X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;ds=sidebyside;f=gl%2Fview%2Fgl_trans_view.php;h=4feed339d7b013160683c34bbcb88619809600d1;hb=54d84ff9a67620ab38c676cdbcf87853632724f0;hp=e48b09bfa72d9325bc68c2ca884487babe3f14d3;hpb=2829455fee1259fb5013f382309cb3e61e9381ef;p=fa-stable.git

diff --git a/gl/view/gl_trans_view.php b/gl/view/gl_trans_view.php
index e48b09bf..4feed339 100644
--- a/gl/view/gl_trans_view.php
+++ b/gl/view/gl_trans_view.php
@@ -47,7 +47,11 @@ function display_gl_heading($myrow)
     end_table(1);
 }
 
-$sql = "SELECT ".TB_PREF."gl_trans.*, account_name FROM ".TB_PREF."gl_trans, ".TB_PREF."chart_master WHERE ".TB_PREF."gl_trans.account = ".TB_PREF."chart_master.account_code AND type= " . $_GET['type_id'] . " AND type_no = " . $_GET['trans_no'] . " ORDER BY counter";
+$sql = "SELECT ".TB_PREF."gl_trans.*, account_name FROM "
+	.TB_PREF."gl_trans, ".TB_PREF."chart_master WHERE "
+	.TB_PREF."gl_trans.account = ".TB_PREF."chart_master.account_code AND type= " 
+	.db_escape($_GET['type_id']) . " AND type_no = ".db_escape($_GET['trans_no']) 
+	. " ORDER BY counter";
 $result = db_query($sql,"could not get transactions");
 //alert("sql = ".$sql);