Sealing against XSS atacks: purchasing,sales,install,admin,taxes

diff --git a/admin/db/maintenance_db.inc b/admin/db/maintenance_db.inc
index b2583d5c9b8f9f959ce24af20e7f0cd749029e9c..444ac100d2f3cc72b0f32f2827dab98578e9742f 100644 (file)
--- a/admin/db/maintenance_db.inc
+++ b/admin/db/maintenance_db.inc
@@ -411,7 +411,7 @@ function db_export($conn, $filename, $zip='no', $comment='')
                                        // run through each field
                                        for ($k = 0; $k < $nf = db_num_fields($res2); $k++)
                                        {
-                                               $out .= db_escape($row2[$k], true);
+                                               $out .= db_escape($row2[$k]);
                                                if ($k < ($nf - 1))
                                                        $out .= ", ";
                                        }

diff --git a/install/save.php b/install/save.php
index 0c786f26bd5cf2f9ea8abc953264dfa660629dea..e6de3fe9297251518ee9e0a22e4a68f325365fbb 100644 (file)
--- a/install/save.php
+++ b/install/save.php
@@ -348,9 +348,9 @@ else
 {
        mysql_select_db($database_name, $db);
 }
-$sql = "UPDATE ".$table_prefix."users SET password = '" . md5($admin_password) . "', email = '$admin_email' WHERE user_id = 'admin'";
+$sql = "UPDATE ".$table_prefix."users SET password = '" . md5($admin_password) . "', email = ".db_escape($admin_email)." WHERE user_id = 'admin'";
 db_query($sql, "could not update admin account");
-$sql = "UPDATE ".$table_prefix."company SET coy_name = '$company_name' WHERE coy_code = 1";
+$sql = "UPDATE ".$table_prefix."company SET coy_name = ".db_escape($company_name)." WHERE coy_code = 1";
 db_query($sql, "could not update company name. Do it manually later in Setup");
 
 session_unset();

diff --git a/purchasing/includes/db/grn_db.inc b/purchasing/includes/db/grn_db.inc
index 81b11bb97ed22c8b755f510e8d5bd6ca2862e480..90b5528af8cd89fde575b010ede2f18e5cd7bb96 100644 (file)
--- a/purchasing/includes/db/grn_db.inc
+++ b/purchasing/includes/db/grn_db.inc
@@ -39,7 +39,7 @@ function add_grn(&$po, $date_, $reference, $location)
                        else
                                $material_cost = ($qoh * $material_cost + $order_line->receive_qty * $price_in_home_currency) /
                                        ($qoh + $order_line->receive_qty);
-                       $sql = "UPDATE ".TB_PREF."stock_master SET material_cost=$material_cost
+                       $sql = "UPDATE ".TB_PREF."stock_master SET material_cost=".db_escape($material_cost)."
                                WHERE stock_id='$order_line->stock_id'";
                        db_query($sql,"The cost details for the inventory item could not be updated");
                        //----------------------------------------------------------------------------------------------------------------
@@ -73,7 +73,8 @@ function add_grn_batch($po_number, $supplier_id, $reference, $location, $date_)
        $date = date2sql($date_);
 
        $sql = "INSERT INTO ".TB_PREF."grn_batch (purch_order_no, delivery_date, supplier_id, reference, loc_code)
-                       VALUES ($po_number, '$date', '$supplier_id', '$reference', '$location')";
+                       VALUES (".db_escape($po_number).", ".db_escape($date).", "
+                       .db_escape($supplier_id).", ".db_escape($reference).", ".db_escape($location).")";
 
        db_query($sql, "A grn batch record could not be inserted.");
 
@@ -93,7 +94,7 @@ function add_grn_detail_item($grn_batch_id, $po_detail_item, $item_code, $descri
        db_query($sql, "a purchase order details record could not be updated. This receipt of goods has not been processed ");
 
        $sql = "INSERT INTO ".TB_PREF."grn_items (grn_batch_id, po_detail_item, item_code, description, qty_recd)
-               VALUES ($grn_batch_id, $po_detail_item, '$item_code', '$description', $quantity_received)";
+               VALUES ($grn_batch_id, $po_detail_item, ".db_escape($item_code).", ".db_escape($description).", $quantity_received)";
 
        db_query($sql, "A GRN detail item could not be inserted.");
 

diff --git a/purchasing/includes/db/invoice_items_db.inc b/purchasing/includes/db/invoice_items_db.inc
index 18ff4aa9ba37f609783d7f5f2a73c5ebd29e5e8d..621309bb0464dcb21bd2d1171c008d3e784fc53e 100644 (file)
--- a/purchasing/includes/db/invoice_items_db.inc
+++ b/purchasing/includes/db/invoice_items_db.inc
@@ -8,8 +8,9 @@ function add_supp_invoice_item($supp_trans_type, $supp_trans_no, $stock_id, $des
 {
        $sql = "INSERT INTO ".TB_PREF."supp_invoice_items (supp_trans_type, supp_trans_no, stock_id, description, gl_code, unit_price, unit_tax, quantity,
                grn_item_id, po_detail_item_id, memo_) ";
-       $sql .= "VALUES ($supp_trans_type, $supp_trans_no, '$stock_id', '$description', '$gl_code', $unit_price, $unit_tax, $quantity,
-               $grn_item_id, $po_detail_item_id, '$memo_')";
+       $sql .= "VALUES ($supp_trans_type, $supp_trans_no, ".db_escape($stock_id).
+       ", ".db_escape($description).", ".db_escape($gl_code).", $unit_price, $unit_tax, $quantity,
+               $grn_item_id, $po_detail_item_id, ".db_escape($memo_).")";
 
