CVE-2017-6087: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2017-03-24T14:59Z
Repository: https://github.com/EyesOfNetworkCommunity/eonweb
Language: PHP
Files changed: include/arrays.php, include/function.php, module/admin_bp/php/auto_completion.php, module/admin_bp/php/function_bp.php, module/admin_user/search.php, module/index.php, module/monitoring_ged/ajax.php, module/monitoring_ged/ged_actions.php, module/monitoring_ged/ged_functions.php
Commit date: 2016-10-27 09:33:52 +0200
Commit message: Fix vulnerabilities

Diff: diff --git a/include/arrays.php b/include/arrays.php
index d365596..f47f879 100644
--- a/include/arrays.php
+++ b/include/arrays.php
@@ -35,10 +35,12 @@ $array_msg = array (
 	8 => "EON - User / Group ",
 	9 => "EON - Graph ",
 	10 => "EON - Name Error",
 	11 => "EON - GED");
 
+$array_modules = array ("glpi","ocsinventory-reports");
+	
 $array_tools = array (
 	"snmpwalk"		 => "tools/snmpwalk.php",
 	"show interface" => "tools/interface.php",
 	"show port" 	 => "tools/port.php");
 
@@ -58,10 +60,12 @@ $array_bp_mgt = array (
 	"delete on cascade" => "cascade_delete",
 	"delete all" 		=> "delete_all",
 	"duplicate" 		=> "duplicate",
 	"back-up file" 		=> "backup");
 
+$array_ged_queues = array("active","sync","history");
+		
 $array_ged_types = array(
 	0 => "label.all",
 	1 => "services",
 	2 => "snmp trap",
 	/* 3 => "performances"); */
diff --git a/include/function.php b/include/function.php
index 8f93817..7194cbf 100644
--- a/include/function.php
+++ b/include/function.php
@@ -61,11 +61,11 @@ function message($id, $text, $type){
 			<i class='fa ".$alert_icon."'></i> $tempid $text
 		  </p>";
 }
 
 // Connect to Database
-function sqlrequest($database,$sql,$id=false){
+function sqlrequest($database,$sql,$id=false,$prepare=false){
 
 	// Get the global value
 	global $database_host;
 	global $database_username;
 	global $database_password;
@@ -81,12 +81,26 @@ function sqlrequest($database,$sql,$id=false){
 
 	if ( $database == "eonweb" ) {
 		// Force UTF-8
 		mysqli_query($connexion, "SET NAMES 'utf8'");
 	}
-	$result=mysqli_query($connexion, "$sql");
-
+	
+	if(is_array($prepare)) {
+		$stmt = mysqli_prepare($connexion,$sql);
+		
+		if(isset($prepare[0]) && isset($prepare[1])) {
+			$ref = new ReflectionClass('mysqli_stmt');
+			$method = $ref->getMethod("bind_param");
+			$method->invokeArgs($stmt,$prepare);
+		}
+		
+		mysqli_stmt_execute($stmt);
+		$result = mysqli_stmt_get_result($stmt);
+	} else {
+		$result=mysqli_query($connexion, "$sql");
+	}
+		
 	if($id==true)
 		$result=mysqli_insert_id($connexion);
 		
 	mysqli_close($connexion);
 	return $result;
diff --git a/module/admin_bp/php/auto_completion.php b/module/admin_bp/php/auto_completion.php
index ca0347a..f7b42ec 100644
--- a/module/admin_bp/php/auto_completion.php
+++ b/module/admin_bp/php/auto_completion.php
@@ -1,20 +1,24 @@
 <?php
-  // Mot tapé par l'utilisateur
-  $q = $_GET['query'];
-	$table_name = $_GET['table_name'];
 
-    try {
-        $bdd = new PDO('mysql:host=localhost;dbname=lilac', 'root', 'root66');
-    } catch(Exception $e) {
-		 echo "Connection failed: " . $e->getMessage();
-        exit('Impossible de se connecter à la base de données.');
-    }
+include("../../../include/config.php");
 
-    // Requête SQL
-    $requete = "SELECT name FROM " . $table_name .  " WHERE name LIKE '". $q ."%' LIMIT 0, 10";
+// Mot tapé par l'utilisateur
+$q = $_GET['query'];
+$table_name = $_GET['table_name'];
+
+try {
+	$bdd = new PDO('mysql:host=localhost;dbname='.$database_lilac, $database_username, $database_password);
+} catch(Exception $e) {
+	 echo "Connection failed: " . $e->getMessage();
+	exit('Impossible de se connecter à la base de données.');
+}
+
+// Requête SQL
+$requete = "SELECT name FROM " . $table_name .  " WHERE name LIKE '". $q ."%' LIMIT 0, 10";
+
+foreach  ($bdd->query($requete) as $row) {
+	$suggestions['suggestions'][] = $row['name'];
+}
+echo json_encode($suggestions);
 
-	foreach  ($bdd->query($requete) as $row) {
-		$suggestions['suggestions'][] = $row['name'];
-	}
-    echo json_encode($suggestions);
 ?>
diff --git a/module/admin_bp/php/function_bp.php b/module/admin_bp/php/function_bp.php
index c550b7b..3fe12c2 100644
--- a/module/admin_bp/php/function_bp.php
+++ b/module/admin_bp/php/function_bp.php
@@ -1,7 +1,9 @@
 <?php
 
+include("../../../include/config.php");
+
 $action = isset($_GET['action']) ? $_GET['action'] : false;
 $bp_name = isset($_GET['bp_name']) ? $_GET['bp_name'] : false;
 $host_name = isset($_GET['host_name']) ? $_GET['host_name'] : false;
 $service = isset($_GET['service']) ? $_GET['service'] : false;
 $new_services = isset($_GET['new_services']) ? $_GET['new_services'] : false;
@@ -14,11 +16,11 @@ $url = isset($_GET['url']) ? $_GET['url'] : false;
 $command = isset($_GET['command']) ? $_GET['command'] : false;
 $type = isset($_GET['type']) ? $_GET['type'] : false;
 $min_value = isset($_GET['min_value']) ? $_GET['min_value'] : false;
 
 try {
-	$bdd = new PDO('mysql:host=localhost;dbname=nagiosbp', 'root', 'root66');
+	$bdd = new PDO('mysql:host=localhost;dbname='.$database_nagios, $database_username, $database_password);
 } catch(Exception $e) {
 	echo "Connection failed: " . $e->getMessage();
 	exit('Impossible de se connecter à la base de données.');
 }
 
@@ -71,21 +73,25 @@ function verify_services($bp,$host,$bdd){
 
 	echo $bp . "::" . $host . "::" . $number_services . "::" . $service;
 }
 
 function delete_bp($bp,$bdd){
-    $sql = "delete from bp where name = '" . $bp . "'";
-    $bdd->exec($sql);
+	$sql = "delete from bp where name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp));
 
