Security update merged from 2.1.

[fa-stable.git] / manufacturing / inquiry / where_used_inquiry.php

diff --git a/manufacturing/inquiry/where_used_inquiry.php b/manufacturing/inquiry/where_used_inquiry.php
index 4ad2ebc7eb578f06d77484c4af74fbd6ccd4972a..c10dc2a7aa039af1ce06f44a5c493a7f69dcfe7e 100644 (file)
--- a/manufacturing/inquiry/where_used_inquiry.php
+++ b/manufacturing/inquiry/where_used_inquiry.php
@@ -50,7 +50,7 @@ $sql = "SELECT
                WHERE bom.parent = parent.stock_id 
                        AND bom.workcentre_added = workcentre.id
                        AND bom.loc_code = location.loc_code
-                       AND bom.component='" . $_POST['stock_id'] . "'";
+                       AND bom.component=".db_escape($_POST['stock_id']);
 
    $cols = array(
        _("Parent Item") => array('fun'=>'select_link'),