        if ($err_msg == "")
                $err_msg = "Cannot insert a supplier transaction detail record";

diff --git a/purchasing/includes/db/po_db.inc b/purchasing/includes/db/po_db.inc
index ba2740e927f1b0dc296bd0bd7c9d20c9a7409ffd..cb2a1e49cfeca3cd93e2a8af32575a2f5023e415 100644 (file)
--- a/purchasing/includes/db/po_db.inc
+++ b/purchasing/includes/db/po_db.inc
@@ -19,7 +19,7 @@ function add_po(&$po_obj)
 
      /*Insert to purchase order header record */
      $sql = "INSERT INTO ".TB_PREF."purch_orders (supplier_id, Comments, ord_date, reference, requisition_no, into_stock_location, delivery_address) VALUES(";
-     $sql .= "' ". $po_obj->supplier_id . "'," .
+     $sql .= db_escape($po_obj->supplier_id) . "," .
          db_escape($po_obj->Comments) . ",'" .
          date2sql($po_obj->orig_order_date) . "', '" .
                 $po_obj->reference . "', " .

diff --git a/purchasing/includes/db/supp_trans_db.inc b/purchasing/includes/db/supp_trans_db.inc
index 6526093b2ff26bf13fccd7e741dbebab478d0b6d..b38e787ab03eea1683779edddc0d88cf1ff3cdc6 100644 (file)
--- a/purchasing/includes/db/supp_trans_db.inc
+++ b/purchasing/includes/db/supp_trans_db.inc
@@ -17,7 +17,7 @@ function add_supp_trans($type, $supplier_id, $date_, $due_date, $reference, $sup
        $sql = "INSERT INTO ".TB_PREF."supp_trans (trans_no, type, supplier_id, tran_date, due_date, 
                reference, supp_reference, ov_amount, ov_gst, rate, ov_discount) ";
        $sql .= "VALUES ($trans_no, $type, $supplier_id, '$date', '$due_date',
-               '$reference', '$supp_reference', $amount, $amount_tax, $rate, $discount)";
+               ".db_escape($reference).", ".db_escape($supp_reference).", $amount, $amount_tax, $rate, $discount)";
        
        if ($err_msg == "")
                $err_msg = "Cannot insert a supplier transaction record";

diff --git a/purchasing/manage/suppliers.php b/purchasing/manage/suppliers.php
index b1866cd1ac47d4896bca3bcae112d640cc99a7b6..fbaabbca01610f4eee656aed6d34cf4b34ec75a5 100644 (file)
--- a/purchasing/manage/suppliers.php
+++ b/purchasing/manage/suppliers.php
@@ -46,18 +46,18 @@ if (isset($_POST['submit']))
                if (!isset($_POST['New'])) 
                {
 
-                       $sql = "UPDATE ".TB_PREF."suppliers SET supp_name='" . $_POST['supp_name'] . "',
-                address='" . $_POST['address'] . "',
-                email='" . $_POST['email'] . "',
-                bank_account='" . $_POST['bank_account'] . "',
-                dimension_id=" . $_POST['dimension_id'] . ",
-                dimension2_id=" . $_POST['dimension2_id'] . ",
-                curr_code='" . $_POST['curr_code'] . "',
-                payment_terms='" . $_POST['payment_terms'] . "',
-                               payable_account='" . $_POST['payable_account'] . "',
-                               purchase_account='" . $_POST['purchase_account'] . "',
-                               payment_discount_account='" . $_POST['payment_discount_account'] . "',
-                               tax_group_id=" . $_POST['tax_group_id'] . " WHERE supplier_id = '" . $_POST['supplier_id'] . "'";
+                       $sql = "UPDATE ".TB_PREF."suppliers SET supp_name=".db_escape($_POST['supp_name']) . ",
+                address=".db_escape($_POST['address']) . ",
+                email=".db_escape($_POST['email']) . ",
+                bank_account=".db_escape($_POST['bank_account']) . ",
+                dimension_id=".db_escape($_POST['dimension_id']) . ",
+                dimension2_id=".db_escape($_POST['dimension2_id']) . ",
+                curr_code=".db_escape($_POST['curr_code']).",
+                payment_terms=".db_escape($_POST['payment_terms']) . ",
+                               payable_account=".db_escape($_POST['payable_account']) . ",
+                               purchase_account=".db_escape($_POST['purchase_account']) . ",
+                               payment_discount_account=".db_escape($_POST['payment_discount_account']) . ",
+                               tax_group_id=".db_escape($_POST['tax_group_id']) . " WHERE supplier_id = '" . $_POST['supplier_id'] . "'";
 
                        db_query($sql,"The supplier could not be updated");
 
@@ -67,18 +67,18 @@ if (isset($_POST['submit']))
 