-	$sql = "delete from bp_services where bp_name = '" . $bp . "'";
-    $bdd->exec($sql);
+	$sql = "delete from bp_services where bp_name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp));
 
-	$sql = "delete from bp_links where bp_name = '" . $bp . "'";
-	$bdd->exec($sql);
+	$sql = "delete from bp_links where bp_name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp));
 	
-	$sql = "delete from bp_links where bp_link = '" . $bp . "'";
-	$bdd->exec($sql);
+	$sql = "delete from bp_links where bp_link = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp));
 }
 
 function list_services($host_name){
 	$path_nagios_ser = "/srv/eyesofnetwork/nagios/etc/objects/services.cfg";
 
@@ -110,12 +116,13 @@ function list_services($host_name){
 	array_unshift($tabServices['service'],"Hoststatus");
 	echo json_encode($tabServices);
 }
 
 function list_process($bp,$display,$bdd){
-	$sql = "select name from bp where is_define = 1 and name!='".$bp."' and priority = '" . $display . "'";
-	$req = $bdd->query($sql);
+	$sql = "select name from bp where is_define = 1 and name!=? and priority = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp,$display));
 	$process = $req->fetchall();
 
     echo json_encode($process);
 }
 
@@ -128,63 +135,69 @@ function add_services($bp,$services,$bdd){
 			$value = explode("::", $values);
 			$service = $value[1];
 			$list_services[] = $service;
 		}
 	}
-	$sql = "select service,host from bp_services where bp_name = '" . $bp . "'";
-	$req = $bdd->query($sql);
 
-	$sql = "delete from bp_services where bp_name = '" . $bp . "'";
-	$bdd->exec($sql);
+	$sql = "delete from bp_services where bp_name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp));
 
 	if(count($services) > 0){
-		$sql = "update bp set is_define = 1 where name = '" . $bp . "'";
-		$bdd->exec($sql);
+		$sql = "update bp set is_define = 1 where name = ?";
+		$req = $bdd->prepare($sql);
+		$req->execute(array($bp));
 	}
-
 	else{
-		$sql = "update bp set is_define = 0 where name = '" . $bp . "'";
-        $bdd->exec($sql);
+		$sql = "update bp set is_define = 0 where name = ?";
+		$req = $bdd->prepare($sql);
+		$req->execute(array($bp));
     }
 
 	if(is_array($services)) {
 		foreach($services as $values){
 			$value = explode("::", $values);
 			$host = $value[0];
 			$service = $value[1];
 			echo $service;
-			$sql = "insert into bp_services (bp_name,host,service) values('" . trim($bp) . "','" . $host . "','" . $service . "')";
-			$bdd->exec($sql);
+			$sql = "insert into bp_services (bp_name,host,service) values(?,?,?)";
+			$req = $bdd->prepare($sql);
+			$req->execute(array(trim($bp),$host,$service));
 		}
 	}
 }
 
 function add_process($bp,$process,$bdd){
-    $sql = "delete from bp_links where bp_name = '" . $bp . "'";
-    $bdd->exec($sql);
-	$sql = "update bp set is_define = 0 where name = '" . $bp . "'";
-	$bdd->exec($sql);	
+	$sql = "delete from bp_links where bp_name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp));
+	$sql = "update bp set is_define = 0 where name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp));
 
     if(count($process) > 0 and is_array($process)){
-        $sql = "update bp set is_define = 1 where name = '" . $bp . "'";
-        $bdd->exec($sql);
+		$sql = "update bp set is_define = 1 where name = ?";
+		$req = $bdd->prepare($sql);
+		$req->execute(array($bp));
 	
 		foreach($process as $values){
 			$value = explode("::", $values);
 			$bp_link = $value[1];
 
-			$sql = "insert into bp_links (bp_name,bp_link) values('" . $bp . "','" . $bp_link . "')";
+			$sql = "insert into bp_links (bp_name,bp_link) values(?,?)";
 
-			$bdd->exec($sql);
+			$req = $bdd->prepare($sql);
+			$req->execute(array($bp,$bp_link));
 		}	
 	}
 }
 
 function check_app_exists($uniq_name, $bdd)
 {
-	$sql = "select count(*) from bp where name = '" . $uniq_name . "';";
-	$req = $bdd->query($sql);
+	$sql = "select count(*) from bp where name = ?;";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($uniq_name));
 	$bp_exist = $req->fetch(PDO::FETCH_NUM);
 	
 	if($bp_exist[0] == 1){
 		echo "true";
 	} else {
@@ -194,38 +207,45 @@ function check_app_exists($uniq_name, $bdd)
 
 function add_application($uniq_name_orig,$uniq_name,$process_name,$display,$url,$command,$type,$min_value,$bdd){
 	if($type != 'MIN'){
 		$min_value = "";
 	}
-	$sql = "select count(*) from bp where name = '" . $uniq_name . "';";
-	$req = $bdd->query($sql);
+	$sql = "select count(*) from bp where name = ?;";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($uniq_name));
 	$bp_exist = $req->fetch();
 
 	// add
 	if($bp_exist[0] == 0 and empty($uniq_name_orig)){
-		$sql = "insert into bp (name,description,priority,type,command,url,min_value) values('" . $uniq_name ."','" . $process_name ."','" . $display . "','" . $type . "','" . $command . "','" . $url . "','" . $min_value . "')";
-		$bdd->exec($sql);
+		$sql = "insert into bp (name,description,priority,type,command,url,min_value) values(?,?,?,?,?,?,?)";
+		$req = $bdd->prepare($sql);
+		$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value));
 	}
 	// uniq name modification
 	elseif($uniq_name_orig != $uniq_name) {
 		if($bp_exist[0] != 0){
 			// TODO QUENTIN
 		} else {
-			$sql = "update bp set name = '" . $uniq_name . "',description = '" . $process_name . "',priority = '" . $display . "',type = '" . $type . "',command = '" . $command . "',url = '" . $url . "',min_value = '" . $min_value . "' where name = '" . $uniq_name_orig . "'";
-			$bdd->exec($sql);
-			$sql = "update bp_links set bp_name = '" . $uniq_name . "' where bp_name = '" . $uniq_name_orig . "'";
-			$bdd->exec($sql);		
-			$sql = "update bp_links set bp_link = '" . $uniq_name . "' where bp_link = '" . $uniq_name_orig . "'";
-			$bdd->exec($sql);
-			$sql = "update bp_services set bp_name = '" . $uniq_name . "' where bp_name = '" . $uniq_name_orig . "'";					
-			$bdd->exec($sql);		
+			$sql = "update bp set name = ?,description = ?,priority = ?,type = ?,command = ?,url = ?,min_value = ? where name = ?";
+			$req = $bdd->prepare($sql);
+			$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value,$uniq_name_orig));
+			$sql = "update bp_links set bp_name = ? where bp_name = ?";
+			$req = $bdd->prepare($sql);
+			$req->execute(array($uniq_name,$uniq_name_orig));	
+			$sql = "update bp_links set bp_link = ? where bp_link = ?";
+			$req = $bdd->prepare($sql);
+			$req->execute(array($uniq_name,$uniq_name_orig));
+			$sql = "update bp_services set bp_name = ? where bp_name = ?";					
+			$req = $bdd->prepare($sql);
+			$req->execute(array($uniq_name,$uniq_name_orig));	
 		}
 	}	
 	// modification
 	else{
-		$sql = "update bp set name = '" . $uniq_name . "',description = '" . $process_name . "',priority = '" . $display . "',type = '" . $type . "',command = '" . $command . "',url = '" . $url . "',min_value = '" . $min_value . "' where name = '" . $uniq_name . "'";
-		$bdd->exec($sql);	
+		$sql = "update bp set name = ?,description = ?,priority = ?,type = ?,command = ?,url = ?,min_value = ? where name = ?";
+		$req = $bdd->prepare($sql);
+		$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value,$uniq_name));
 	}
 }
 
