CVE-2018-16809: Dolibarr SQL injection via the integer parameters qty and value_unit

The vulnerability stems from Dolibarr's use of regex-based blacklist filtering in these functions rather than prepared statements or proper type casting. The advisory explicitly states these functions were intended to protect against SQLi but were bypassed due to: 1) Insufficient regex patterns that could be evaded via parameter splitting 2) Failure to properly handle integer parameters 3) Lack of context-aware escaping. These functions directly process the qty/value_unit parameters used in the vulnerable UPDATE query in expensereport/card.php.