                        $sql = "INSERT INTO ".TB_PREF."suppliers (supp_name, address, email, bank_account, dimension_id, dimension2_id, curr_code,
                                payment_terms, payable_account, purchase_account, payment_discount_account, tax_group_id)
-                               VALUES ('" . $_POST['supp_name'] . "', '" .
-                               $_POST['address'] . "', '" .
-                               $_POST['email'] . "', '" .
-                               $_POST['bank_account'] . "', " .
-                               $_POST['dimension_id'] . ", " .
-                               $_POST['dimension2_id'] . ", '" .
-                               $_POST['curr_code'] . "', '" .
-                               $_POST['payment_terms'] . "', '" .
-                               $_POST['payable_account'] . "', '" .
-                               $_POST['purchase_account'] . "', '" .
-                               $_POST['payment_discount_account'] . "', " .
-                               $_POST['tax_group_id'] . ")";
+                               VALUES (".db_escape($_POST['supp_name']). ", "
+                               .db_escape($_POST['address']) . ", "
+                               .db_escape($_POST['email']). ", "
+                               .db_escape($_POST['bank_account']). ", "
+                               .db_escape($_POST['dimension_id']). ", "
+                               .db_escape($_POST['dimension2_id']). ", "
+                               .db_escape($_POST['curr_code']). ", "
+                               .db_escape($_POST['payment_terms']). ", "
+                               .db_escape($_POST['payable_account']). ", "
+                               .db_escape($_POST['purchase_account']). ", "
+                               .db_escape($_POST['payment_discount_account']). ", "
+                               .db_escape($_POST['tax_group_id']). ")";
 
                        db_query($sql,"The supplier could not be added");
                }

diff --git a/sales/includes/db/credit_status_db.inc b/sales/includes/db/credit_status_db.inc
index 4bf0bdd96bdedff43f847d1c854b9e63516c05c8..0bcabe7071ce823399d5d54015f8134f9aa38204 100644 (file)
--- a/sales/includes/db/credit_status_db.inc
+++ b/sales/includes/db/credit_status_db.inc
@@ -3,14 +3,14 @@
 function add_credit_status($description, $disallow_invoicing)
 {
        $sql = "INSERT INTO ".TB_PREF."credit_status (reason_description, dissallow_invoices) 
-               VALUES ('$description',$disallow_invoicing)";
+               VALUES (".db_escape($description).",$disallow_invoicing)";
                
        db_query($sql, "could not add credit status");          
 }
 
 function update_credit_status($status_id, $description, $disallow_invoicing)
 {
-       $sql = "UPDATE ".TB_PREF."credit_status SET reason_description='$description',
+       $sql = "UPDATE ".TB_PREF."credit_status SET reason_description=".db_escape($description).",
                dissallow_invoices=$disallow_invoicing WHERE id=$status_id";
        
        db_query($sql, "could not update credit status");                       

diff --git a/sales/includes/db/cust_trans_db.inc b/sales/includes/db/cust_trans_db.inc
index 5e403c51c79de6858bdf1246c5e436b9fc340d1b..dde04fe7cd687e39135359df141a45e6fade34a7 100644 (file)
--- a/sales/includes/db/cust_trans_db.inc
+++ b/sales/includes/db/cust_trans_db.inc
@@ -99,18 +99,20 @@ function write_customer_trans($trans_type, $trans_no, $debtor_no, $BranchNo,
                order_, ov_amount, ov_discount,
                ov_gst, ov_freight, ov_freight_tax,
                rate, ship_via, alloc, trans_link
-               ) VALUES ($trans_no, $trans_type, '$debtor_no', '$BranchNo',
-               '$SQLDate', '$SQLDueDate', '$reference',
-               '$sales_type', $order_no, $Total, $discount, $Tax, $Freight,
-               $FreightTax, $rate, '$ship_via', $AllocAmt, $trans_link)";
+               ) VALUES ($trans_no, $trans_type, 
+               ".db_escape($debtor_no).", ".db_escape($BranchNo).",
+               '$SQLDate', '$SQLDueDate', ".db_escape($reference).",
+               ".db_escape($sales_type).", $order_no, $Total, ".db_escape($discount).", $Tax, 
+               ".db_escape($Freight).",
+               $FreightTax, $rate, ".db_escape($ship_via).", $AllocAmt, ".db_escape($trans_link);
        } else {        // may be optional argument should stay unchanged ?
        $sql = "UPDATE ".TB_PREF."debtor_trans SET
-               debtor_no='$debtor_no' , branch_code='$BranchNo',
+               debtor_no=".db_escape($debtor_no)." , branch_code=".db_escape($BranchNo).",
                tran_date='$SQLDate', due_date='$SQLDueDate',
-               reference='$reference', tpe='$sales_type', order_=$order_no,
-               ov_amount=$Total, ov_discount=$discount, ov_gst=$Tax,
-               ov_freight=$Freight, ov_freight_tax=$FreightTax, rate=$rate,
-               ship_via='$ship_via', alloc=$AllocAmt, trans_link=$trans_link
+               reference=".db_escape($reference).", tpe=".db_escape($sales_type).", order_=$order_no,
+               ov_amount=$Total, ov_discount=".db_escape($discount).", ov_gst=$Tax,
+               ov_freight=".db_escape($Freight).", ov_freight_tax=$FreightTax, rate=$rate,
+               ship_via=".db_escape($ship_via).", alloc=$AllocAmt, trans_link=$trans_link
                WHERE trans_no=$trans_no AND type=$trans_type";
        }
        db_query($sql, "The debtor transaction record could not be inserted");

