X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=reporting%2Frep101.php;h=6ae113875c7065ffc3d940eec9ddc0d4c6ac7906;hb=efc1a9ce400be6233323af9c193ab9460407bcf6;hp=c57ab3aebe36c7ae45001a9e6ef9e6e1ce6d9b93;hpb=98c3d4786f920b0fbbc415343fe69e9fb69ea995;p=fa-stable.git

diff --git a/reporting/rep101.php b/reporting/rep101.php
index c57ab3ae..6ae11387 100644
--- a/reporting/rep101.php
+++ b/reporting/rep101.php
@@ -59,7 +59,7 @@ function get_open_balance($debtorno, $to, $convert)
     $sql .= ")) AS OutStanding
 		FROM ".TB_PREF."debtor_trans
     	WHERE ".TB_PREF."debtor_trans.tran_date < '$to'
-		AND ".TB_PREF."debtor_trans.debtor_no = '$debtorno'
+		AND ".TB_PREF."debtor_trans.debtor_no = ".db_escape($debtorno)."
 		AND ".TB_PREF."debtor_trans.type <> ".ST_CUSTDELIVERY." GROUP BY debtor_no";
 
     $result = db_query($sql,"No transactions were returned");
@@ -80,7 +80,7 @@ function get_transactions($debtorno, $from, $to)
     	FROM ".TB_PREF."debtor_trans
     	WHERE ".TB_PREF."debtor_trans.tran_date >= '$from'
 		AND ".TB_PREF."debtor_trans.tran_date <= '$to'
-		AND ".TB_PREF."debtor_trans.debtor_no = '$debtorno'
+		AND ".TB_PREF."debtor_trans.debtor_no = ".db_escape($debtorno)."
 		AND ".TB_PREF."debtor_trans.type <> ".ST_CUSTDELIVERY."
     	ORDER BY ".TB_PREF."debtor_trans.tran_date";
 
@@ -131,17 +131,15 @@ function print_customer_balances()
     				    3 => array('text' => _('Currency'), 'from' => $currency, 'to' => ''));
 
     $rep = new FrontReport(_('Customer Balances'), "CustomerBalances", user_pagesize());
-
     $rep->Font();
     $rep->Info($params, $cols, $headers, $aligns);
-    $rep->Header();
-
+    $rep->NewPage();
 	$grandtotal = array(0,0,0,0);
 
 	$sql = "SELECT debtor_no, name, curr_code FROM ".TB_PREF."debtors_master ";
 	if ($fromcust != ALL_NUMERIC)
-		$sql .= "WHERE debtor_no=$fromcust ";
-	$sql .= "ORDER BY name";
+		$sql .= "WHERE debtor_no=".db_escape($fromcust);
+	$sql .= " ORDER BY name";
 	$result = db_query($sql, "The customers could not be retrieved");
 
 	while ($myrow = db_fetch($result))