Customers Comments Don't Show In Admin orders.php

[bottyz]

You can see the customer's comments when you view the details of the order.

P.S. I didn't say it was "expected behavior", just that the behavior hasn't changed since v1.5.4.

I know you can, but I thought it might be beneficial to have the comment printed in the side box also, so that its available at a glance before opening each order.

I'm currently trying to figure out how to safely extract the actual comment around line 993 of the orders.php:

 // indicate if comments exist
        $orders_history_query = $db->Execute("select orders_status_id, date_added, customer_notified, comments from " . TABLE_ORDERS_STATUS_HISTORY . " where orders_id = '" . $oInfo->orders_id . "' and comments !='" . "'" );

        if ($orders_history_query->RecordCount() > 0) {
          $contents[] = array('align' => 'left', 'text' => '<br />' . TABLE_HEADING_COMMENTS);
        }

I've got the comment to display by using the below, but do I need to sanitize the output in some way?

        // indicate if comments exist
        $orders_history_query = $db->Execute("select orders_status_id, date_added, customer_notified, comments from " . TABLE_ORDERS_STATUS_HISTORY . " where orders_id = '" . $oInfo->orders_id . "' and comments !='" . "'" );

	if ($orders_history_query->RecordCount() > 0) {
            $contents[] = array('align' => 'left', 'text' => '<br />' . TABLE_HEADING_COMMENTS) . ":";
            $contents[] = array('align' => 'left', 'text' => $orders_history_query->fields['comments']);

        }