diff --git a/sales/includes/db/cust_trans_details_db.inc b/sales/includes/db/cust_trans_details_db.inc
index ebe79a56461cfbf27a88c18a96d577791dbbaa97..b44c1d5f12e41d4922e8a5c8cfa03c7efacf3a17 100644 (file)
--- a/sales/includes/db/cust_trans_details_db.inc
+++ b/sales/includes/db/cust_trans_details_db.inc
@@ -84,8 +84,8 @@ function write_customer_trans_detail_item($debtor_trans_type, $debtor_trans_no,
 {
        if ($line_id!=0)
                $sql = "UPDATE ".TB_PREF."debtor_trans_details SET
-                       stock_id='$stock_id',
-                       description='$description',
+                       stock_id=".db_escape($stock_id).",
+                       description=".db_escape($description).",
                        quantity=$quantity,
                        unit_price=$unit_price,
                        unit_tax=$unit_tax,
@@ -96,7 +96,8 @@ function write_customer_trans_detail_item($debtor_trans_type, $debtor_trans_no,
                        $sql = "INSERT INTO ".TB_PREF."debtor_trans_details (debtor_trans_no,
                                debtor_trans_type, stock_id, description, quantity, unit_price,
                                unit_tax, discount_percent, standard_cost)
-                       VALUES ($debtor_trans_no, $debtor_trans_type, '$stock_id', '$description',
+                       VALUES ($debtor_trans_no, $debtor_trans_type, ".db_escape($stock_id).
+                       ", ".db_escape($description).",
                                $quantity, $unit_price, $unit_tax, $discount_percent, $std_cost)";
 
        db_query($sql, "The debtor transaction detail could not be written");

diff --git a/sales/includes/db/sales_order_db.inc b/sales/includes/db/sales_order_db.inc
index cb8e416b4ec4b610185a7c6ab69c20a18f38e333..0e51a907dcb748a7375737625400aecd2a8b09b0 100644 (file)
--- a/sales/includes/db/sales_order_db.inc
+++ b/sales/includes/db/sales_order_db.inc
@@ -54,20 +54,20 @@ function add_sales_order(&$order)
        $sql = "INSERT INTO ".TB_PREF."sales_orders (type, debtor_no, branch_code, customer_ref, comments, ord_date,
                order_type, ship_via, deliver_to, delivery_address, contact_phone,
                contact_email, freight_cost, from_stk_loc, delivery_date)
-               VALUES (" .db_quote($order_type) . "," . db_quote($order->customer_id) .
-                ", " . db_quote($order->Branch) . ", ".
-                       db_quote($order->cust_ref) .",". 
-                       db_quote($order->Comments) .",'" . 
+               VALUES (" .db_escape($order_type) . "," . db_escape($order->customer_id) .
+                ", " . db_escape($order->Branch) . ", ".
+                       db_escape($order->cust_ref) .",". 
+                       db_escape($order->Comments) .",'" . 
                        date2sql($order->document_date) . "', " .
-                       db_quote($order->sales_type) . ", " .
+                       db_escape($order->sales_type) . ", " .
                        $_POST['ship_via'] ."," . 
-                       db_quote($order->deliver_to) . "," .
-                       db_quote($order->delivery_address) . ", " .
-                       db_quote($order->phone) . ", " . 
-                       db_quote($order->email) . ", " .
-                       db_quote($order->freight_cost) .", " . 
-                       db_quote($order->Location) .", " .
-                       db_quote($del_date) . ")";
+                       db_escape($order->deliver_to) . "," .
+                       db_escape($order->delivery_address) . ", " .
+                       db_escape($order->phone) . ", " . 
+                       db_escape($order->email) . ", " .
+                       db_escape($order->freight_cost) .", " . 
+                       db_escape($order->Location) .", " .
+                       db_escape($del_date) . ")";
 
        db_query($sql, "order Cannot be Added");
 
@@ -111,7 +111,8 @@ function add_sales_order(&$order)
 
                $sql = "INSERT INTO ".TB_PREF."sales_order_details (order_no, stk_code, description, unit_price, quantity, discount_percent) VALUES (";
                $sql .= $order_no .
-                               ",'$line->stock_id', '$line->item_description', $line->price,
+                               ",".db_escape($line->stock_id).", "
+                               .db_escape($line->item_description).", $line->price,
                                $line->quantity,
                                $line->discount_percent)";
                db_query($sql, "order Details Cannot be Added");
@@ -182,24 +183,23 @@ function update_sales_order($order)
        begin_transaction();
 
        $sql = "UPDATE ".TB_PREF."sales_orders SET type =".$order->so_type." ,
-               debtor_no = " . db_quote($order->customer_id) . ",
-               branch_code = " . db_quote($order->Branch) . ",
-               customer_ref = ". db_quote($order->cust_ref) .",
-               comments = ". db_quote($order->Comments) .",
-               ord_date = " . db_quote($ord_date) . ",
-               order_type = " .db_quote($order->sales_type) . ",
-               ship_via = " . db_quote($order->ship_via) .",
-               deliver_to = " . db_quote($order->deliver_to) . ",
-               delivery_address = " . db_quote($order->delivery_address) . ",
-               contact_phone = " .db_quote($order->phone) . ",
-               contact_email = " .db_quote($order->email) . ",
-               freight_cost = " .db_quote($order->freight_cost) .",
-               from_stk_loc = " .db_quote($order->Location) .",
-               delivery_date = " .db_quote($del_date). ",
+               debtor_no = " . db_escape($order->customer_id) . ",
+               branch_code = " . db_escape($order->Branch) . ",
+               customer_ref = ". db_escape($order->cust_ref) .",
+               comments = ". db_escape($order->Comments) .",
+               ord_date = " . db_escape($ord_date) . ",
+               order_type = " .db_escape($order->sales_type) . ",
+               ship_via = " . db_escape($order->ship_via) .",
+               deliver_to = " . db_escape($order->deliver_to) . ",
+               delivery_address = " . db_escape($order->delivery_address) . ",
+               contact_phone = " .db_escape($order->phone) . ",
+               contact_email = " .db_escape($order->email) . ",
+               freight_cost = " .db_escape($order->freight_cost) .",
+               from_stk_loc = " .db_escape($order->Location) .",
+               delivery_date = " .db_escape($del_date). ",
                version = ".($version+1)."
         WHERE order_no=" . $order_no ."
         AND version=".$version;
-
        db_query($sql, "order Cannot be Updated, this can be concurrent edition conflict");
 
