Security update merged from 2.1.

[fa-stable.git] / sales / includes / sales_db.inc

diff --git a/sales/includes/sales_db.inc b/sales/includes/sales_db.inc
index fc6f290479c1e2b64348969da51b59bab84cf068..536458369b243695db5c789535d9e2897ee2442e 100644 (file)
--- a/sales/includes/sales_db.inc
+++ b/sales/includes/sales_db.inc
@@ -92,15 +92,15 @@ function get_price ($stock_id, $currency, $sales_type_id, $factor=null, $date=nu
                $myrow = get_sales_type($sales_type_id);
                $factor = $myrow['factor'];
        }
-           
+
        $add_pct = get_company_pref('add_pct');
        $base_id = get_base_sales_type();
     $home_curr = get_company_currency();
        //      AND (sales_type_id = $sales_type_id     OR sales_type_id = $base_id)
        $sql = "SELECT price, curr_abrev, sales_type_id
                FROM ".TB_PREF."prices
-               WHERE stock_id = '$stock_id' 
-                       AND (curr_abrev = '$currency' OR curr_abrev = '$home_curr')";
+               WHERE stock_id = ".db_escape($stock_id)."
+                       AND (curr_abrev = ".db_escape($currency)." OR curr_abrev = ".db_escape($home_curr).")";
 
        $result = db_query($sql, "There was a problem retrieving the pricing information for the part $stock_id for customer");
        $num_rows = db_num_rows($result);
@@ -188,7 +188,7 @@ function set_document_parent($cart)
        $del_no = reset(array_keys($cart->src_docs));
 
        $sql = 'UPDATE '.TB_PREF.'debtor_trans SET trans_link = ' . $del_no .
-               ' WHERE type='.$cart->trans_type.' AND trans_no='. $inv_no ;
+               ' WHERE type=".db_escape($cart->trans_type)." AND trans_no='. $inv_no ;
        db_query($sql, 'Child document link cannot be updated');
 
        }
@@ -236,11 +236,11 @@ function update_parent_line($doc_type, $line_id, $qty_dispatched)
                if ($doc_type==ST_SALESORDER)
                        $sql = "UPDATE ".TB_PREF."sales_order_details
                                SET qty_sent = qty_sent + $qty_dispatched
-                               WHERE id=$line_id";
+                               WHERE id=".db_escape($line_id);
                else
                        $sql = "UPDATE ".TB_PREF."debtor_trans_details
                                SET qty_done = qty_done + $qty_dispatched
-                               WHERE id=$line_id";
+                               WHERE id=".db_escape($line_id);
        }
        db_query($sql, "The parent document detail record could not be updated");
        return true;
@@ -253,7 +253,7 @@ function get_location(&$cart)
 {
        $sql = "SELECT ".TB_PREF."locations.* FROM ".TB_PREF."stock_moves,"
                .TB_PREF."locations".
-               " WHERE type=".$cart->trans_type.
+               " WHERE type=".db_escape($cart->trans_type).
                " AND trans_no=".key($cart->trans_no).
                " AND qty!=0 ".
                " AND ".TB_PREF."locations.loc_code=".TB_PREF."stock_moves.loc_code";