fixed nosqlinjection bug in invoice.php