        $sql = "DELETE FROM ".TB_PREF."sales_order_details WHERE order_no =" . $order_no;
@@ -247,13 +247,13 @@ function update_sales_order($order)
                 (order_no, stk_code,  description, unit_price, quantity,
                  discount_percent, qty_sent)
                 VALUES (";
-               $sql .= $order_no . ",'"
-                 .$line->stock_id . "','"
-                 .$line->item_description . "', "
-                 .$line->price . ", "
-                 .$line->quantity . ", "
-                 .$line->discount_percent . ", "
-                 .$line->qty_done ." )";
+               $sql .= $order_no . ","
+                 .db_escape($line->stock_id) . ","
+                 .db_escape($line->item_description) . ", "
+                 .db_escape($line->price) . ", "
+                 .db_escape($line->quantity) . ", "
+                 .db_escape($line->discount_percent) . ", "
+                 .db_escape($line->qty_done) ." )";
 
                db_query($sql, "Old order Cannot be Inserted");
 

diff --git a/sales/includes/db/sales_types_db.inc b/sales/includes/db/sales_types_db.inc
index 338ae59b309b7ea48ae942dec5d16697304dc005..51e1142b39a6912e2037f2af139cec16333e1a23 100644 (file)
--- a/sales/includes/db/sales_types_db.inc
+++ b/sales/includes/db/sales_types_db.inc
@@ -2,14 +2,14 @@
 
 function add_sales_type($name, $tax_included)
 {
-       $sql = "INSERT INTO ".TB_PREF."sales_types (sales_type,tax_included) VALUES ('$name','$tax_included')";
+       $sql = "INSERT INTO ".TB_PREF."sales_types (sales_type,tax_included) VALUES (".db_escape($name).",'$tax_included')";
                
        db_query($sql, "could not add sales type");             
 }
 
 function update_sales_type($id, $name, $tax_included)
 {
-       $sql = "UPDATE ".TB_PREF."sales_types SET sales_type = '$name',
+       $sql = "UPDATE ".TB_PREF."sales_types SET sales_type = ".db_escape($name).",
        tax_included =$tax_included WHERE id = $id";
        
        db_query($sql, "could not update sales type");                  

diff --git a/sales/manage/customer_branches.php b/sales/manage/customer_branches.php
index ef2b2db91bfdc10473575e6ae780f9de25ae9251..1ca32ec712908bd5e09b2df92a257d2dd75f7519 100644 (file)
--- a/sales/manage/customer_branches.php
+++ b/sales/manage/customer_branches.php
@@ -63,25 +63,25 @@ if (isset($_POST['ADD_ITEM']) || isset($_POST['UPDATE_ITEM']))
                {
                        /*SelectedBranch could also exist if submit had not been clicked this code would not run in this case cos submit is false of course see the     delete code below*/
 
-                       $sql = "UPDATE ".TB_PREF."cust_branch SET br_name = '" . $_POST['br_name'] . "',
-                               br_address = '" . $_POST['br_address'] . "',
-               phone='" . $_POST['phone'] . "',
-               fax='" . $_POST['fax'] . "',
-               contact_name='" . $_POST['contact_name'] . "',
-               salesman= '" . $_POST['salesman'] . "',
-               area='" . $_POST['area'] . "',
-               email='" . $_POST['email'] . "',
-               tax_group_id=" . $_POST['tax_group_id'] . ",
-                               sales_account='" . $_POST['sales_account'] . "',
-                               sales_discount_account='" . $_POST['sales_discount_account'] . "',
-                               receivables_account='" . $_POST['receivables_account'] . "',
-                               payment_discount_account='" . $_POST['payment_discount_account'] . "',
-               default_location='" . $_POST['default_location'] . "',
-               br_post_address = '" . $_POST['br_post_address'] . "',
-               disable_trans=" . $_POST['disable_trans'] . ",
-               default_ship_via=" . $_POST['default_ship_via'] . "
-               WHERE branch_code = '" . $_POST['branch_code'] . "'
-               AND debtor_no='" . $_POST['customer_id']. "'";
+                       $sql = "UPDATE ".TB_PREF."cust_branch SET br_name = " . db_escape($_POST['br_name']) . ",
+                               br_address = ".db_escape($_POST['br_address']). ",
+               phone=".db_escape($_POST['phone']). ",
+               fax=".db_escape($_POST['fax']).",
+               contact_name=".db_escape($_POST['contact_name']) . ",
+               salesman= ".db_escape($_POST['salesman']) . ",
+               area=".db_escape($_POST['area']) . ",
+               email=".db_escape($_POST['email']) . ",
+               tax_group_id=".db_escape($_POST['tax_group_id']). ",
+                               sales_account=".db_escape($_POST['sales_account']) . ",
+                               sales_discount_account=".db_escape($_POST['sales_discount_account']) . ",
+                               receivables_account=".db_escape($_POST['receivables_account']) . ",
+                               payment_discount_account=".db_escape($_POST['payment_discount_account']) . ",
+               default_location=".db_escape($_POST['default_location']) . ",
+               br_post_address =".db_escape($_POST['br_post_address']) . ",
+               disable_trans=".db_escape($_POST['disable_trans']) . ",
+               default_ship_via=".db_escape($_POST['default_ship_via']) . "
+               WHERE branch_code =".db_escape($_POST['branch_code']) . "
+               AND debtor_no=".db_escape($_POST['customer_id']);
 