 function build_file($bdd){
 	
@@ -250,20 +270,22 @@ function build_file($bdd){
 	fclose($bp_file);
 }
 
 function build_file_recursive($bdd,$bp_file,$bp_informations,$bp_sons){
 
-	$sql = "SELECT bp_link FROM bp_links where bp_name='".$bp_informations['name']."'";
-	$req = $bdd->query($sql);
+	$sql = "SELECT bp_link FROM bp_links where bp_name=?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp_informations['name']));
 	if($req->rowCount() == 0) {
 		$bp_sons[]=$bp_informations['name'];
 		build_file_bp($bdd,$bp_file, $bp_informations);
 	} else {
 		$bp_links = $req->fetchall();
 		foreach($bp_links as $bp_link){
-			$sql = "SELECT * FROM bp where is_define ='1' and name='".$bp_link["bp_link"]."'";
-			$req = $bdd->query($sql);
+			$sql = "SELECT * FROM bp where is_define ='1' and name=?";
+			$req = $bdd->prepare($sql);
+			$req->execute(array($bp_link["bp_link"]));
 			$bps_sons_informations = $req->fetchall();
 			foreach($bps_sons_informations as $bp_sons_informations){
 				if(!in_array($bp_sons_informations['name'],$bp_sons,true)) {
 					$bp_sons=build_file_recursive($bdd,$bp_file,$bp_sons_informations,$bp_sons);
 				}
@@ -285,12 +307,13 @@ function build_file_bp($bdd,$bp_file, $bp_informations){
 	}
 	else{
 		$type = "+";
 		fputs($bp_file, $bp_informations['min_value'] . " of: ");
 	}
-	$sql = "select host,service from bp_services where bp_name = '" . $bp_informations['name'] . "'";
-	$req = $bdd->query($sql);
+	$sql = "select host,service from bp_services where bp_name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp_informations['name']));
 	$host_services = $req->fetchall();
 
 	$counter1 = count($host_services);
 	$counter2 = 0;
 
@@ -301,12 +324,13 @@ function build_file_bp($bdd,$bp_file, $bp_informations){
 		if($counter2 < $counter1){
 			fputs($bp_file, " " . $type . " ");
 		}
 	}
 
-	$sql = "select bp_link from bp_links where bp_name = '" .$bp_informations['name'] . "'";
-	$req = $bdd->query($sql);
+	$sql = "select bp_link from bp_links where bp_name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp_informations['name']));
 	$link_informations = $req->fetchall();
 
 	$counter1 = count($link_informations);
 	$counter2 = 0;
 
@@ -331,12 +355,13 @@ function build_file_bp($bdd,$bp_file, $bp_informations){
 		fputs($bp_file, "external_info " . $bp_informations['name'] . ";" . $bp_informations['command'] . "\n");
 	}
 }
 
 function info_application($bp_name, $bdd){
-	$sql = "select * from bp where name = '" . $bp_name . "'";
-	$req = $bdd->query($sql);
+	$sql = "select * from bp where name = ?";
+	$req = $bdd->prepare($sql);
+	$req->execute(array($bp_name));
 	$info = $req->fetch();
 	echo json_encode($info);
 }
 
 ?>
diff --git a/module/admin_user/search.php b/module/admin_user/search.php
index 6722c91..b5a6364 100644
--- a/module/admin_user/search.php
+++ b/module/admin_user/search.php
@@ -23,11 +23,12 @@
 include("../../include/config.php");
 include("../../include/function.php");
 
 // Search function for Jquery an exit
 if(isset($_GET['term']) && isset($_GET['request']) && $_GET['request'] == "search_user") {
-	$result=sqlrequest($database_eonweb,"select * from ldap_users_extended where (user LIKE '%".$_GET['term']."%') OR (login LIKE '%".$_GET['term']."%') order by user");
+	$sql="select * from ldap_users_extended where (user LIKE ?) OR (login LIKE ?) order by user";
+	$result=sqlrequest($database_eonweb,$sql,false,array("ss","%".$_GET['term']."%","%".$_GET['term']."%"));
 	
 	$array = array();
 	while ($line = mysqli_fetch_array($result)){
 		array_push($array, $line[0]);
 	}
diff --git a/module/index.php b/module/index.php
index 49b30a8..9a60c95 100644
--- a/module/index.php
+++ b/module/index.php
@@ -21,14 +21,18 @@
 */
 
 # Check optionnal module to load
 if(isset($_GET["module"]) && isset($_GET["link"])) { 
 
-	$module=exec("rpm -q ".$_GET["module"]." |grep '.eon' |wc -l");
+	include("../include/config.php");
+	include("../include/arrays.php");
 	
-	# Redirect to module page if rpm installed
-	if($module!=0) { header('Location: '.$_GET["link"].''); }
+	if(in_array($_GET["module"],$array_modules)) {
+		$module=exec("rpm -q ".$_GET["module"]." |grep '.eon' |wc -l");
+		# Redirect to module page if rpm installed
+		if($module!=0) { header('Location: '.$_GET["link"].''); }
+	}
 
 } 
 	
 include("../header.php"); 
 include("../side.php"); 
diff --git a/module/monitoring_ged/ajax.php b/module/monitoring_ged/ajax.php
index a93cd2a..6dca5d5 100644
--- a/module/monitoring_ged/ajax.php
+++ b/module/monitoring_ged/ajax.php
@@ -24,10 +24,12 @@ include("../../include/config.php");
 include("../../include/arrays.php");
 include("../../include/function.php"); 
 include("ged_functions.php");
 
 extract($_GET);
+if(!isset($queue)) { $queue="active"; } 
+elseif(!in_array($queue,$array_ged_queues)) { $queue="active"; }
 
