Security statements update against sql injection attacks.

[fa-stable.git] / purchasing / inquiry / po_search_completed.php

diff --git a/purchasing/inquiry/po_search_completed.php b/purchasing/inquiry/po_search_completed.php
index a22f6d2ad7bb3ba01b54bc167bf52721b3ad4f67..c71c0cdec00068a758233a664d2f4a4863396859 100644 (file)
--- a/purchasing/inquiry/po_search_completed.php
+++ b/purchasing/inquiry/po_search_completed.php
@@ -126,7 +126,7 @@ $sql = "SELECT
 
 if (isset($order_number) && $order_number != "")
 {
-       $sql .= "AND porder.reference LIKE '%". $order_number . "%'";
+       $sql .= "AND porder.reference LIKE ".db_escape('%'. $order_number . '%');
 }
 else
 {
@@ -139,11 +139,11 @@ else
 
        if (isset($_POST['StockLocation']) && $_POST['StockLocation'] != reserved_words::get_all())
        {
-               $sql .= " AND porder.into_stock_location = '". $_POST['StockLocation'] . "' ";
+               $sql .= " AND porder.into_stock_location = ".db_escape($_POST['StockLocation']);
        }
        if (isset($selected_stock_item))
        {
-               $sql .= " AND line.item_code='". $selected_stock_item ."' ";
+               $sql .= " AND line.item_code=".db_escape($selected_stock_item);
        }
 
 } //end not order number selected