                } 
                else
@@ -91,16 +91,19 @@ if (isset($_POST['ADD_ITEM']) || isset($_POST['UPDATE_ITEM']))
                                salesman, phone, fax,
                                contact_name, area, email, tax_group_id, sales_account, receivables_account, payment_discount_account, sales_discount_account, default_location,
                                br_post_address, disable_trans, default_ship_via)
-                               VALUES ('" . $_POST['customer_id']. "', '" . $_POST['br_name'] . "', '" .
-                                       $_POST['br_address'] . "', '" . $_POST['salesman'] . "', '" .
-                                       $_POST['phone'] . "', '" . $_POST['fax'] . "','" .
-                                       $_POST['contact_name'] . "', '" . $_POST['area'] . "','" .
-                                       $_POST['email'] . "', " . $_POST['tax_group_id'] . ", '" .
-                                       $_POST['sales_account'] . "', '" .
-                                       $_POST['receivables_account'] . "', '" .
-                                       $_POST['payment_discount_account'] . "', '" .
-                                       $_POST['sales_discount_account'] . "', '" .
-                                       $_POST['default_location'] . "', '" . $_POST['br_post_address'] . "'," . $_POST['disable_trans'] . ", " . $_POST['default_ship_via'] . ")";
+                               VALUES (".db_escape($_POST['customer_id']). ",".db_escape($_POST['br_name']) . ", " 
+                                       .db_escape($_POST['br_address']) . ", ".db_escape($_POST['salesman']) . ", " 
+                                       .db_escape($_POST['phone']) . ", ".db_escape($_POST['fax']) . ","
+                                       .db_escape($_POST['contact_name']) . ", ".db_escape($_POST['area']) . "," 
+                                       .db_escape($_POST['email']) . ", ".db_escape($_POST['tax_group_id']) . ", " 
+                                       .db_escape($_POST['sales_account']) . ", " 
+                                       .db_escape($_POST['receivables_account']) . ", " 
+                                       .db_escape($_POST['payment_discount_account']) . ", " 
+                                       .db_escape($_POST['sales_discount_account']) . ", " 
+                                       .db_escape($_POST['default_location']) . ", " 
+                                       .db_escape($_POST['br_post_address']) . "," 
+                                       .db_escape($_POST['disable_trans']) . ", " 
+                                       .db_escape($_POST['default_ship_via']) . ")";
                }
 
                //run the sql from either of the above possibilites

diff --git a/sales/manage/customers.php b/sales/manage/customers.php
index a82c71b073a346a41862e248ca063ab18acd3473..0f101574c17c033ef101dc59e8eae0e2f5f25302 100644 (file)
--- a/sales/manage/customers.php
+++ b/sales/manage/customers.php
@@ -62,20 +62,20 @@ function handle_submit()
        if (!isset($_POST['New'])) 
        {
 
-               $sql = "UPDATE ".TB_PREF."debtors_master SET name='" . $_POST['CustName'] . "', 
-                       address='" . $_POST['address'] . "', 
-                       tax_id='" . $_POST['tax_id'] . "', 
-                       curr_code='" . $_POST['curr_code'] . "', 
-                       email='" . $_POST['email'] . "', 
-                       dimension_id=" . $_POST['dimension_id'] . ", 
-                       dimension2_id=" . $_POST['dimension2_id'] . ", 
-            credit_status='" . $_POST['credit_status'] . "', 
-            payment_terms='" . $_POST['payment_terms'] . "', 
+               $sql = "UPDATE ".TB_PREF."debtors_master SET name=" . db_escape($_POST['CustName']) . ", 
+                       address=".db_escape($_POST['address']) . ", 
+                       tax_id=".db_escape($_POST['tax_id']) . ", 
+                       curr_code=".db_escape($_POST['curr_code']) . ", 
+                       email=".db_escape($_POST['email']) . ", 
+                       dimension_id=".db_escape($_POST['dimension_id']) . ", 
+                       dimension2_id=".db_escape($_POST['dimension2_id']) . ", 
+            credit_status=".db_escape($_POST['credit_status']) . ", 
+            payment_terms=".db_escape($_POST['payment_terms']) . ", 
             discount=" . input_num('discount') / 100 . ", 
             pymt_discount=" . input_num('pymt_discount') / 100 . ", 
             credit_limit=" . input_num('credit_limit') . ", 
-            sales_type = '" . $_POST['sales_type'] . "' 
-            WHERE debtor_no = '" . $_POST['customer_id'] . "'";
+            sales_type = ".db_escape($_POST['sales_type']) . " 
+            WHERE debtor_no = '". $_POST['customer_id'] . "'";
 
                db_query($sql,"The customer could not be updated");
                display_notification(_("Customer has been updated."));
@@ -89,10 +89,12 @@ function handle_submit()
 
