From 7c0901e6181ee9d7100dfdbda86224a065d3f0d3 Mon Sep 17 00:00:00 2001 From: Janusz Dobrowolski Date: Sat, 4 Apr 2009 08:40:42 +0000 Subject: [PATCH] Sealed sql queries. --- sales/manage/customers.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sales/manage/customers.php b/sales/manage/customers.php index ba754756..d1f358ec 100644 --- a/sales/manage/customers.php +++ b/sales/manage/customers.php @@ -137,8 +137,8 @@ if (isset($_POST['delete'])) $cancel_delete = 0; // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans' - - $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE debtor_no='" . $_POST['customer_id'] . "'"; + $sel_id = db_escape($_POST['customer_id']); + $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE debtor_no=$sel_id"; $result = db_query($sql,"check failed"); $myrow = db_fetch_row($result); if ($myrow[0] > 0) @@ -148,7 +148,7 @@ if (isset($_POST['delete'])) } else { - $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE debtor_no='" . $_POST['customer_id'] . "'"; + $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE debtor_no=$sel_id"; $result = db_query($sql,"check failed"); $myrow = db_fetch_row($result); if ($myrow[0] > 0) @@ -158,7 +158,7 @@ if (isset($_POST['delete'])) } else { - $sql = "SELECT COUNT(*) FROM ".TB_PREF."cust_branch WHERE debtor_no='" . $_POST['customer_id'] . "'"; + $sql = "SELECT COUNT(*) FROM ".TB_PREF."cust_branch WHERE debtor_no=$sel_id"; $result = db_query($sql,"check failed"); $myrow = db_fetch_row($result); if ($myrow[0] > 0) @@ -172,7 +172,7 @@ if (isset($_POST['delete'])) if ($cancel_delete == 0) { //ie not cancelled the delete as a result of above tests - $sql = "DELETE FROM ".TB_PREF."debtors_master WHERE debtor_no='" . $_POST['customer_id'] . "'"; + $sql = "DELETE FROM ".TB_PREF."debtors_master WHERE debtor_no=$sel_id"; db_query($sql,"cannot delete customer"); display_notification(_("Selected customer has been deleted.")); @@ -218,7 +218,7 @@ if ($new_customer) else { - $sql = "SELECT * FROM ".TB_PREF."debtors_master WHERE debtor_no = '" . $_POST['customer_id'] . "'"; + $sql = "SELECT * FROM ".TB_PREF."debtors_master WHERE debtor_no = ".db_escape($_POST['customer_id']); $result = db_query($sql,"check failed"); $myrow = db_fetch($result); -- 2.30.2