commit e33047250e66ac10e2d0be16262ed744e3c08af7
author rohitwaghchaure <rohitw1991@gmail.com> Mon Aug 27 11:43:57 2018 +0530
committer Nabin Hait <nabinhait@gmail.com> Mon Aug 27 11:43:57 2018 +0530
tree f4899ccb1407448bdd791fa9aac50399e34e1602
parent c4e38ffd4dc78dfccb799cda73c1c408e7cf284e

[Fix] Speacial character issue in searching project in sales invoice (#15220)

erpnext/controllers/queries.py

diff --git a/erpnext/controllers/queries.py b/erpnext/controllers/queries.py
index bc18d77..6c27b2c 100644
--- a/erpnext/controllers/queries.py
+++ b/erpnext/controllers/queries.py
@@ -218,7 +218,8 @@
 def get_project_name(doctype, txt, searchfield, start, page_len, filters):
 	cond = ''
 	if filters.get('customer'):
-		cond = '(`tabProject`.customer = "' + filters['customer'] + '" or ifnull(`tabProject`.customer,"")="") and'
+		cond = """(`tabProject`.customer = '%s' or
+			ifnull(`tabProject`.customer,"")="") and""" %(frappe.db.escape(filters.get("customer")))
 
 	return frappe.db.sql("""select `tabProject`.name from `tabProject`
 		where `tabProject`.status not in ("Completed", "Cancelled")