 // get all GED filters
 $default = "";
 $file="../../cache/".$_COOKIE["user_name"]."-ged.xml";
 if(file_exists($file)){
@@ -60,20 +62,23 @@ if(file_exists($file)){
 				</tr>
 			</thead>
 			<tbody>
 				<?php
 					if($_GET["type"] == 0){
-						$ged_where = "WHERE pkt_type_id!='0'";
+						$sql = "SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id!='0' AND pkt_type_id<'100';";
+						$gedsql_result1=sqlrequest($database_ged,$sql);
 					} else {
-						$ged_where = "WHERE pkt_type_id='".$_GET["type"]."'";
+						$sql = "SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id=? AND pkt_type_id<'100';";
+						$prepare=array("i",(int)$_GET["type"]);
+						$gedsql_result1=sqlrequest($database_ged,$sql,false,$prepare);
 					}
-					$gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type $ged_where AND pkt_type_id<'100';");
-					
+										
 					while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
 
 						// request for ged events according to queue and filters
 						$sql = createSelectClause($ged_type["pkt_type_name"], $queue);
+						$mysqli_prepare=array("");
 						
 						// time periods (only in active events);
 						if($time_period != ""){
 							// define all times needed (for each range)
 							$actual_time = time();
@@ -82,29 +87,44 @@ if(file_exists($file)){
 							$thirty_minutes = $actual_time - (60 * 30);
 							$one_hour = $actual_time - (60 * 60);
 
 							switch ($time_period) {
 								case '0-5m':
-									$sql .= " AND o_sec <= ". $actual_time ." AND o_sec > ". $five_minutes;
+									$sql .= " AND o_sec <= ? AND o_sec > ?";
+									$mysqli_prepare[0].="ii";
+									$mysqli_prepare[]=(int)$actual_time;
+									$mysqli_prepare[]=(int)$five_minutes;
 									break;
 								case '5-15m':
-									$sql .= " AND o_sec <= ". $five_minutes ." AND o_sec > ". $fifteen_minutes;
+									$sql .= " AND o_sec <= ? AND o_sec > ?";
+									$mysqli_prepare[0].="ii";
+									$mysqli_prepare[]=(int)$five_minutes;
+									$mysqli_prepare[]=(int)$fifteen_minutes;
 									break;
 								case '15-30m':
-									$sql .= " AND o_sec <= ". $fifteen_minutes ." AND o_sec > ". $thirty_minutes;
+									$sql .= " AND o_sec <= ? AND o_sec > ?";
+									$mysqli_prepare[0].="ii";
+									$mysqli_prepare[]=(int)$fifteen_minutes;
+									$mysqli_prepare[]=(int)$thirty_minutes;
 									break;
 								case '30m-1h':
-									$sql .= " AND o_sec <= ". $thirty_minutes ." AND o_sec > ". $one_hour;
+									$sql .= " AND o_sec <= ? AND o_sec > ?";
+									$mysqli_prepare[0].="ii";
+									$mysqli_prepare[]=(int)$thirty_minutes;
+									$mysqli_prepare[]=(int)$one_hour;
 									break;
 								case 'more':
-									$sql .= " AND o_sec <= ". $one_hour;
+									$sql .= " AND o_sec <= ?";
+									$mysqli_prepare[0].="i";
+									$mysqli_prepare[]=(int)$one_hour;
 									break;
 							}
 						}
 
 						if($ack_time != ""){
-							$sql .= " AND a_sec - o_sec >= $ack_time";
+							$sql .= " AND a_sec - o_sec >= ?";
+							$mysqli_prepare=array("i",(int)$ack_time);
 						}
 
 						// if there's a default filter
 						$array_filters = [];
 						if($default!=""){
@@ -130,23 +150,27 @@ if(file_exists($file)){
 									$like .= trim($value, '*');
 									if ( substr($value, -1) === '*' ) {
 										$like .= "%";
 									}
 									if($sqlcpt=="0") {
-										$sql .= " AND ($key LIKE '$like'";
+										$sql .= " AND ($key LIKE ?";
+										$mysqli_prepare[0].="s";
+										$mysqli_prepare[]=(string)$like;
 									} else {
-										$sql .= " OR $key LIKE '$like'";
+										$sql .= " OR $key LIKE ?";
+										$mysqli_prepare[0].="s";
+										$mysqli_prepare[]=(string)$like;
 									}
 									$sqlcpt++;
 								}
 							}
 							$sql .= ")";
 						}
 
 						$sql .= createWhereClause($owner,$filter,$search,$daterange,$ok,$warning,$critical,$unknown);
 
-						$request = sqlrequest($database_ged, $sql);
+						$request = sqlrequest($database_ged, $sql, false, $mysqli_prepare);
 						while($event = mysqli_fetch_object($request)){
 							$event_state = getEventState($event);
 							$row_class = getClassRow($event_state);
 
 							echo '<tr class="'.$row_class.'" name="'.$ged_type["pkt_type_name"].'">';
diff --git a/module/monitoring_ged/ged_actions.php b/module/monitoring_ged/ged_actions.php
index 9e2eb43..02e2156 100644
--- a/module/monitoring_ged/ged_actions.php
+++ b/module/monitoring_ged/ged_actions.php
@@ -25,10 +25,12 @@ include("../../include/arrays.php");
 include("../../include/function.php"); 
 include("ged_functions.php");
 
 // create variables from $_GET
 extract($_GET);
+if(!isset($queue)) { $queue="active"; } 
+elseif(!in_array($queue,$array_ged_queues)) { $queue="active"; }
 
 if(isset($action) && $action != "" && (isset($selected_events) && count($selected_events) > 0) || isset($filter_name) || isset($filter) ){
 	switch ($action) {
 		case "0":
 			details($selected_events, $queue);
diff --git a/module/monitoring_ged/ged_functions.php b/module/monitoring_ged/ged_functions.php
index 0199b80..2dcfd51 100644
--- a/module/monitoring_ged/ged_functions.php
+++ b/module/monitoring_ged/ged_functions.php
@@ -47,12 +47,15 @@ function getClassRow($event_state)
 	return $row_class;
 }
 
 function createTableRow($event, $event_state, $queue)
 {
+	global $array_ged_queues;
 	global $dateformat;
 	global $ged_prefix;
+
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
 	
 	foreach ($event as $key => $value) {
 		$class = "";
 
 		if($key == "equipment"){
@@ -94,13 +97,16 @@ function createTableRow($event, $event_state, $queue)
 	}	
 }
 
 function createSelectClause($ged_type, $queue)
 {
+	global $array_ged_queues; 
 	global $array_ged_packets;
 	global $database_ged;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+
 	$sql = "SELECT id,";
 	foreach ($array_ged_packets as $key => $value) {
 		if($value["col"] == true){
 			if(isset($value["db_col"])){
 				$sql .= $value["db_col"].',';
@@ -117,10 +123,13 @@ function createSelectClause($ged_type, $queue)
 	return $sql;
 }
 
 function createWhereClause($owner, $filter, $search, $daterange, $ok, $warning, $critical, $unknown)
 {
+	
+	global $mysqli_prepare;
+	
 	$where_clause = "";
 	
