Security statements update against sql injection attacks.

[fa-stable.git] / admin / view_print_transaction.php

diff --git a/admin/view_print_transaction.php b/admin/view_print_transaction.php
index 94c22416102df6f35e29af92c87de8d7991bce1c..99f2be1df36104b4dad0e9d148f1394439c83d97 100644 (file)
--- a/admin/view_print_transaction.php
+++ b/admin/view_print_transaction.php
@@ -109,11 +109,11 @@ function handle_search()
                        $sql .= " ,$trans_ref ";
 
                $sql .= ", ".$_POST['filterType']." as type FROM $table_name
-                       WHERE $trans_no_name >= " . $_POST['FromTransNo']. "
-                       AND  $trans_no_name <= " . $_POST['ToTransNo'];
+                       WHERE $trans_no_name >= ".db_escape($_POST['FromTransNo']). "
+                       AND  $trans_no_name <= ".db_escape($_POST['ToTransNo']);
 
                if ($type_name != null)
-                       $sql .= " AND `$type_name` = " . $_POST['filterType'];
+                       $sql .= " AND `$type_name` = ".db_escape($_POST['filterType']);
 
                $sql .= " ORDER BY $trans_no_name";