Stupid me ... missed the correct line for the marked.

ag/markt.php

@@ -39,7 +39,7 @@ $item_8 = validateUnsignedInteger($_GET['item_8'], null);
 $item_9 = validateUnsignedInteger($_GET['item_9'], null);
 $item_10 = validateUnsignedInteger($_GET['item_10'], null);
 $pagenum = validateUnsignedInteger($_GET['pagenum'], null);
-$oder = validateString($_GET['oder']);
+$oder = validateStringCritical($_GET['oder']);
 $ords = validateStringCritical($_GET['ords']);
 $charm = validateString($_GET['charm']);