 	// owner
 	if($owner == "owned"){ $where_clause .= " AND owner != ''"; }
 	elseif($owner == "not owned"){ $where_clause .= " AND owner = ''"; }
@@ -134,11 +143,13 @@ function createWhereClause($owner, $filter, $search, $daterange, $ok, $warning,
 		$like .= trim($search, '*');
 		if ( substr($search, -1) === '*' ) {
 			$like .= "%";
 		}
 
-		$where_clause .= " AND $filter LIKE '$like'";
+		$where_clause .= " AND $filter LIKE ?";
+		$mysqli_prepare[0].="s";
+		$mysqli_prepare[]=(string)$like;
 	}
 
 	// daterange
 	if($daterange != ""){
 		$daterange_parts = explode(" - ", $daterange);
@@ -149,19 +160,22 @@ function createWhereClause($owner, $filter, $search, $daterange, $ok, $warning,
 		// perhaps a little bug from DateRangePicker
 		$start = strtotime($start);
 		$start += 3600;
 		$end = strtotime($end);
 		$end += 86400 + 3600;
-		$where_clause .= " AND o_sec > $start AND o_sec < $end";
+		$where_clause .= " AND o_sec > ? AND o_sec < ?";
+		$mysqli_prepare[0].="ii";
+		$mysqli_prepare[]=(int)$start;
+		$mysqli_prepare[]=(int)$end;
 	}
 
 	// states
 	$states_list = "";
-	if($ok != "")		{ $states_list .= "0,"; }
-	if($warning != "")	{ $states_list .= "1,"; }
-	if($critical != "")	{ $states_list .= "2,"; }
-	if($unknown != "")	{ $states_list .= "3,"; }
+	if($ok != "")		{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=0; }
+	if($warning != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=1; }
+	if($critical != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=2; }
+	if($unknown != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=3; }
 	$states_list = trim($states_list, ",");
 	
 	if($states_list != ""){
 		$where_clause .= " AND state IN ($states_list)";
 	}
@@ -201,19 +215,22 @@ function createDetailRow($event, $db_col_name, $row_name)
 	echo '</tr>';
 }
 
 function details($selected_events, $queue)
 {
+	global $array_ged_queues; 
 	global $database_ged;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+
 	// get all needed infos into variables
 	$value_parts = explode(":", $selected_events);
 	$id = $value_parts[0];
 	$ged_type = $value_parts[1];
 
-	$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
-	$result = sqlrequest($database_ged, $sql);
+	$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
+	$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
 	$event = mysqli_fetch_assoc($result);
 
 	// display event's details
 	echo '<table class="table table-hover table-condensed">';
 		echo '<tbody>';
@@ -236,24 +253,24 @@ function details($selected_events, $queue)
 	echo '</table>';
 }
 
 function edit($selected_events, $queue)
 {
+	global $array_ged_queues; 
 	global $database_ged;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+
 	// get all needed infos into variables
 	$value_parts = explode(":", $selected_events);
 	$id = $value_parts[0];
 	$ged_type = $value_parts[1];
 
-	$sql = "SELECT comments FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
-	$result = sqlrequest($database_ged, $sql);
+	$sql = "SELECT comments FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
+	$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
 	$event = mysqli_fetch_assoc($result);
 
-	$event["comments"] = str_replace("\'", "'", $event["comments"]);
-	$event["comments"] = str_replace("\#", "#'", $event["comments"]);
-
 	echo "
 	<form id='edit-event-form'>
 		<div class='form-group'>
 			<label>".getLabel("label.add_comment")."</label>
 			<textarea id='event-comments' class='form-control textarea' rows='10'>".$event["comments"]."</textarea>
@@ -261,47 +278,45 @@ function edit($selected_events, $queue)
 	</form>";
 }
 
 function editEvent($selected_events, $queue, $comments)
 {
+	global $array_ged_queues;
 	global $database_ged;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+	
 	// get all needed infos into variables
 	$value_parts = explode(":", $selected_events);
 	$id = $value_parts[0];
 	$ged_type = $value_parts[1];
 
-	// format comment string to avoid errors
-	$comments = str_replace("'", "\'", $comments);
-	$comments = str_replace("#", "\#", $comments);
-
-	$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments='$comments' WHERE id = $id";
-	$result = sqlrequest($database_ged, $sql);
+	$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments=? WHERE id = ?";
+	$result = sqlrequest($database_ged, $sql, false, array("ss",(string)$comments,(string)$id));
 	if($result){
 		message(11, " : ".getLabel("message.event_edited"), "ok");
 	} else {
 		message(11, " : ".getLabel("message.event_edited_error"), "danger");
 	}
 }
 
 function editAllEvents($selected_events, $queue, $comments)
 {
+	global $array_ged_queues;
 	global $database_ged;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+	
 	$success = true;
 	foreach ($selected_events as $key => $value) {
 		// get all needed infos into variables
 		$value_parts = explode(":", $value);
 		$id = $value_parts[0];
 		$ged_type = $value_parts[1];
 
-		// format comment string to avoid errors
-		$comments = str_replace("'", "\'", $comments);
-		$comments = str_replace("#", "\#", $comments);
-
-		$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments='$comments' WHERE id = $id";
-		$result = sqlrequest($database_ged, $sql);
+		$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments=? WHERE id = ?";
+		$result = sqlrequest($database_ged, $sql, false, array("ss",(string)$comments,(string)$id));
 		if(!$result){
 			$success = false;
 		}
 	}
 
@@ -315,13 +330,16 @@ function editAllEvents($selected_events, $queue, $comments)
 
 function ownDisown($selected_events, $queue, $global_action)
 {
 	global $database_ged;
 	global $array_ged_packets;
+	global $array_ged_queues;
 	global $path_ged_bin;
 	global $array_serv_system;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+	
 	if(exec($array_serv_system["Ged agent"]["status"])==NULL) {
 		return message(0," : ged daemon must be dead","critical");
 	}
 
 	if($global_action == 2){
@@ -335,12 +353,12 @@ function ownDisown($selected_events, $queue, $global_action)
 		$id = $value_parts[0];
 		$ged_type = $value_parts[1];
 		if($ged_type == "nagios"){ $ged_type_nbr = 1; }
 		if($ged_type == "snmptrap"){ $ged_type_nbr = 2; }
 
