Security update merged from 2.1.

[fa-stable.git] / sales / inquiry / sales_orders_view.php

diff --git a/sales/inquiry/sales_orders_view.php b/sales/inquiry/sales_orders_view.php
index 9a0be7a5ab0c2d139695a5bf9d60fe1da87c3e47..dac158eaf7c133aa31679c9a2611f13ba8f25982 100644 (file)
--- a/sales/inquiry/sales_orders_view.php
+++ b/sales/inquiry/sales_orders_view.php
@@ -275,8 +275,9 @@ $sql = "SELECT
 
 if (isset($_POST['OrderNumber']) && $_POST['OrderNumber'] != "")
 {
-       // search orders with number like ...
-       $sql .= " AND sorder.order_no LIKE '%". $_POST['OrderNumber'] ."'"
+       // search orders with number like 
+       $number_like = "%".$_POST['OrderNumber'];
+       $sql .= " AND sorder.order_no LIKE ".db_escape($number_like)
                        ." GROUP BY sorder.order_no";
 }
 else   // ... or select inquiry constraints
@@ -292,13 +293,13 @@ else      // ... or select inquiry constraints
        if ($trans_type == 32 && !check_value('show_all'))
                $sql .= " AND sorder.delivery_date >= '".date2sql(Today())."'";
        if ($selected_customer != -1)
-               $sql .= " AND sorder.debtor_no='" . $selected_customer . "'";
+               $sql .= " AND sorder.debtor_no=".db_escape($selected_customer);
 
        if (isset($selected_stock_item))
-               $sql .= " AND line.stk_code='". $selected_stock_item ."'";
+               $sql .= " AND line.stk_code=".db_escape($selected_stock_item);
 
        if (isset($_POST['StockLocation']) && $_POST['StockLocation'] != ALL_TEXT)
-               $sql .= " AND sorder.from_stk_loc = '". $_POST['StockLocation'] . "' ";
+               $sql .= " AND sorder.from_stk_loc = ".db_escape($_POST['StockLocation']);
 
        if ($_POST['order_view_mode']=='OutstandingOnly')
                $sql .= " AND line.qty_sent < line.quantity";