X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=reporting%2Frep209.php;h=b6b88a4572ee85b310b3493d5109b019c5594441;hb=af78fbb535a6fedbc2eb70a26ddc39739be2b986;hp=785420c9218cd7223133f931bf517b139942c0b8;hpb=28e7dac267b65d8163ca41c452c42706d0ffb2dd;p=fa-stable.git

diff --git a/reporting/rep209.php b/reporting/rep209.php
index 785420c9..b6b88a45 100644
--- a/reporting/rep209.php
+++ b/reporting/rep209.php
@@ -37,7 +37,7 @@ function get_po($order_no)
 		FROM ".TB_PREF."purch_orders, ".TB_PREF."suppliers, ".TB_PREF."locations
 		WHERE ".TB_PREF."purch_orders.supplier_id = ".TB_PREF."suppliers.supplier_id
 		AND ".TB_PREF."locations.loc_code = into_stock_location
-		AND ".TB_PREF."purch_orders.order_no = " . $order_no;
+		AND ".TB_PREF."purch_orders.order_no = ".db_escape($order_no);
    	$result = db_query($sql, "The order cannot be retrieved");
     return db_fetch($result);
 }
@@ -48,7 +48,7 @@ function get_po_details($order_no)
 		FROM ".TB_PREF."purch_order_details
 		LEFT JOIN ".TB_PREF."stock_master
 		ON ".TB_PREF."purch_order_details.item_code=".TB_PREF."stock_master.stock_id
-		WHERE order_no =$order_no ";
+		WHERE order_no =".db_escape($order_no)." ";
 	$sql .= " ORDER BY po_detail_item";
 	return db_query($sql, "Retreive order Line Items");
 }