-		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
-		$result = sqlrequest($database_ged, $sql);
+		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
+		$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
 		$event = mysqli_fetch_assoc($result);
 
 		$ged_command = "-update -type $ged_type_nbr ";
 		foreach ($array_ged_packets as $key => $value) {
 			if($value["type"] == true){
@@ -349,23 +367,27 @@ function ownDisown($selected_events, $queue, $global_action)
 				}
 				$ged_command .= "\"".$event[$key]."\" ";
 			}
 		}
 		$ged_command = trim($ged_command, " ");
-
+		$ged_command=escapeshellcmd($ged_command);
+		
 		shell_exec($path_ged_bin." ".$ged_command);
 		logging("ged_update",$ged_command);
 	}
 }
 
 function acknowledge($selected_events, $queue)
 {
+	global $array_ged_queues;
 	global $database_ged;
 	global $array_ged_packets;
 	global $path_ged_bin;
 	global $array_serv_system;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+	
 	if(exec($array_serv_system["Ged agent"]["status"])==NULL) {
 		return message(0," : ged daemon must be dead","critical");
 	}
 
 	$owner = $_COOKIE['user_name']."@".getenv("SERVER_NAME");
@@ -378,12 +400,12 @@ function acknowledge($selected_events, $queue)
 		if($ged_type == "snmptrap"){ $ged_type_nbr = 2; }
 
 		$event_to_delete = [];
 		array_push($event_to_delete, $value);
 
-		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
-		$result = sqlrequest($database_ged, $sql);
+		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
+		$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
 		$event = mysqli_fetch_assoc($result);
 
 		$ged_command = "-update -type $ged_type_nbr ";
 		foreach ($array_ged_packets as $key => $value) {
 			if($value["type"] == true){
@@ -392,24 +414,28 @@ function acknowledge($selected_events, $queue)
 				}
 				$ged_command .= "\"".$event[$key]."\" ";
 			}
 		}
 		$ged_command = trim($ged_command, " ");
-
+		$ged_command=escapeshellcmd($ged_command);
+		
 		shell_exec($path_ged_bin." ".$ged_command);
 		logging("ged_update",$ged_command);
 		delete($event_to_delete, $queue);
 	}
 }
 
 function delete($selected_events, $queue)
 {
+	global $array_ged_queues;
 	global $database_ged;
 	global $array_ged_packets;
 	global $path_ged_bin;
 	global $array_serv_system;
 
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
+	
 	if(exec($array_serv_system["Ged agent"]["status"])==NULL) {
 		return message(0," : ged daemon must be dead","critical");
 	}
 
 	$id_list = "";
@@ -431,22 +457,24 @@ function delete($selected_events, $queue)
 				if($value["key"] == true){
 					$ged_command .= "\"".$event[$key]."\" ";
 				}
 			}
 			$ged_command = trim($ged_command, " ");
-
+			$ged_command=escapeshellcmd($ged_command);
+					
 			shell_exec($path_ged_bin." ".$ged_command);
 			logging("ged_update",$ged_command);
 		} else {
 			$id_list .= $id.",";
 		}
 	}
 
 	if($queue == "history"){
 		$id_list = trim($id_list, ",");
 		$ged_command = "-drop -id ".$id_list." -queue history";
-
+		$ged_command=escapeshellcmd($ged_command);
+		
 		shell_exec($path_ged_bin." ".$ged_command);
 		logging("ged_update",$ged_command);
 	}
 }
 
@@ -480,28 +508,33 @@ function changeGedFilter($filter_name)
 }
 
 // advanced search autocomplete
 function advancedFilterSearch($queue, $filter)
 {
+	global $array_ged_packets;
+	global $array_ged_queues;
 	global $database_ged;
 	$datas = array();
+	
+	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
 
 	if($filter == "description"){
 		echo json_encode($datas);
 		return false;
 	}
 
 	$gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id!='0' AND pkt_type_id<'100';");
 	
-	
-	while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
-		$sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue;
-
-		$results = sqlrequest($database_ged, $sql);
-		while($result = mysqli_fetch_array($results)){
-			if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){
-				array_push($datas, $result[$filter]);
+	if(isset($array_ged_packets[$filter])) {
+		while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
+			$sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue;
+
+			$results = sqlrequest($database_ged, $sql);
+			while($result = mysqli_fetch_array($results)){
+				if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){
+					array_push($datas, $result[$filter]);
+				}
 			}
 		}
 	}
 
 	echo json_encode($datas);

Vulnerable code: function sqlrequest($database,$sql,$id=false){
	$result=mysqli_query($connexion, "$sql");

  // Mot tapé par l'utilisateur
  $q = $_GET['query'];
	$table_name = $_GET['table_name'];
    try {
        $bdd = new PDO('mysql:host=localhost;dbname=lilac', 'root', 'root66');
    } catch(Exception $e) {
		 echo "Connection failed: " . $e->getMessage();
        exit('Impossible de se connecter à la base de données.');
    }
    // Requête SQL
    $requete = "SELECT name FROM " . $table_name .  " WHERE name LIKE '". $q ."%' LIMIT 0, 10";
	foreach  ($bdd->query($requete) as $row) {
		$suggestions['suggestions'][] = $row['name'];
	}
    echo json_encode($suggestions);
	$bdd = new PDO('mysql:host=localhost;dbname=nagiosbp', 'root', 'root66');
    $sql = "delete from bp where name = '" . $bp . "'";
    $bdd->exec($sql);
	$sql = "delete from bp_services where bp_name = '" . $bp . "'";
    $bdd->exec($sql);
	$sql = "delete from bp_links where bp_name = '" . $bp . "'";
	$bdd->exec($sql);
	$sql = "delete from bp_links where bp_link = '" . $bp . "'";
	$bdd->exec($sql);
	$sql = "select name from bp where is_define = 1 and name!='".$bp."' and priority = '" . $display . "'";
	$req = $bdd->query($sql);
	$sql = "select service,host from bp_services where bp_name = '" . $bp . "'";
	$req = $bdd->query($sql);
	$sql = "delete from bp_services where bp_name = '" . $bp . "'";
	$bdd->exec($sql);
		$sql = "update bp set is_define = 1 where name = '" . $bp . "'";
		$bdd->exec($sql);

