Security Fix in recurring invoices in cron

functions/format.php

@@ -349,6 +349,20 @@ function validateDate($date) {
     return date('Y-m-d'); // Fallback
 }
 
+/*
+ * Validates a recurring invoice frequency against the only two values the UI
+ * offers. This value is spliced into SQL *unquoted* (INTERVAL 1 <frequency>),
+ * where escaping does nothing - a whitelist is the only safe handling. Apply it
+ * at every write path AND at the read side before use, so a row planted before
+ * this fix can't fire.
+ */
+function validateRecurringFrequency($frequency) {
+    if (in_array($frequency, ['month', 'year'], true)) {
+        return $frequency;
+    }
+    return 'month'; // Fallback
+}
+
 /*
  * Formats bytes into human readable file sizes
  */