fix prepared statement combination

src/Modules/Application/Model/d3_dev_oxorder.php

@@ -58,10 +58,11 @@ class d3_dev_oxorder extends d3_dev_oxorder_parent
     {
         $orderNr = (int) Registry::getRequest()->getRequestEscapedParameter('d3ordernr');
         $sWhere = 1;
+        $parameters = [];
         if ($orderNr) {
             $sWhere = ' oxordernr = ? ';
+            $parameters[] = $orderNr;
         }
-        $parameters = [$orderNr];
 
         $sSelect = "SELECT oxid FROM ".oxNew(Order::class)->getViewName()." WHERE ".
             "oxuserid != '' AND ".