Security update merged from 2.1.

[fa-stable.git] / reporting / rep302.php

diff --git a/reporting/rep302.php b/reporting/rep302.php
index 1678b2ab5b4b94491269aebb61e57fde3183d506..8e5bb6ddfd2e39e0898149e167842b5d82295df1 100644 (file)
--- a/reporting/rep302.php
+++ b/reporting/rep302.php
@@ -44,9 +44,9 @@ function getTransactions($category, $location)
                WHERE ".TB_PREF."stock_master.category_id=".TB_PREF."stock_category.category_id
                AND (".TB_PREF."stock_master.mb_flag='B' OR ".TB_PREF."stock_master.mb_flag='M')";
        if ($category != 0)
-               $sql .= " AND ".TB_PREF."stock_master.category_id = '$category'";
+               $sql .= " AND ".TB_PREF."stock_master.category_id = ".db_escape($category);
        if ($location != 'all')
-               $sql .= " AND IF(".TB_PREF."stock_moves.stock_id IS NULL, '1=1',".TB_PREF."stock_moves.loc_code = '$location')";
+               $sql .= " AND IF(".TB_PREF."stock_moves.stock_id IS NULL, '1=1',".TB_PREF."stock_moves.loc_code = ".db_escape($location).")";
        $sql .= " GROUP BY ".TB_PREF."stock_master.category_id,
                ".TB_PREF."stock_category.description,
                ".TB_PREF."stock_master.stock_id,
@@ -97,14 +97,14 @@ function print_inventory_planning()
        else
                include_once($path_to_root . "/reporting/includes/pdf_report.inc");
 
-       if ($category == reserved_words::get_all_numeric())
+       if ($category == ALL_NUMERIC)
                $category = 0;
        if ($category == 0)
                $cat = _('All');
        else
                $cat = get_category_name($category);
 
-       if ($location == reserved_words::get_all())
+       if ($location == ALL_TEXT)
                $location = 'all';
        if ($location == 'all')
                $loc = _('All');