X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=manufacturing%2Fincludes%2Fdb%2Fwork_order_issues_db.inc;h=23d07caa03d8f8b0f141a58dabc2ce11492b8575;hb=54d84ff9a67620ab38c676cdbcf87853632724f0;hp=0df0684652b2e1987858f2cc9f8c79f36dacc724;hpb=d567a10b7925c8bb97c734e213d6651a979af29d;p=fa-stable.git

diff --git a/manufacturing/includes/db/work_order_issues_db.inc b/manufacturing/includes/db/work_order_issues_db.inc
index 0df06846..23d07caa 100644
--- a/manufacturing/includes/db/work_order_issues_db.inc
+++ b/manufacturing/includes/db/work_order_issues_db.inc
@@ -34,8 +34,8 @@ function add_work_order_issue($woid, $ref, $to_work_order, $items, $location, $w
 
 	// insert the actual issue
 	$sql = "INSERT INTO ".TB_PREF."wo_issues (workorder_id, reference, issue_date, loc_code, workcentre_id)
-		VALUES ($woid, ".db_escape($ref).", '" .
-		date2sql($date_) . "', ".db_escape($location).", $workcentre)";
+		VALUES (".db_escape($woid).", ".db_escape($ref).", '" .
+		date2sql($date_) . "', ".db_escape($location).", ".db_escape($workcentre).")";
 	db_query($sql,"The work order issue could not be added");
 
 	$number = db_insert_id();
@@ -51,7 +51,8 @@ function add_work_order_issue($woid, $ref, $to_work_order, $items, $location, $w
 			$location, $date_, $memo_, -$item->quantity, 0);
 
 		$sql = "INSERT INTO ".TB_PREF."wo_issue_items (issue_id, stock_id, qty_issued)
-			VALUES ('$number', '$item->stock_id', $item->quantity)";
+			VALUES (".db_escape($number).", ".db_escape($item->stock_id).", "
+			.db_escape($item->quantity).")";
 		db_query($sql,"A work order issue item could not be added");
 	}
 
@@ -67,7 +68,8 @@ function add_work_order_issue($woid, $ref, $to_work_order, $items, $location, $w
 
 function get_work_order_issues($woid)
 {
-	$sql = "SELECT * FROM ".TB_PREF."wo_issues WHERE workorder_id=$woid ORDER BY issue_no";
+	$sql = "SELECT * FROM ".TB_PREF."wo_issues WHERE workorder_id=".db_escape($woid)
+	." ORDER BY issue_no";
     return db_query($sql, "The work order issues could not be retrieved");
 }
 
@@ -76,7 +78,8 @@ function get_additional_issues($woid)
 	$sql = "SELECT ".TB_PREF."wo_issues.*, ".TB_PREF."wo_issue_items.*
 		FROM ".TB_PREF."wo_issues, ".TB_PREF."wo_issue_items
 		WHERE ".TB_PREF."wo_issues.issue_no=".TB_PREF."wo_issue_items.issue_id
-		AND ".TB_PREF."wo_issues.workorder_id=$woid ORDER BY ".TB_PREF."wo_issue_items.id";
+		AND ".TB_PREF."wo_issues.workorder_id=".db_escape($woid)
+		." ORDER BY ".TB_PREF."wo_issue_items.id";
     return db_query($sql, "The work order issues could not be retrieved");
 }
 //--------------------------------------------------------------------------------------
@@ -84,9 +87,11 @@ function get_additional_issues($woid)
 function get_work_order_issue($issue_no)
 {
 	$sql = "SELECT DISTINCT ".TB_PREF."wo_issues.*, ".TB_PREF."workorders.stock_id,
-		".TB_PREF."stock_master.description, ".TB_PREF."locations.location_name, ".TB_PREF."workcentres.name AS WorkCentreName
-		FROM ".TB_PREF."wo_issues, ".TB_PREF."workorders, ".TB_PREF."stock_master, ".TB_PREF."locations, ".TB_PREF."workcentres
-		WHERE issue_no='$issue_no'
+		".TB_PREF."stock_master.description, ".TB_PREF."locations.location_name, "
+		.TB_PREF."workcentres.name AS WorkCentreName
+		FROM ".TB_PREF."wo_issues, ".TB_PREF."workorders, ".TB_PREF."stock_master, "
+		.TB_PREF."locations, ".TB_PREF."workcentres
+		WHERE issue_no=".db_escape($issue_no)."
 		AND ".TB_PREF."workorders.id = ".TB_PREF."wo_issues.workorder_id
 		AND ".TB_PREF."locations.loc_code = ".TB_PREF."wo_issues.loc_code
 		AND ".TB_PREF."workcentres.id = ".TB_PREF."wo_issues.workcentre_id
@@ -100,9 +105,10 @@ function get_work_order_issue($issue_no)
 
 function get_work_order_issue_details($issue_no)
 {
-	$sql = "SELECT ".TB_PREF."wo_issue_items.*,".TB_PREF."stock_master.description, ".TB_PREF."stock_master.units
+	$sql = "SELECT ".TB_PREF."wo_issue_items.*,"
+	.TB_PREF."stock_master.description, ".TB_PREF."stock_master.units
 		FROM ".TB_PREF."wo_issue_items, ".TB_PREF."stock_master
-		WHERE issue_id=$issue_no
+		WHERE issue_id=".db_escape($issue_no)."
 		AND ".TB_PREF."stock_master.stock_id=".TB_PREF."wo_issue_items.stock_id
 		ORDER BY ".TB_PREF."wo_issue_items.id";
     return db_query($sql, "The work order issue items could not be retrieved");
@@ -112,7 +118,7 @@ function get_work_order_issue_details($issue_no)
 
 function exists_work_order_issue($issue_no)
 {
-	$sql = "SELECT issue_no FROM ".TB_PREF."wo_issues WHERE issue_no=$issue_no";
+	$sql = "SELECT issue_no FROM ".TB_PREF."wo_issues WHERE issue_no=".db_escape($issue_no);
 	$result = db_query($sql, "Cannot retreive a wo issue");
 
     return (db_num_rows($result) > 0);
@@ -125,7 +131,8 @@ function void_work_order_issue($type_no)
 	begin_transaction();
 
 	// void the actual issue items and their quantities
-	$sql = "UPDATE ".TB_PREF."wo_issue_items Set qty_issued = 0 WHERE issue_id=$type_no";
+	$sql = "UPDATE ".TB_PREF."wo_issue_items Set qty_issued = 0 WHERE issue_id="
+		.db_escape($type_no);
 	db_query($sql,"A work order issue item could not be voided");
 
 	// void all related stock moves