                $sql = "INSERT INTO ".TB_PREF."debtors_master (name, address, tax_id, email, dimension_id, dimension2_id,  
                        curr_code, credit_status, payment_terms, discount, pymt_discount,credit_limit, 
-                       sales_type) VALUES ('" . $_POST['CustName'] ."', '" . $_POST['address'] . "', '" . $_POST['tax_id'] . "',
-                       '" . $_POST['email'] . "', " . $_POST['dimension_id'] . ", " . $_POST['dimension2_id'] . ", '" . $_POST['curr_code'] . "', 
-                       " . $_POST['credit_status'] . ", '" . $_POST['payment_terms'] . "', " . input_num('discount')/100 . ", 
-                       " . input_num('pymt_discount')/100 . ", " . input_num('credit_limit') . ", '" . $_POST['sales_type'] . "')";
+                       sales_type) VALUES (".db_escape($_POST['CustName']) .", " 
+                       .db_escape($_POST['address']) . ", " . db_escape($_POST['tax_id']) . ","
+                       .db_escape($_POST['email']) . ", ".db_escape($_POST['dimension_id']) . ", " 
+                       .db_escape($_POST['dimension2_id']) . ", ".db_escape($_POST['curr_code']) . ", 
+                       " . db_escape($_POST['credit_status']) . ", ".db_escape($_POST['payment_terms']) . ", " . input_num('discount')/100 . ", 
+                       " . input_num('pymt_discount')/100 . ", " . input_num('credit_limit') . ", ".db_escape($_POST['sales_type']) . ")";
 
                db_query($sql,"The customer could not be added");
 

diff --git a/sales/manage/sales_areas.php b/sales/manage/sales_areas.php
index 7aed3e6e04f0203cbc0ee85feedd41f709b9e09f..7b993667eeb5534632f6e083df4edf293463c181 100644 (file)
--- a/sales/manage/sales_areas.php
+++ b/sales/manage/sales_areas.php
@@ -33,12 +33,12 @@ if (isset($_POST['ADD_ITEM']) || isset($_POST['UPDATE_ITEM']))
        {
        if (isset($selected_id)) 
        {
-               $sql = "UPDATE ".TB_PREF."areas SET description='" . $_POST['description'] . "' WHERE area_code = '$selected_id'";
+               $sql = "UPDATE ".TB_PREF."areas SET description=".db_escape($_POST['description'])." WHERE area_code = '$selected_id'";
        } 
        else 
        {
     
-               $sql = "INSERT INTO ".TB_PREF."areas (description) VALUES ('" . $_POST['description'] . "')";
+               $sql = "INSERT INTO ".TB_PREF."areas (description) VALUES (".db_escape($_POST['description']) . ")";
        }
     
        db_query($sql,"The sales area could not be updated or added");

diff --git a/sales/manage/sales_people.php b/sales/manage/sales_people.php
index e2c4ed4398307aca8796849b480216d29c70afeb..7d5e57b3e040c539e4e8e6fa253b7b12e669e2c4 100644 (file)
--- a/sales/manage/sales_people.php
+++ b/sales/manage/sales_people.php
@@ -30,17 +30,27 @@ if (isset($_POST['ADD_ITEM']) || isset($_POST['UPDATE_ITEM']))
                $input_error = 1;
                display_error(_("The sales person name cannot be empty."));
        }
-
+       $pr1 = check_num('provision', 0,100);
+       if (!$pr1 || !check_num('provision2', 0, 100)) {
+               $input_error = 1;
+               display_error( _("Salesman provision cannot be less than 0 or more than 100%."));
+               set_focus(!$pr1 ? 'provision' : 'provision2');
+       }
+       if (!check_num('break_pt', 0)) {
+               $input_error = 1;
+               display_error( _("Salesman provision breakpoint must be numeric and not less than 0."));
+               set_focus('break_pt');
+       }
        if ($input_error != 1)
        {
        if (isset($selected_id))
        {
                /*selected_id could also exist if submit had not been clicked this code would not run in this case cos submit is false of course  see the delete code below*/
 
-               $sql = "UPDATE ".TB_PREF."salesman SET salesman_name='" . $_POST['salesman_name'] . "',
-                       salesman_phone='" . $_POST['salesman_phone'] . "',
-                       salesman_fax='" . $_POST['salesman_fax'] . "',
-                       salesman_email='" . $_POST['salesman_email'] . "',
+               $sql = "UPDATE ".TB_PREF."salesman SET salesman_name=".db_escape($_POST['salesman_name']) . ",
+                       salesman_phone=".db_escape($_POST['salesman_phone']) . ",
+                       salesman_fax=".db_escape($_POST['salesman_fax']) . ",
+                       salesman_email=".db_escape($_POST['salesman_email']) . ",
                        provision=".input_num('provision').",
                        break_pt=".input_num('break_pt').",
                        provision2=".input_num('provision2')."
@@ -51,8 +61,12 @@ if (isset($_POST['ADD_ITEM']) || isset($_POST['UPDATE_ITEM']))
                /*Selected group is null cos no item selected on first time round so must be adding a record must be submitting new entries in the new Sales-person form */
                $sql = "INSERT INTO ".TB_PREF."salesman (salesman_name, salesman_phone, salesman_fax, salesman_email,
                        provision, break_pt, provision2)
-                       VALUES ('" . $_POST['salesman_name'] . "', '" .$_POST['salesman_phone'] . "', '" . $_POST['salesman_fax'] . "', '" . $_POST['salesman_email'] . "', ".
-                       input_num('provision').", ".input_num('break_pt').", ".input_num('provision2').")";
+                       VALUES (".db_escape($_POST['salesman_name']) . ", "
+                                 .db_escape($_POST['salesman_phone']) . ", "
+                                 .db_escape($_POST['salesman_fax']) . ", "
+                                 .db_escape($_POST['salesman_email']) . ", ".
+                       input_num('provision').", ".input_num('break_pt').", "
+                               .input_num('provision2').")";
        }
 