		$sql = "update bp set is_define = 0 where name = '" . $bp . "'";
        $bdd->exec($sql);
			$sql = "insert into bp_services (bp_name,host,service) values('" . trim($bp) . "','" . $host . "','" . $service . "')";
			$bdd->exec($sql);
    $sql = "delete from bp_links where bp_name = '" . $bp . "'";
    $bdd->exec($sql);
	$sql = "update bp set is_define = 0 where name = '" . $bp . "'";
	$bdd->exec($sql);	
        $sql = "update bp set is_define = 1 where name = '" . $bp . "'";
        $bdd->exec($sql);
			$sql = "insert into bp_links (bp_name,bp_link) values('" . $bp . "','" . $bp_link . "')";
			$bdd->exec($sql);
	$sql = "select count(*) from bp where name = '" . $uniq_name . "';";
	$req = $bdd->query($sql);
	$sql = "select count(*) from bp where name = '" . $uniq_name . "';";
	$req = $bdd->query($sql);
		$sql = "insert into bp (name,description,priority,type,command,url,min_value) values('" . $uniq_name ."','" . $process_name ."','" . $display . "','" . $type . "','" . $command . "','" . $url . "','" . $min_value . "')";
		$bdd->exec($sql);
			$sql = "update bp set name = '" . $uniq_name . "',description = '" . $process_name . "',priority = '" . $display . "',type = '" . $type . "',command = '" . $command . "',url = '" . $url . "',min_value = '" . $min_value . "' where name = '" . $uniq_name_orig . "'";
			$bdd->exec($sql);
			$sql = "update bp_links set bp_name = '" . $uniq_name . "' where bp_name = '" . $uniq_name_orig . "'";
			$bdd->exec($sql);		
			$sql = "update bp_links set bp_link = '" . $uniq_name . "' where bp_link = '" . $uniq_name_orig . "'";
			$bdd->exec($sql);
			$sql = "update bp_services set bp_name = '" . $uniq_name . "' where bp_name = '" . $uniq_name_orig . "'";					
			$bdd->exec($sql);		
		$sql = "update bp set name = '" . $uniq_name . "',description = '" . $process_name . "',priority = '" . $display . "',type = '" . $type . "',command = '" . $command . "',url = '" . $url . "',min_value = '" . $min_value . "' where name = '" . $uniq_name . "'";
		$bdd->exec($sql);	
	$sql = "SELECT bp_link FROM bp_links where bp_name='".$bp_informations['name']."'";
	$req = $bdd->query($sql);
			$sql = "SELECT * FROM bp where is_define ='1' and name='".$bp_link["bp_link"]."'";
			$req = $bdd->query($sql);
	$sql = "select host,service from bp_services where bp_name = '" . $bp_informations['name'] . "'";
	$req = $bdd->query($sql);
	$sql = "select bp_link from bp_links where bp_name = '" .$bp_informations['name'] . "'";
	$req = $bdd->query($sql);
	$sql = "select * from bp where name = '" . $bp_name . "'";
	$req = $bdd->query($sql);
	$result=sqlrequest($database_eonweb,"select * from ldap_users_extended where (user LIKE '%".$_GET['term']."%') OR (login LIKE '%".$_GET['term']."%') order by user");
	$module=exec("rpm -q ".$_GET["module"]." |grep '.eon' |wc -l");
	# Redirect to module page if rpm installed
	if($module!=0) { header('Location: '.$_GET["link"].''); }
						$ged_where = "WHERE pkt_type_id!='0'";
						$ged_where = "WHERE pkt_type_id='".$_GET["type"]."'";
					$gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type $ged_where AND pkt_type_id<'100';");
					
									$sql .= " AND o_sec <= ". $actual_time ." AND o_sec > ". $five_minutes;
									$sql .= " AND o_sec <= ". $five_minutes ." AND o_sec > ". $fifteen_minutes;
									$sql .= " AND o_sec <= ". $fifteen_minutes ." AND o_sec > ". $thirty_minutes;
									$sql .= " AND o_sec <= ". $thirty_minutes ." AND o_sec > ". $one_hour;
									$sql .= " AND o_sec <= ". $one_hour;
							$sql .= " AND a_sec - o_sec >= $ack_time";
										$sql .= " AND ($key LIKE '$like'";
										$sql .= " OR $key LIKE '$like'";
						$request = sqlrequest($database_ged, $sql);
		$where_clause .= " AND $filter LIKE '$like'";
		$where_clause .= " AND o_sec > $start AND o_sec < $end";
	if($ok != "")		{ $states_list .= "0,"; }
	if($warning != "")	{ $states_list .= "1,"; }
	if($critical != "")	{ $states_list .= "2,"; }
	if($unknown != "")	{ $states_list .= "3,"; }
	$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
	$result = sqlrequest($database_ged, $sql);
	$sql = "SELECT comments FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
	$result = sqlrequest($database_ged, $sql);
	$event["comments"] = str_replace("\'", "'", $event["comments"]);
	$event["comments"] = str_replace("\#", "#'", $event["comments"]);

	// format comment string to avoid errors
	$comments = str_replace("'", "\'", $comments);
	$comments = str_replace("#", "\#", $comments);

	$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments='$comments' WHERE id = $id";
	$result = sqlrequest($database_ged, $sql);
		// format comment string to avoid errors
		$comments = str_replace("'", "\'", $comments);
		$comments = str_replace("#", "\#", $comments);

		$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments='$comments' WHERE id = $id";
		$result = sqlrequest($database_ged, $sql);
		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
		$result = sqlrequest($database_ged, $sql);

		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
		$result = sqlrequest($database_ged, $sql);



	
	while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
		$sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue;

		$results = sqlrequest($database_ged, $sql);
		while($result = mysqli_fetch_array($results)){
			if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){
				array_push($datas, $result[$filter]);
Fixed code: $array_modules = array ("glpi","ocsinventory-reports");
	
$array_ged_queues = array("active","sync","history");
		
function sqlrequest($database,$sql,$id=false,$prepare=false){
	
	if(is_array($prepare)) {
		$stmt = mysqli_prepare($connexion,$sql);
		
		if(isset($prepare[0]) && isset($prepare[1])) {
			$ref = new ReflectionClass('mysqli_stmt');
			$method = $ref->getMethod("bind_param");
			$method->invokeArgs($stmt,$prepare);
		}
		
		mysqli_stmt_execute($stmt);
		$result = mysqli_stmt_get_result($stmt);
	} else {
		$result=mysqli_query($connexion, "$sql");
	}
		
include("../../../include/config.php");
// Mot tapé par l'utilisateur
$q = $_GET['query'];
$table_name = $_GET['table_name'];

try {
	$bdd = new PDO('mysql:host=localhost;dbname='.$database_lilac, $database_username, $database_password);
} catch(Exception $e) {
	 echo "Connection failed: " . $e->getMessage();
	exit('Impossible de se connecter à la base de données.');
}

