fix(main): validate specialty exists, fix double-escaped title filter

ws_customerspecialty/src/Grid/Query/CustomerSpecialtyQueryBuilder.php

@@ -78,7 +78,7 @@ class CustomerSpecialtyQueryBuilder extends AbstractDoctrineQueryBuilder
             switch ($filterName) {
                 case 'title':
                     $queryBuilder->andWhere('csl.title LIKE :title')
-                        ->setParameter('title', '%' . pSQL($filterValue) . '%');
+                        ->setParameter('title', '%' . $filterValue . '%');
                     break;
                 case 'active':
                     $queryBuilder->andWhere('cs.active = :active')

ws_customerspecialty/src/Module/DisplayHooks.php

@@ -91,7 +91,7 @@ trait DisplayHooks
         $idCustomer = (int) $customer->id;
         $specialization = (int) Tools::getValue('specialization');
 
-        if ($idCustomer <= 0 || $specialization <= 0) {
+        if ($idCustomer <= 0 || $specialization <= 0 || !$this->customerSpecialtyExists($specialization)) {
             return;
         }
 
@@ -108,6 +108,14 @@ trait DisplayHooks
         );
     }
 
+    private function customerSpecialtyExists(int $idCustomerSpecialty): bool
+    {
+        return (bool) Db::getInstance()->getValue(
+            'SELECT `id_ws_customerspecialty` FROM `' . _DB_PREFIX_ . 'ws_customerspecialty`
+             WHERE `id_ws_customerspecialty` = ' . $idCustomerSpecialty . ' AND `active` = 1'
+        );
+    }
+
     private function loadOrderCustomerSpecialization(int $idOrder): ?string
     {
         $idCustomer = (int) Db::getInstance()->getValue(