Security update merged from 2.1.

[fa-stable.git] / purchasing / includes / db / invoice_items_db.inc

diff --git a/purchasing/includes/db/invoice_items_db.inc b/purchasing/includes/db/invoice_items_db.inc
index 0d69d8682661475b252a53896cc237a8fe5e0dcf..efcdcb4bd323b1af4a737c2cbd2225ed10b176c2 100644 (file)
--- a/purchasing/includes/db/invoice_items_db.inc
+++ b/purchasing/includes/db/invoice_items_db.inc
@@ -17,9 +17,11 @@ function add_supp_invoice_item($supp_trans_type, $supp_trans_no, $stock_id, $des
 {
        $sql = "INSERT INTO ".TB_PREF."supp_invoice_items (supp_trans_type, supp_trans_no, stock_id, description, gl_code, unit_price, unit_tax, quantity,
                grn_item_id, po_detail_item_id, memo_) ";
-       $sql .= "VALUES ($supp_trans_type, $supp_trans_no, ".db_escape($stock_id).
-       ", ".db_escape($description).", ".db_escape($gl_code).", $unit_price, $unit_tax, $quantity,
-               $grn_item_id, $po_detail_item_id, ".db_escape($memo_).")";
+       $sql .= "VALUES (".db_escape($supp_trans_type).", ".db_escape($supp_trans_no).", "
+               .db_escape($stock_id).
+       ", ".db_escape($description).", ".db_escape($gl_code).", ".db_escape($unit_price)
+       .", ".db_escape($unit_tax).", ".db_escape($quantity).",
+               ".db_escape($grn_item_id).", ".db_escape($po_detail_item_id).", ".db_escape($memo_).")";
 
        if ($err_msg == "")
                $err_msg = "Cannot insert a supplier transaction detail record";
@@ -43,8 +45,8 @@ function add_supp_invoice_gl_item($supp_trans_type, $supp_trans_no, $gl_code, $a
 function get_supp_invoice_items($supp_trans_type, $supp_trans_no)
 {
        $sql = "SELECT *, unit_price AS FullUnitPrice FROM ".TB_PREF."supp_invoice_items
-               WHERE supp_trans_type = $supp_trans_type
-               AND supp_trans_no = $supp_trans_no ORDER BY id";
+               WHERE supp_trans_type = ".db_escape($supp_trans_type)."
+               AND supp_trans_no = ".db_escape($supp_trans_no)." ORDER BY id";
        return db_query($sql, "Cannot retreive supplier transaction detail records");
 }
 
@@ -53,7 +55,7 @@ function get_supp_invoice_items($supp_trans_type, $supp_trans_no)
 function void_supp_invoice_items($type, $type_no)
 {
        $sql = "UPDATE ".TB_PREF."supp_invoice_items SET quantity=0, unit_price=0
-               WHERE supp_trans_type = $type AND supp_trans_no=$type_no";
+               WHERE supp_trans_type = ".db_escape($type)." AND supp_trans_no=".db_escape($type_no);
        db_query($sql, "could not void supptrans details");
 }