        //run the sql from either of the above possibilites

diff --git a/taxes/db/item_tax_types_db.inc b/taxes/db/item_tax_types_db.inc
index 486bfc781122acaf4ecbb06dd39d85946f26b9ad..24a5eedd86e5fcb0cbd80a86186597e8ad85e62d 100644 (file)
--- a/taxes/db/item_tax_types_db.inc
+++ b/taxes/db/item_tax_types_db.inc
@@ -5,7 +5,7 @@ function add_item_tax_type($name, $exempt, $exempt_from)
        begin_transaction();
        
        $sql = "INSERT INTO ".TB_PREF."item_tax_types (name, exempt) 
-               VALUES ('$name',$exempt)";
+               VALUES (".db_escape($name).",$exempt)";
                
        db_query($sql, "could not add item tax type");  
        
@@ -21,7 +21,8 @@ function update_item_tax_type($id, $name, $exempt, $exempt_from)
 {
        begin_transaction();
        
-       $sql = "UPDATE ".TB_PREF."item_tax_types SET name='$name',      exempt=$exempt WHERE id=$id";
+       $sql = "UPDATE ".TB_PREF."item_tax_types SET name=".db_escape($name).
+       ",      exempt=$exempt WHERE id=$id";
        
        db_query($sql, "could not update item tax type");       
        

diff --git a/taxes/db/tax_groups_db.inc b/taxes/db/tax_groups_db.inc
index 10f0f5cfce9ecf124e6477fcf862ac4223cd79db..10f0256a2e4654826d50815ff76aa8ee8eec4c6e 100644 (file)
--- a/taxes/db/tax_groups_db.inc
+++ b/taxes/db/tax_groups_db.inc
@@ -12,7 +12,7 @@ function add_tax_group($name, $tax_shipping, $taxes, $rates)
        if($tax_shipping)       // only one tax group for shipping
          clear_shipping_tax_group();
                
-       $sql = "INSERT INTO ".TB_PREF."tax_groups (name, tax_shipping) VALUES ('$name', $tax_shipping)";
+       $sql = "INSERT INTO ".TB_PREF."tax_groups (name, tax_shipping) VALUES (".db_escape($name).", $tax_shipping)";
        db_query($sql, "could not add tax group");
        
        $id = db_insert_id();
@@ -29,7 +29,7 @@ function update_tax_group($id, $name, $tax_shipping, $taxes, $rates)
        if($tax_shipping)       // only one tax group for shipping
          clear_shipping_tax_group();
        
-    $sql = "UPDATE ".TB_PREF."tax_groups SET name='$name',tax_shipping=$tax_shipping WHERE id=$id";
+    $sql = "UPDATE ".TB_PREF."tax_groups SET name=".db_escape($name).",tax_shipping=$tax_shipping WHERE id=$id";
        db_query($sql, "could not update tax group");
        
        delete_tax_group_items($id);

diff --git a/taxes/db/tax_types_db.inc b/taxes/db/tax_types_db.inc
index 029cad160e6e6c6c41c5c444a7d121ce0e2ff316..5cd18ebb1b55815d9340d29acdbdc1f7c9ac01f1 100644 (file)
--- a/taxes/db/tax_types_db.inc
+++ b/taxes/db/tax_types_db.inc
@@ -3,16 +3,17 @@
 function add_tax_type($name, $sales_gl_code, $purchasing_gl_code, $rate)
 {
        $sql = "INSERT INTO ".TB_PREF."tax_types (name, sales_gl_code, purchasing_gl_code, rate)
-               VALUES ('$name', '$sales_gl_code', '$purchasing_gl_code', $rate)";
+               VALUES (".db_escape($name).", ".db_escape($sales_gl_code)
+               .", ".db_escape($purchasing_gl_code).", $rate)";
 
        db_query($sql, "could not add tax type");
 }
 
 function update_tax_type($type_id, $name, $sales_gl_code, $purchasing_gl_code, $rate)
 {
-       $sql = "UPDATE ".TB_PREF."tax_types SET name='$name',
-               sales_gl_code='$sales_gl_code',
-               purchasing_gl_code='$purchasing_gl_code',
+       $sql = "UPDATE ".TB_PREF."tax_types SET name=".db_escape($name).",
+               sales_gl_code=".db_escape($sales_gl_code).",
+               purchasing_gl_code=".db_escape($purchasing_gl_code).",
                rate=$rate
                WHERE id=$type_id";