Merge lp:~xmo-deactivatedaccount/openobject-addons/5.0-sql-fixes into lp:openobject-addons/5.0

[Xavier (Open ERP)]

Fixes sql moche, potentiellement injectable.

[Christophe Simonis (OpenERP) (kangol)]

In order to be consistent with the rest of stable branch, can you please use netsvc.notifyChannel instead of logging?

(For trunk it is ok)

review: Needs Fixing

[Xavier (Open ERP) (xmo-deactivatedaccount)]

Done, logging.getLogger calls were moved back to netsvc.Logger.

=== added file '.bzrignore'
--- .bzrignore	1970-01-01 00:00:00 +0000
+++ .bzrignore	2010-03-17 11:50:49 +0000
@@ -0,0 +1,1 @@
+./.ropeproject

=== modified file 'account/account.py'
--- account/account.py	2010-03-16 09:19:35 +0000
+++ account/account.py	2010-03-17 11:50:49 +0000
@@ -20,8 +20,10 @@
 #
 ##############################################################################
 import time
+
+from operator import itemgetter
+
 import netsvc
-
 from osv import fields, osv
 
 from tools.misc import currency
@@ -32,6 +34,26 @@
 
 from tools import config
 
+def check_cycle(self, cr, uid, ids):
+    """ climbs the ``self._table.parent_id`` chains for 100 levels or
+    until it can't find any more parent(s)
+
+    Returns true if it runs out of parents (no cycle), false if
+    it can recurse 100 times without ending all chains
+    """
+    level = 100
+    while len(ids):
+        cr.execute('SELECT DISTINCT parent_id '\
+                   'FROM '+self._table+' '\
+                   'WHERE id IN %s '\
+                   'AND parent_id IS NOT NULL',
+                   (tuple(ids),))
+        ids = map(itemgetter(0), cr.fetchall())
+        if not level:
+            return False
+        level -= 1
+    return True
+
 class account_payment_term(osv.osv):
     _name = "account.payment.term"
     _description = "Payment Term"
@@ -149,6 +171,7 @@
     _name = "account.account"
     _description = "Account"
     _parent_store = True
+    logger = netsvc.Logger()
 
     def search(self, cr, uid, args, offset=0, limit=None, order=None,
             context=None, count=False):
@@ -195,19 +218,33 @@
             ids3 = self._get_children_and_consol(cr, uid, ids3, context)
         return ids2 + ids3
 
-    def __compute(self, cr, uid, ids, field_names, arg, context={}, query=''):
-        #compute the balance/debit/credit accordingly to the value of field_name for the given account ids
+    def __compute(self, cr, uid, ids, field_names, arg=None, context=None,
+                  query='', query_params=()):
+        """ compute the balance, debit and/or credit for the provided
+        account ids
+
+        Arguments:
+        `ids`: account ids
+        `field_names`: the fields to compute (a list of any of
+                       'balance', 'debit' and 'credit')
+        `arg`: unused fields.function stuff
+        `query`: additional query filter (as a string)
+        `query_params`: parameters for the provided query string
+                        (__compute will handle their escaping) as a
+                        tuple
+        """
         mapping = {
-            'balance': "COALESCE(SUM(l.debit),0) - COALESCE(SUM(l.credit), 0) as balance ",
-            'debit': "COALESCE(SUM(l.debit), 0) as debit ",
-            'credit': "COALESCE(SUM(l.credit), 0) as credit "
+            'balance': "COALESCE(SUM(l.debit),0) " \
+                       "- COALESCE(SUM(l.credit), 0) as balance",
+            'debit': "COALESCE(SUM(l.debit), 0) as debit",
+            'credit': "COALESCE(SUM(l.credit), 0) as credit"
         }
         #get all the necessary accounts
-        ids2 = self._get_children_and_consol(cr, uid, ids, context)
-        acc_set = ",".join(map(str, ids2))
+        children_and_consolidated = self._get_children_and_consol(
+            cr, uid, ids, context=context)
         #compute for each account the balance/debit/credit from the move lines
         accounts = {}
-        if ids2:
+        if children_and_consolidated:
             aml_query = self.pool.get('account.move.line')._query_get(cr, uid, context=context)
 
