Security statements update against sql injection attacks.

[fa-stable.git] / manufacturing / includes / db / work_order_issues_db.inc

diff --git a/manufacturing/includes/db/work_order_issues_db.inc b/manufacturing/includes/db/work_order_issues_db.inc
index 0df0684652b2e1987858f2cc9f8c79f36dacc724..23d07caa03d8f8b0f141a58dabc2ce11492b8575 100644 (file)
--- a/manufacturing/includes/db/work_order_issues_db.inc
+++ b/manufacturing/includes/db/work_order_issues_db.inc
@@ -34,8 +34,8 @@ function add_work_order_issue($woid, $ref, $to_work_order, $items, $location, $w
 
        // insert the actual issue
        $sql = "INSERT INTO ".TB_PREF."wo_issues (workorder_id, reference, issue_date, loc_code, workcentre_id)
-               VALUES ($woid, ".db_escape($ref).", '" .
-               date2sql($date_) . "', ".db_escape($location).", $workcentre)";
+               VALUES (".db_escape($woid).", ".db_escape($ref).", '" .
+               date2sql($date_) . "', ".db_escape($location).", ".db_escape($workcentre).")";
        db_query($sql,"The work order issue could not be added");
 
        $number = db_insert_id();
@@ -51,7 +51,8 @@ function add_work_order_issue($woid, $ref, $to_work_order, $items, $location, $w
                        $location, $date_, $memo_, -$item->quantity, 0);
 
                $sql = "INSERT INTO ".TB_PREF."wo_issue_items (issue_id, stock_id, qty_issued)
-                       VALUES ('$number', '$item->stock_id', $item->quantity)";
+                       VALUES (".db_escape($number).", ".db_escape($item->stock_id).", "
+                       .db_escape($item->quantity).")";
                db_query($sql,"A work order issue item could not be added");
        }
 
@@ -67,7 +68,8 @@ function add_work_order_issue($woid, $ref, $to_work_order, $items, $location, $w
 
 function get_work_order_issues($woid)
 {
-       $sql = "SELECT * FROM ".TB_PREF."wo_issues WHERE workorder_id=$woid ORDER BY issue_no";
+       $sql = "SELECT * FROM ".TB_PREF."wo_issues WHERE workorder_id=".db_escape($woid)
+       ." ORDER BY issue_no";
     return db_query($sql, "The work order issues could not be retrieved");
 }
 
@@ -76,7 +78,8 @@ function get_additional_issues($woid)
        $sql = "SELECT ".TB_PREF."wo_issues.*, ".TB_PREF."wo_issue_items.*
                FROM ".TB_PREF."wo_issues, ".TB_PREF."wo_issue_items
                WHERE ".TB_PREF."wo_issues.issue_no=".TB_PREF."wo_issue_items.issue_id
-               AND ".TB_PREF."wo_issues.workorder_id=$woid ORDER BY ".TB_PREF."wo_issue_items.id";
+               AND ".TB_PREF."wo_issues.workorder_id=".db_escape($woid)
+               ." ORDER BY ".TB_PREF."wo_issue_items.id";
     return db_query($sql, "The work order issues could not be retrieved");
 }
 //--------------------------------------------------------------------------------------
@@ -84,9 +87,11 @@ function get_additional_issues($woid)
 function get_work_order_issue($issue_no)
 {
        $sql = "SELECT DISTINCT ".TB_PREF."wo_issues.*, ".TB_PREF."workorders.stock_id,
-               ".TB_PREF."stock_master.description, ".TB_PREF."locations.location_name, ".TB_PREF."workcentres.name AS WorkCentreName
-               FROM ".TB_PREF."wo_issues, ".TB_PREF."workorders, ".TB_PREF."stock_master, ".TB_PREF."locations, ".TB_PREF."workcentres
-               WHERE issue_no='$issue_no'
+               ".TB_PREF."stock_master.description, ".TB_PREF."locations.location_name, "
+               .TB_PREF."workcentres.name AS WorkCentreName
+               FROM ".TB_PREF."wo_issues, ".TB_PREF."workorders, ".TB_PREF."stock_master, "
+               .TB_PREF."locations, ".TB_PREF."workcentres
+               WHERE issue_no=".db_escape($issue_no)."
                AND ".TB_PREF."workorders.id = ".TB_PREF."wo_issues.workorder_id
                AND ".TB_PREF."locations.loc_code = ".TB_PREF."wo_issues.loc_code
                AND ".TB_PREF."workcentres.id = ".TB_PREF."wo_issues.workcentre_id
@@ -100,9 +105,10 @@ function get_work_order_issue($issue_no)
 
 function get_work_order_issue_details($issue_no)
 {
-       $sql = "SELECT ".TB_PREF."wo_issue_items.*,".TB_PREF."stock_master.description, ".TB_PREF."stock_master.units
+       $sql = "SELECT ".TB_PREF."wo_issue_items.*,"
+       .TB_PREF."stock_master.description, ".TB_PREF."stock_master.units
                FROM ".TB_PREF."wo_issue_items, ".TB_PREF."stock_master
-               WHERE issue_id=$issue_no
+               WHERE issue_id=".db_escape($issue_no)."
                AND ".TB_PREF."stock_master.stock_id=".TB_PREF."wo_issue_items.stock_id
                ORDER BY ".TB_PREF."wo_issue_items.id";
     return db_query($sql, "The work order issue items could not be retrieved");
@@ -112,7 +118,7 @@ function get_work_order_issue_details($issue_no)
 
 function exists_work_order_issue($issue_no)
 {
-       $sql = "SELECT issue_no FROM ".TB_PREF."wo_issues WHERE issue_no=$issue_no";
+       $sql = "SELECT issue_no FROM ".TB_PREF."wo_issues WHERE issue_no=".db_escape($issue_no);
        $result = db_query($sql, "Cannot retreive a wo issue");
 
     return (db_num_rows($result) > 0);
@@ -125,7 +131,8 @@ function void_work_order_issue($type_no)
        begin_transaction();
 
        // void the actual issue items and their quantities
-       $sql = "UPDATE ".TB_PREF."wo_issue_items Set qty_issued = 0 WHERE issue_id=$type_no";
+       $sql = "UPDATE ".TB_PREF."wo_issue_items Set qty_issued = 0 WHERE issue_id="
+               .db_escape($type_no);
        db_query($sql,"A work order issue item could not be voided");
 
        // void all related stock moves