Security statements update against sql injection attacks.

[fa-stable.git] / gl / view / gl_trans_view.php

diff --git a/gl/view/gl_trans_view.php b/gl/view/gl_trans_view.php
index 0aec1027b07948a3ee0953ba7e4ab3d93377c1f1..4feed339d7b013160683c34bbcb88619809600d1 100644 (file)
--- a/gl/view/gl_trans_view.php
+++ b/gl/view/gl_trans_view.php
@@ -1,5 +1,14 @@
 <?php
-
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
 $page_security = 8;
 $path_to_root="../..";
 include_once($path_to_root . "/includes/session.inc");
@@ -38,7 +47,11 @@ function display_gl_heading($myrow)
     end_table(1);
 }
 
-$sql = "SELECT ".TB_PREF."gl_trans.*, account_name FROM ".TB_PREF."gl_trans, ".TB_PREF."chart_master WHERE ".TB_PREF."gl_trans.account = ".TB_PREF."chart_master.account_code AND type= " . $_GET['type_id'] . " AND type_no = " . $_GET['trans_no'] . " ORDER BY counter";
+$sql = "SELECT ".TB_PREF."gl_trans.*, account_name FROM "
+       .TB_PREF."gl_trans, ".TB_PREF."chart_master WHERE "
+       .TB_PREF."gl_trans.account = ".TB_PREF."chart_master.account_code AND type= " 
+       .db_escape($_GET['type_id']) . " AND type_no = ".db_escape($_GET['trans_no']) 
+       . " ORDER BY counter";
 $result = db_query($sql,"could not get transactions");
 //alert("sql = ".$sql);
 
@@ -66,6 +79,7 @@ $heading_shown = false;
 
 while ($myrow = db_fetch($result)) 
 {
+       if ($myrow['amount'] == 0) continue;
        if (!$heading_shown)
        {
                display_gl_heading($myrow);