             wheres = [""]
@@ -215,23 +252,33 @@
                 wheres.append(query.strip())
             if aml_query:
                 wheres.append(aml_query.strip())
-            query = " AND ".join(wheres)
-
-            cr.execute(("SELECT l.account_id as id, " +\
-                    ' , '.join(map(lambda x: mapping[x], field_names)) +
-                    "FROM " \
-                        "account_move_line l " \
-                    "WHERE " \
-                        "l.account_id IN (%s) " \
-                        + query +
-                    " GROUP BY l.account_id") % (acc_set, ))
+            filters = " AND ".join(wheres)
+            self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                      'Filters: %s'%filters)
+            # IN might not work ideally in case there are too many
+            # children_and_consolidated, in that case join on a
+            # values() e.g.:
+            # SELECT l.account_id as id FROM account_move_line l
+            # INNER JOIN (VALUES (id1), (id2), (id3), ...) AS tmp (id)
+            # ON l.account_id = tmp.id
+            # or make _get_children_and_consol return a query and join on that
+            request = ("SELECT l.account_id as id, " +\
+                       ' , '.join(map(mapping.__getitem__, field_names)) +
+                       " FROM account_move_line l" \
+                       " WHERE l.account_id IN %s " \
+                            + filters +
+                       " GROUP BY l.account_id")
+            params = (tuple(children_and_consolidated),) + query_params
+            cr.execute(request, params)
+            self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                      'Status: %s'%cr.statusmessage)
 
             for res in cr.dictfetchall():
                 accounts[res['id']] = res
 
-
         # consolidate accounts with direct children
-        brs = list(self.browse(cr, uid, ids2, context=context))
+        brs = list(self.browse(cr, uid, children_and_consolidated,
+                               context=context))
         sums = {}
         while brs:
             current = brs[0]
@@ -341,8 +388,10 @@
         if (obj_self in obj_self.child_consol_ids) or (p_id and (p_id is obj_self.id)):
             return False
         while(ids):
-            cr.execute('select distinct child_id from account_account_consol_rel where parent_id in ('+','.join(map(str, ids))+')')
-            child_ids = filter(None, map(lambda x: x[0], cr.fetchall()))
+            cr.execute('SELECT DISTINCT child_id '\
+                       'FROM account_account_consol_rel '\
+                       'WHERE parent_id IN %s', (tuple(ids),))
+            child_ids = map(itemgetter(0), cr.fetchall())
             c_ids = child_ids
             if (p_id and (p_id in c_ids)) or (obj_self.id in c_ids):
                 return False
@@ -767,7 +816,10 @@
 
     def _amount_compute(self, cr, uid, ids, name, args, context, where =''):
         if not ids: return {}
-        cr.execute('select move_id,sum(debit) from account_move_line where move_id in ('+','.join(map(str,ids))+') group by move_id')
+        cr.execute('SELECT move_id, SUM(debit) '\
+                   'FROM account_move_line '\
+                   'WHERE move_id IN %s '\
+                   'GROUP BY move_id', (tuple(ids),))
         result = dict(cr.fetchall())
         for id in ids:
             result.setdefault(id, 0.0)
@@ -862,7 +914,10 @@
                     if new_name:
                         self.write(cr, uid, [move.id], {'name':new_name})
 