// Requête SQL
$requete = "SELECT name FROM " . $table_name .  " WHERE name LIKE '". $q ."%' LIMIT 0, 10";

foreach  ($bdd->query($requete) as $row) {
	$suggestions['suggestions'][] = $row['name'];
}
echo json_encode($suggestions);
include("../../../include/config.php");

	$bdd = new PDO('mysql:host=localhost;dbname='.$database_nagios, $database_username, $database_password);
	$sql = "delete from bp where name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "delete from bp_services where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "delete from bp_links where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "delete from bp_links where bp_link = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "select name from bp where is_define = 1 and name!=? and priority = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp,$display));
	$sql = "delete from bp_services where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
		$sql = "update bp set is_define = 1 where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($bp));
		$sql = "update bp set is_define = 0 where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($bp));
			$sql = "insert into bp_services (bp_name,host,service) values(?,?,?)";
			$req = $bdd->prepare($sql);
			$req->execute(array(trim($bp),$host,$service));
	$sql = "delete from bp_links where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "update bp set is_define = 0 where name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
		$sql = "update bp set is_define = 1 where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($bp));
			$sql = "insert into bp_links (bp_name,bp_link) values(?,?)";
			$req = $bdd->prepare($sql);
			$req->execute(array($bp,$bp_link));
	$sql = "select count(*) from bp where name = ?;";
	$req = $bdd->prepare($sql);
	$req->execute(array($uniq_name));
	$sql = "select count(*) from bp where name = ?;";
	$req = $bdd->prepare($sql);
	$req->execute(array($uniq_name));
		$sql = "insert into bp (name,description,priority,type,command,url,min_value) values(?,?,?,?,?,?,?)";
		$req = $bdd->prepare($sql);
		$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value));
			$sql = "update bp set name = ?,description = ?,priority = ?,type = ?,command = ?,url = ?,min_value = ? where name = ?";
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value,$uniq_name_orig));
			$sql = "update bp_links set bp_name = ? where bp_name = ?";
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$uniq_name_orig));	
			$sql = "update bp_links set bp_link = ? where bp_link = ?";
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$uniq_name_orig));
			$sql = "update bp_services set bp_name = ? where bp_name = ?";					
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$uniq_name_orig));	
		$sql = "update bp set name = ?,description = ?,priority = ?,type = ?,command = ?,url = ?,min_value = ? where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value,$uniq_name));
	$sql = "SELECT bp_link FROM bp_links where bp_name=?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_informations['name']));
			$sql = "SELECT * FROM bp where is_define ='1' and name=?";
			$req = $bdd->prepare($sql);
			$req->execute(array($bp_link["bp_link"]));
	$sql = "select host,service from bp_services where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_informations['name']));
	$sql = "select bp_link from bp_links where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_informations['name']));
	$sql = "select * from bp where name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_name));
	$sql="select * from ldap_users_extended where (user LIKE ?) OR (login LIKE ?) order by user";
	$result=sqlrequest($database_eonweb,$sql,false,array("ss","%".$_GET['term']."%","%".$_GET['term']."%"));
	include("../include/config.php");
	include("../include/arrays.php");
	if(in_array($_GET["module"],$array_modules)) {
		$module=exec("rpm -q ".$_GET["module"]." |grep '.eon' |wc -l");
		# Redirect to module page if rpm installed
		if($module!=0) { header('Location: '.$_GET["link"].''); }
	}
if(!isset($queue)) { $queue="active"; } 
elseif(!in_array($queue,$array_ged_queues)) { $queue="active"; }
						$sql = "SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id!='0' AND pkt_type_id<'100';";
						$gedsql_result1=sqlrequest($database_ged,$sql);
						$sql = "SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id=? AND pkt_type_id<'100';";
						$prepare=array("i",(int)$_GET["type"]);
						$gedsql_result1=sqlrequest($database_ged,$sql,false,$prepare);
										
						$mysqli_prepare=array("");
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$actual_time;
									$mysqli_prepare[]=(int)$five_minutes;
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$five_minutes;
									$mysqli_prepare[]=(int)$fifteen_minutes;
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$fifteen_minutes;
									$mysqli_prepare[]=(int)$thirty_minutes;
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$thirty_minutes;
									$mysqli_prepare[]=(int)$one_hour;
									$sql .= " AND o_sec <= ?";
									$mysqli_prepare[0].="i";
									$mysqli_prepare[]=(int)$one_hour;
							$sql .= " AND a_sec - o_sec >= ?";
							$mysqli_prepare=array("i",(int)$ack_time);
										$sql .= " AND ($key LIKE ?";
										$mysqli_prepare[0].="s";
										$mysqli_prepare[]=(string)$like;
										$sql .= " OR $key LIKE ?";
										$mysqli_prepare[0].="s";
										$mysqli_prepare[]=(string)$like;
						$request = sqlrequest($database_ged, $sql, false, $mysqli_prepare);
if(!isset($queue)) { $queue="active"; } 
elseif(!in_array($queue,$array_ged_queues)) { $queue="active"; }
	global $array_ged_queues;

	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	global $array_ged_queues; 
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }

	
	global $mysqli_prepare;
	
		$where_clause .= " AND $filter LIKE ?";
		$mysqli_prepare[0].="s";
		$mysqli_prepare[]=(string)$like;
		$where_clause .= " AND o_sec > ? AND o_sec < ?";
		$mysqli_prepare[0].="ii";
		$mysqli_prepare[]=(int)$start;
		$mysqli_prepare[]=(int)$end;
	if($ok != "")		{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=0; }
	if($warning != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=1; }
	if($critical != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=2; }
	if($unknown != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=3; }
	global $array_ged_queues; 
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }

	$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
	$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
	global $array_ged_queues; 
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }

	$sql = "SELECT comments FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
	$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
	$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments=? WHERE id = ?";
	$result = sqlrequest($database_ged, $sql, false, array("ss",(string)$comments,(string)$id));
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
		$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments=? WHERE id = ?";
		$result = sqlrequest($database_ged, $sql, false, array("ss",(string)$comments,(string)$id));
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
		$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
		$ged_command=escapeshellcmd($ged_command);
		
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
		$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
		$ged_command=escapeshellcmd($ged_command);
		
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
			$ged_command=escapeshellcmd($ged_command);
					
		$ged_command=escapeshellcmd($ged_command);
		
	global $array_ged_packets;
	global $array_ged_queues;
	
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	if(isset($array_ged_packets[$filter])) {
		while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
			$sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue;

			$results = sqlrequest($database_ged, $sql);
			while($result = mysqli_fetch_array($results)){
				if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){
					array_push($datas, $result[$filter]);
				}