X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=manufacturing%2Fsearch_work_orders.php;h=cf93441cfaa7332ef74cc7f5e020667a52e9e1a7;hb=8ea6c4dd0d9b31b3456d012b0c94339b801bee0c;hp=b4e0d2f5cb5401d02c601f0435aca1f6ab7a0dd3;hpb=f0f460043b9bcb6153c0f6f82d4a74433efe4ad8;p=fa-stable.git

diff --git a/manufacturing/search_work_orders.php b/manufacturing/search_work_orders.php
index b4e0d2f5..cf93441c 100644
--- a/manufacturing/search_work_orders.php
+++ b/manufacturing/search_work_orders.php
@@ -185,17 +185,17 @@ if (check_value('OpenOnly') || $outstanding_only != 0)
 
 if (isset($_POST['StockLocation']) && $_POST['StockLocation'] != $all_items)
 {
-	$sql .= " AND workorder.loc_code='" . $_POST['StockLocation'] . "' ";
+	$sql .= " AND workorder.loc_code=".db_escape($_POST['StockLocation']);
 }
 
 if (isset($_POST['OrderNumber']) && $_POST['OrderNumber'] != "")
 {
-	$sql .= " AND workorder.wo_ref LIKE '%". $_POST['OrderNumber'] . "%'";
+	$sql .= " AND workorder.wo_ref LIKE ".db_escape('%'.$_POST['OrderNumber'].'%');
 }
 
 if (isset($_POST['SelectedStockItem']) && $_POST['SelectedStockItem'] != $all_items)
 {
-	$sql .= " AND workorder.stock_id='". $_POST['SelectedStockItem'] . "'";
+	$sql .= " AND workorder.stock_id=".db_escape($_POST['SelectedStockItem']);
 }
 
 if (check_value('OverdueOnly'))