PK . ' = ' . $this->id
                );
                $delete->where(
                    self::PK . ' = ' . $this->id
                );
            $delete->where(
                self::PK . ' = ' . $this->id
            );
                self::PK . ' = ' . $this->id
                    ->where(self::PK . '=' . $this->id);
            $delete->where(
                self::PK . ' = ' . $this->id
            );
            $delete->where(
                self::PK . ' = ' . $this->id
            );
                $update->where(self::PK . '=' . $this->id);
            $select->limit(1)->where(self::PK . ' = ' . $id);
                $update->set($data)->where(
                    self::PK . '=' . $this->id
                );
            $delete->where(
                self::PK . ' = ' . $id
            );
                ->where(self::PK . ' = ' . $id);
                    self::PK . '=' . $this->id
                ->where(self::PK . ' = ' . $id);
            $select->limit(1)->where(self::PK . ' = ' . $id);
                $select->where(Adherent::PK . ' = ' . (int)$this->login->id);
            $delete->where(
                self::PK . ' = ' . $id
            );
            $select->limit(1)->where(self::PK . ' = ' . $id);
                    self::PK . '=' . $this->id
            $select->limit(1)->where(self::PK . ' = ' . $id);
                $update->set($data)->where(
                    self::PK . '=' . $this->id
                );
            $delete->where(
                self::PK . ' = ' . $id
            );
            $select->where(self::PK . ' = ' . $id);
            $delete->where(
                self::PK . ' = ' . $this->_id
            );
                $update->set($values)->where(
                    self::PK . '=' . $this->_id
                );
            )->where(self::PK . ' = ' . $this->_id);
            )->where(self::PK . ' = ' . $this->_id);
 * Copyright © 2011-2014 The Galette Team
 * @copyright 2011-2014 The Galette Team
 * @copyright 2011-2014 The Galette Team
                )->where('c.' . Adherent::PK . ' = ' . $this->login->id);
            $delete->where(
                Adherent::PK . ' = ' . $adh->id
            );
                    )->where('m.' . Adherent::PK . ' = ' . $login->id);
                    $subselect->where('df.field_form = \'adh\'');
                    $subselect->where('df.field_id = ' . $df);
                    '(g.' . Group::PK . ' = ' . $this->filters->group_filter .
Fixed code:  * Copyright © 2011-2021 The Galette Team
 * @copyright 2011-2021 The Galette Team
 * @copyright 2011-2021 The Galette Team
                    $select->where(['test_id' => 1]);
                    $where[$k] = $row->$k;
 * Copyright © 2009-2021 The Galette Team
 * @copyright 2009-2021 The Galette Team
 * @copyright 2009-2021 The Galette Team
        $select->where([self::PK => $this->db_id]);
            $select->where(['mailing_id' => $id]);
            $update->where([self::PK => $this->mailing->history_id]);
 * Copyright © 2003-2021 The Galette Team
 * @copyright 2003-2021 The Galette Team
 * @copyright 2009-2021 The Galette Team
            $delete->where([self::PK => $id_adh]);
 * Copyright © 2006-2021 The Galette Team
 * @copyright 2006-2021 The Galette Team
 * @copyright 2006-2021 The Galette Team
            $delete->where([$class::PK => $this->db_id]);
            $select->where(['field_id' => $id]);
            $select->where([self::PK => $id]);
                $update->set($values)->where([self::PK => $this->id]);
            )->where(['parent_id' => $this->_id]);
            $select->where([self::PK => $id]);
            )->where([self::PK => $id_adh]);
                            $select->where->notEqualTo(
                                self::PK,
                                $this->_id
                                $select->where->notEqualTo(
                                    self::PK,
                                    $this->_id
                    $select->where([Status::PK => $value]);
                $update->where([self::PK => $this->_id]);
            )->where([self::PK => $this->_id]);
            )->where([Adherent::PK => $this->_member])
                $select->where->notEqualTo(self::PK, $this->id);
                $update->set($values)->where([self::PK => $this->_id]);
                [Adherent::PK => $this->_member]
            $delete->where([self::PK => $this->_id]);
                [Adherent::PK => $member_id]
                    [self::PK => $contrib_id]
            )->where([self::PK => $contrib_id]);
            $select->where([$this->fpk => $id]);
            $select->where([$this->fpk => $id]);
            $update->where([$this->fpk => $id]);
            $delete->where([$this->fpk => $id]);
            $select->where([$this->fpk => $id]);
                )->where([
                    'g.' . self::PK => $this->id
                ])->order(
                )->where(['b.' . Adherent::PK => $this->login->id]);
            $select->where(['parent_group' => $this->id])
                $delete->where([self::PK => $this->id]);
                $delete->where([self::PK => $this->id]);
            $delete->where([self::PK => $this->id]);
                [self::PK => $this->id]
                    ->where([self::PK => $this->id]);
            $delete->where([self::PK => $this->id]);
            $delete->where([self::PK => $this->id]);
                $update->where([self::PK => $this->id]);
            $select->limit(1)->where([self::PK => $id]);
                $update->set($data)->where([self::PK => $this->id]);
            $delete->where([self::PK => $id]);
                ->where([self::PK => $id]);
                    [self::PK => $this->id]
                ->where([self::PK => $id]);
            $select->limit(1)->where([self::PK => $id]);
                $select->where([Adherent::PK => $this->login->id]);
            $delete->where([self::PK => $id]);
            $select->limit(1)->where([self::PK => $id]);
                    [self::PK => $this->id]
            $select->limit(1)->where([self::PK => $id]);
                $update->set($data)->where([self::PK => $this->id]);
            $delete->where([self::PK => $id]);
            $select->where([self::PK => $id]);
            $delete->where([self::PK => $this->_id]);
                $update->set($values)->where([self::PK => $this->_id]);
            )->where([self::PK => $this->_id]);
            )->where([self::PK => $this->_id]);
 * Copyright © 2011-2021 The Galette Team
 * @copyright 2011-2021 The Galette Team
 * @copyright 2011-2021 The Galette Team
                )->where(['c.' . Adherent::PK => $this->login->id]);
            $delete->where([Adherent::PK => $adh->id]);
                    )->where(['m.' . Adherent::PK => $login->id]);
                    $subselect->where(['df.field_form' => 'adh']);
                    $subselect->where(['df.field_id' => $df]);
                    '(g.' . Group::PK . ' = ' . $zdb->platform->quoteValue($this->filters->group_filter) .