Add Admin_Resource on Admin controllers + Add escaper on templates + Add bind on fetchRow to avoid risk of SQL Injection

[bretin]

During a technical assessment, I noticed a few security issues:

• The admin controllers have no admin_resource, we added sales_order ACL since it's on the order grid but it could be a custom ACL
• A direct SQL query has been adjust to use a binding variable instead of of the direct use in order to avoid risk of SQL injection
• Template has been adjust to use escapers

[Daniel-Shai]

Hi @wkaminsk , can you please take a look? It's a suggestion from SAQ