-            cr.execute('update account_move set state=%s where id in ('+','.join(map(str,ids))+')', ('posted',))
+            cr.execute('UPDATE account_move '\
+                       'SET state=%s '\
+                       'WHERE id IN %s',
+                       ('posted', tuple(ids)))
         else:
             raise osv.except_osv(_('Integrity Error !'), _('You can not validate a non-balanced entry !'))
         return True
@@ -875,7 +930,9 @@
             if not line.journal_id.update_posted:
                 raise osv.except_osv(_('Error !'), _('You can not modify a posted entry of this journal !\nYou should set the journal to allow cancelling entries if you want to do that.'))
         if len(ids):
-            cr.execute('update account_move set state=%s where id in ('+','.join(map(str,ids))+')', ('draft',))
+            cr.execute('UPDATE account_move '\
+                       'SET state=%s '\
+                       'WHERE id IN %s', ('draft', tuple(ids)))
         return True
 
     def write(self, cr, uid, ids, vals, context={}):
@@ -995,7 +1052,10 @@
         else:
             line_id2 = 0
 
-        cr.execute('select sum('+mode+') from account_move_line where move_id=%s and id<>%s', (move.id, line_id2))
+        cr.execute('SELECT SUM(%s) '\
+                   'FROM account_move_line '\
+                   'WHERE move_id=%s AND id<>%s',
+                   (mode, move.id, line_id2))
         result = cr.fetchone()[0] or 0.0
         cr.execute('update account_move_line set '+mode2+'=%s where id=%s', (result, line_id))
         return True
@@ -1143,25 +1203,28 @@
 
     This code is used for some tax declarations.
     """
-    def _sum(self, cr, uid, ids, name, args, context, where =''):
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        acc_set = ",".join(map(str, ids2))
+    def _sum(self, cr, uid, ids, name, args, context,
+             where ='', where_params=()):
+        parent_ids = tuple(self.search(
+            cr, uid, [('parent_id', 'child_of', ids)]))
         if context.get('based_on', 'invoices') == 'payments':
             cr.execute('SELECT line.tax_code_id, sum(line.tax_amount) \
                     FROM account_move_line AS line, \
                         account_move AS move \
                         LEFT JOIN account_invoice invoice ON \
                             (invoice.move_id = move.id) \
-                    WHERE line.tax_code_id in ('+acc_set+') '+where+' \
+                    WHERE line.tax_code_id in %s '+where+' \
                         AND move.id = line.move_id \
                         AND ((invoice.state = \'paid\') \
                             OR (invoice.id IS NULL)) \
-                    GROUP BY line.tax_code_id')
+                    GROUP BY line.tax_code_id',
+                       (parent_ids,)+where_params)
         else:
             cr.execute('SELECT line.tax_code_id, sum(line.tax_amount) \
                     FROM account_move_line AS line \
-                    WHERE line.tax_code_id in ('+acc_set+') '+where+' \
-                    GROUP BY line.tax_code_id')
+                    WHERE line.tax_code_id in %s '+where+' \
+                    GROUP BY line.tax_code_id',
+                       (parent_ids,)+where_params)
         res=dict(cr.fetchall())
         for record in self.browse(cr, uid, ids, context):
             def _rec_get(record):
@@ -1178,12 +1241,14 @@
         else:
             fiscalyear_id = self.pool.get('account.fiscalyear').find(cr, uid, exception=False)
         where = ''
+        where_params = ()
         if fiscalyear_id:
             pids = map(lambda x: str(x.id), self.pool.get('account.fiscalyear').browse(cr, uid, fiscalyear_id).period_ids)
             if pids:
-                where = ' and period_id in (' + (','.join(pids))+')'
+                where = ' and period_id in %s'
+                where_params = (tuple(pids),)
         return self._sum(cr, uid, ids, name, args, context,
-                where=where)
+                where=where, where_params=where_params)
 
     def _sum_period(self, cr, uid, ids, name, args, context):
         if 'period_id' in context and context['period_id']:
@@ -1194,7 +1259,8 @@
                 return dict.fromkeys(ids, 0.0)
             period_id = period_id[0]
         return self._sum(cr, uid, ids, name, args, context,
-                where=' and line.period_id='+str(period_id))
+                         where=' and line.period_id=%s',
+                         where_params=(period_id,))
 
