Security sql statements update against sql injection attacks.

[fa-stable.git] / sales / includes / db / custalloc_db.inc

diff --git a/sales/includes/db/custalloc_db.inc b/sales/includes/db/custalloc_db.inc
index e9695bbcd3f9bbde574ca4078ca4ec5fe350f4c4..80bc9213812e51ad29cbd952f88eae289681fcc9 100644 (file)
--- a/sales/includes/db/custalloc_db.inc
+++ b/sales/includes/db/custalloc_db.inc
@@ -17,7 +17,8 @@ function add_cust_allocation($amount, $trans_type_from, $trans_no_from,
        $sql = "INSERT INTO ".TB_PREF."cust_allocations (
                amt, date_alloc,
                trans_type_from, trans_no_from, trans_no_to, trans_type_to)
-               VALUES ($amount, Now(), $trans_type_from, $trans_no_from, $trans_no_to, $trans_type_to)";
+               VALUES ($amount, Now(), ".db_escape($trans_type_from).", ".db_escape($trans_no_from).", ".db_escape($trans_no_to)
+               .", ".db_escape($trans_type_to).")";
 
        db_query($sql, "A customer allocation could not be added to the database");
 }
@@ -27,7 +28,7 @@ function add_cust_allocation($amount, $trans_type_from, $trans_no_from,
 
 function delete_cust_allocation($trans_id)
 {
-       $sql = "DELETE FROM ".TB_PREF."cust_allocations WHERE id = " . $trans_id;
+       $sql = "DELETE FROM ".TB_PREF."cust_allocations WHERE id = ".db_escape($trans_id);
        return db_query($sql, "The existing allocation $trans_id could not be deleted");
 }
 
@@ -37,7 +38,7 @@ function get_DebtorTrans_allocation_balance($trans_type, $trans_no)
 {
 
        $sql = "SELECT (ov_amount+ov_gst+ov_freight+ov_freight_tax-ov_discount-alloc) AS BalToAllocate
-               FROM ".TB_PREF."debtor_trans WHERE trans_no=$trans_no AND type=$trans_type";
+               FROM ".TB_PREF."debtor_trans WHERE trans_no=".db_escape($trans_no)." AND type=".db_escape($trans_type);
        $result = db_query($sql,"calculate the allocation");
        $myrow = db_fetch_row($result);
 
@@ -49,7 +50,7 @@ function get_DebtorTrans_allocation_balance($trans_type, $trans_no)
 function update_debtor_trans_allocation($trans_type, $trans_no, $alloc)
 {
        $sql = "UPDATE ".TB_PREF."debtor_trans SET alloc = alloc + $alloc
-               WHERE type=$trans_type AND trans_no = $trans_no";
+               WHERE type=".db_escape($trans_type)." AND trans_no = ".db_escape($trans_no);
        db_query($sql, "The debtor transaction record could not be modified for the allocation against it");
 }
 
@@ -66,8 +67,8 @@ function clear_cust_alloctions($type, $type_no, $date="")
 {
        // clear any allocations for this transaction
        $sql = "SELECT * FROM ".TB_PREF."cust_allocations
-               WHERE (trans_type_from=$type AND trans_no_from=$type_no)
-               OR (trans_type_to=$type AND trans_no_to=$type_no)";
+               WHERE (trans_type_from=".db_escape($type)." AND trans_no_from=".db_escape($type_no).")
+               OR (trans_type_to=".db_escape($type)." AND trans_no_to=".db_escape($type_no).")";
        $result = db_query($sql, "could not void debtor transactions for type=$type and trans_no=$type_no");
 
        while ($row = db_fetch($result))
@@ -86,8 +87,8 @@ function clear_cust_alloctions($type, $type_no, $date="")
 
        // remove any allocations for this transaction
        $sql = "DELETE FROM ".TB_PREF."cust_allocations
-               WHERE (trans_type_from=$type AND trans_no_from=$type_no)
-               OR (trans_type_to=$type AND trans_no_to=$type_no)";
+               WHERE (trans_type_from=".db_escape($type)." AND trans_no_from=".db_escape($type_no).")
+               OR (trans_type_to=".db_escape($type)." AND trans_no_to=".db_escape($type_no).")";
 
        db_query($sql, "could not void debtor transactions for type=$type and trans_no=$type_no");
 }
@@ -136,7 +137,7 @@ function get_allocatable_from_cust_sql($customer_id, $settled)
        }
        $cust_sql = "";
        if ($customer_id != null)
-               $cust_sql = " AND trans.debtor_no = $customer_id";
+               $cust_sql = " AND trans.debtor_no = ".db_escape($customer_id);
 
        $sql = get_alloc_trans_sql("round(ov_amount+ov_gst+ov_freight+ov_freight_tax+ov_discount-alloc,6) <= 0 AS settled",
                "(type=12 OR type=11 OR type=2) AND (trans.ov_amount > 0) " . $settled_sql . $cust_sql);
@@ -154,7 +155,7 @@ function get_allocatable_to_cust_transactions($customer_id, $trans_no=null, $typ
                        AND trans.type = alloc.trans_type_to
                        AND alloc.trans_no_from=$trans_no
                        AND alloc.trans_type_from=$type
-                       AND trans.debtor_no=$customer_id",
+                       AND trans.debtor_no=".db_escape($customer_id),
                        "".TB_PREF."cust_allocations as alloc");
        }
        else
@@ -164,7 +165,7 @@ function get_allocatable_to_cust_transactions($customer_id, $trans_no=null, $typ
                        AND trans.type != " . systypes::bank_deposit() . "
                        AND trans.type != 11
                        AND trans.type != 13
-                       AND trans.debtor_no=$customer_id");
+                       AND trans.debtor_no=".db_escape($customer_id));
        }
 
        return db_query($sql." ORDER BY trans_no", "Cannot retreive alloc to transactions");