$sql = "SELECT description, units, material_cost, labour_cost,
overhead_cost, mb_flag
FROM ".TB_PREF."stock_master
- WHERE stock_id='" . $_POST['stock_id'] . "'
+ WHERE stock_id=".db_escape($_POST['stock_id']) . "
GROUP BY description, units, material_cost, labour_cost, overhead_cost, mb_flag";
$result = db_query($sql);
check_db_error("The cost details for the item could not be retrieved", $sql);