Security sql statements update against sql injection attacks.

[fa-stable.git] / reporting / rep104.php

diff --git a/reporting/rep104.php b/reporting/rep104.php
index ac9a5f8fa3097d6ff19c2d13e3bbe5571d4fcd7f..de7d5400bc1d9edb24fecfc85d5c5e0aeb5261d4 100644 (file)
--- a/reporting/rep104.php
+++ b/reporting/rep104.php
@@ -24,7 +24,7 @@ include_once($path_to_root . "/includes/ui/ui_input.inc");
 include_once($path_to_root . "/includes/data_checks.inc");
 include_once($path_to_root . "/gl/includes/gl_db.inc");
 include_once($path_to_root . "/sales/includes/db/sales_types_db.inc");
-include_once($path_to_root . "/inventory/includes/db/inventory_db.inc");
+include_once($path_to_root . "/inventory/includes/inventory_db.inc");
 
 //----------------------------------------------------------------------------------------------------
 
@@ -40,7 +40,7 @@ function fetch_items($category=0)
                                ".TB_PREF."stock_category
                        WHERE ".TB_PREF."stock_master.category_id=".TB_PREF."stock_category.category_id";
                if ($category != 0)
-                       $sql .= " AND ".TB_PREF."stock_category.category_id = '$category'";
+                       $sql .= " AND ".TB_PREF."stock_category.category_id = ".db_escape($category);
                $sql .= " ORDER BY ".TB_PREF."stock_master.category_id,
                                ".TB_PREF."stock_master.stock_id";
 
@@ -57,7 +57,7 @@ function get_kits($category=0)
                        ON i.category_id=c.category_id";
        $sql .= " WHERE !i.is_foreign AND i.item_code!=i.stock_id";
        if ($category != 0)
-               $sql .= " AND c.category_id = '$category'";
+               $sql .= " AND c.category_id = ".db_escape($category);
        $sql .= " GROUP BY i.item_code";
     return db_query($sql,"No kits were returned");
 }
@@ -166,7 +166,7 @@ function print_price_listing()
                                $rep->NewLine();
                                if ($rep->row - $pic_height < $rep->bottomMargin)
                                        $rep->Header();
-                               $rep->AddImage($image, $rep->cols[1], $rep->row - $pic_height, $pic_width, $pic_height);
+                               $rep->AddImage($image, $rep->cols[1], $rep->row - $pic_height, 0, $pic_height);
                                $rep->row -= $pic_height;
                                $rep->NewLine();
                        }