Sealed sql queries.

diff --git a/sales/manage/customers.php b/sales/manage/customers.php
index ba7547565ae4eb8ff152d7ac267a9f0d4c0c76c1..d1f358ec5a9b49f6b590e9a5697932273cb0c7c2 100644 (file)
--- a/sales/manage/customers.php
+++ b/sales/manage/customers.php
@@ -137,8 +137,8 @@ if (isset($_POST['delete']))
        $cancel_delete = 0;
 
        // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans'
-
-       $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE debtor_no='" . $_POST['customer_id'] . "'";
+       $sel_id = db_escape($_POST['customer_id']);
+       $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE debtor_no=$sel_id";
        $result = db_query($sql,"check failed");
        $myrow = db_fetch_row($result);
        if ($myrow[0] > 0) 
@@ -148,7 +148,7 @@ if (isset($_POST['delete']))
        } 
        else 
        {
-               $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE debtor_no='" . $_POST['customer_id'] . "'";
+               $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE debtor_no=$sel_id";
                $result = db_query($sql,"check failed");
                $myrow = db_fetch_row($result);
                if ($myrow[0] > 0) 
@@ -158,7 +158,7 @@ if (isset($_POST['delete']))
                } 
                else 
                {
-                       $sql = "SELECT COUNT(*) FROM ".TB_PREF."cust_branch WHERE debtor_no='" . $_POST['customer_id'] . "'";
+                       $sql = "SELECT COUNT(*) FROM ".TB_PREF."cust_branch WHERE debtor_no=$sel_id";
                        $result = db_query($sql,"check failed");
                        $myrow = db_fetch_row($result);
                        if ($myrow[0] > 0) 
@@ -172,7 +172,7 @@ if (isset($_POST['delete']))
        
        if ($cancel_delete == 0) 
        {       //ie not cancelled the delete as a result of above tests
-               $sql = "DELETE FROM ".TB_PREF."debtors_master WHERE debtor_no='" . $_POST['customer_id'] . "'";
+               $sql = "DELETE FROM ".TB_PREF."debtors_master WHERE debtor_no=$sel_id";
                db_query($sql,"cannot delete customer");
 
                display_notification(_("Selected customer has been deleted."));
@@ -218,7 +218,7 @@ if ($new_customer)
 else 
 {
 
-       $sql = "SELECT * FROM ".TB_PREF."debtors_master WHERE debtor_no = '" . $_POST['customer_id'] . "'";
+       $sql = "SELECT * FROM ".TB_PREF."debtors_master WHERE debtor_no = ".db_escape($_POST['customer_id']);
        $result = db_query($sql,"check failed");
 
        $myrow = db_fetch($result);