~ Fix security handle_params_query_list_orders

Author: tungnxt89

inc/order/class-lp-order.php

@@ -1506,7 +1506,7 @@ public static function get_order_statuses(): array {
 		 * @return void
 		 * @throws Exception
 		 * @since 4.3.2.8
-		 * @version 1.0.1
+		 * @version 1.0.2
 		 */
 		public static function handle_params_query_list_orders( PostFilter &$post_filter, array $param = array() ) {
 			$post_db               = PostDB::getInstance();
@@ -1531,7 +1531,7 @@ public static function handle_params_query_list_orders( PostFilter &$post_filter
 							'post_title',
 							'post_author',
 							'post_status',
-							'order_total'
+							'order_total',
 						);
 						if ( ! in_array( $order_by, $allowed_key ) ) {
 							$order_by = 'ID';
@@ -1580,10 +1580,16 @@ public static function handle_params_query_list_orders( PostFilter &$post_filter
 
 			if ( ! empty( $month ) ) {
 				$year                 = substr( $month, 0, 4 );
-				$post_filter->where[] = "AND YEAR(p.post_date) = $year";
+				$post_filter->where[] = $post_db->wpdb->prepare(
+					'AND YEAR(p.post_date) = %s',
+					$year
+				);
 				if ( strlen( $month ) > 5 ) {
 					$mon                  = substr( $month, 4, 2 );
-					$post_filter->where[] = "AND MONTH(p.post_date) = $mon";
+					$post_filter->where[] = $post_db->wpdb->prepare(
+						'AND MONTH(p.post_date) = %s',
+						$mon
+					);
 				}
 			}