VARCHAR => CHAR for table products fields notes_as_description, show_description
Merge pull request #132 from simpleinvoices/2013.1.beta.8

2013.1.beta.8
Fix SQL Injection Vulnerability

SQL query is not properly escaped, allowing SQL injection attack via malicious request.
Merge pull request #134 from KyraD/patch-1

Fix SQL Injection Vulnerability
Fix XSS Vulnerability

Not sure if htmlsafe() is declared or not, if it is not then make sure to include 'include/functions.php'
Update .htaccess

Fixing mod_php5 block to load properly.
Merge pull request #136 from KyraD/patch-1

Fix XSS Vulnerability
Merge pull request #138 from tenach/master

Update .htaccess
Fix SQL Injection Vulnerability

POST params are being put into SQL query and not being binded. This patch makes placeholders for them and runs separate query with them if condition met.
Fix SQL Injection Vulnerability

same as other PR, but with $_REQUEST vars.
Fix SQL Injection Vulnerability

Per https://github.com/simpleinvoices/simpleinvoices/blob/master/modules/invoices/xml.php#L15-L16 it does just passes $_REQUEST vars to the class as $this->query and $this->qtype, which is then inserted directly into SQL query as is. This similar code seems to have been copied and pasted to multiple files.
Merge pull request #139 from KyraD/patch-2

Fix SQL Injection Vulnerability
Merge pull request #140 from KyraD/patch-3

Fix SQL Injection Vulnerability
Merge pull request #141 from KyraD/patch-4

Fix SQL Injection Vulnerability
eway function getVisitorIP() fix
https://github.com/simpleinvoices/simpleinvoices/issues/137
https://github.com/simpleinvoices/simpleinvoices/pull/142
Merge branch 'master' of https://github.com/simpleinvoices/simpleinvoices
Fix SQL Injection Vulnerability
Fix SQL Injection Vulnerability
Fix XSS Vulnerability

$row_id is being inserted into multiple places in the response HTML without being sanitized.
Fix SQL Injection Vulnerability