Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function getCustomerPaymentInfo_back(int $customer_id) {
    global $table_prefeix;

    easySelectD(
        "select customer_id, if(customer_opening_balance is null, 0, customer_opening_balance) as customer_opening_balance,
            if(sales_grand_total is null, 0, sales_grand_total) as sales_grand_total, 
            if(returns_grand_total is null, 0, returns_grand_total) as returns_grand_total,
            if(received_payments_amount is null, 0, received_payments_amount) as total_received_payments,
            if(received_payments_bonus is null, 0, received_payments_bonus) as total_given_bonus
        from {$table_prefeix}customers
        left join (
            select
                sales_customer_id,
                sum(sales_grand_total) as sales_grand_total
            from {$table_prefeix}sales where is_trash = 0 group by sales_customer_id
        ) as sales on customer_id = sales_customer_id
        left join ( 
            select 
                product_returns_customer_id, 
                sum(product_returns_grand_total) as returns_grand_total 
            from {$table_prefeix}product_returns where is_trash = 0 group by product_returns_customer_id
        ) as product_returns on customer_id = product_returns_customer_id
        left join ( 
            select 
                received_payments_from, 
                sum(received_payments_amount) as received_payments_amount, 
                sum(received_payments_bonus) as received_payments_bonus 
            from {$table_prefeix}received_payments where is_trash = 0 group by received_payments_from
        ) as {$table_prefeix}received_payments on customer_id = received_payments_from
        where customer_id = {$customer_id}"
    );

}