     _name = 'account.tax.code'
     _description = 'Tax Code'
@@ -1240,6 +1306,7 @@
         'sign': lambda *args: 1.0,
         'notprintable': lambda *a: False,
     }
+<<<<<<< TREE
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
@@ -1257,6 +1324,9 @@
         default.update({'line_ids': []})
         return super(account_tax_code, self).copy(cr, uid, id, default, context)
     
+=======
+    _check_recursion = check_cycle
+>>>>>>> MERGE-SOURCE
     _constraints = [
         (_check_recursion, 'Error ! You can not create recursive accounts.', ['parent_id'])
     ]
@@ -1869,16 +1939,7 @@
         'type' : lambda *a :'view',
     }
 
-    def _check_recursion(self, cr, uid, ids):
-        level = 100
-        while len(ids):
-            cr.execute('select parent_id from account_account_template where id in ('+','.join(map(str,ids))+')')
-            ids = filter(None, map(lambda x:x[0], cr.fetchall()))
-            if not level:
-                return False
-            level -= 1
-        return True
-
+    _check_recursion = check_cycle
     _constraints = [
         (_check_recursion, 'Error ! You can not create recursive account templates.', ['parent_id'])
     ]
@@ -1928,16 +1989,7 @@
         return [(x['id'], (x['code'] and x['code'] + ' - ' or '') + x['name']) \
                 for x in reads]
 
-    def _check_recursion(self, cr, uid, ids):
-        level = 100
-        while len(ids):
-            cr.execute('select distinct parent_id from account_tax_code_template where id in ('+','.join(map(str,ids))+')')
-            ids = filter(None, map(lambda x:x[0], cr.fetchall()))
-            if not level:
-                return False
-            level -= 1
-        return True
-
+    _check_recursion = check_cycle
     _constraints = [
         (_check_recursion, 'Error ! You can not create recursive Tax Codes.', ['parent_id'])
     ]

=== modified file 'account/account_move_line.py'
--- account/account_move_line.py	2010-03-04 11:50:58 +0000
+++ account/account_move_line.py	2010-03-17 11:50:49 +0000
@@ -257,9 +257,10 @@
         for line_id in ids:
             res[line_id] = False
         cursor.execute('SELECT l.id, i.id ' \
-                'FROM account_move_line l, account_invoice i ' \
-                'WHERE l.move_id = i.move_id ' \
-                    'AND l.id in (' + ','.join([str(x) for x in ids]) + ')')
+                       'FROM account_move_line l, account_invoice i ' \
+                       'WHERE l.move_id = i.move_id ' \
+                       'AND l.id in %s',
+                       (tuple(ids),))
         invoice_ids = []
         for line_id, invoice_id in cursor.fetchall():
             res[line_id] = invoice_id
@@ -566,10 +567,11 @@
         else:
             date = time.strftime('%Y-%m-%d')
 
-        cr.execute('SELECT account_id, reconcile_id \
-                FROM account_move_line \
-                WHERE id IN ('+id_set+') \
-                GROUP BY account_id,reconcile_id')
+        cr.execute('SELECT account_id, reconcile_id '\
+                   'FROM account_move_line '\
+                   'WHERE id IN %s '\
+                   'GROUP BY account_id,reconcile_id',
+                   (tuple(ids),))
         r = cr.fetchall()
 #TODO: move this check to a constraint in the account_move_reconcile object
         if (len(r) != 1) and not context.get('fy_closing', False):

=== modified file 'account/invoice.py'
--- account/invoice.py	2010-03-09 12:49:07 +0000
+++ account/invoice.py	2010-03-17 11:50:49 +0000
@@ -21,6 +21,8 @@
 ##############################################################################
 
 import time
+from operator import itemgetter
+
 import netsvc
 from osv import fields, osv
 import pooler
@@ -428,12 +430,13 @@
     def move_line_id_payment_get(self, cr, uid, ids, *args):
         res = []
         if not ids: return res
-        cr.execute('select \
-                l.id \
-            from account_move_line l \
-                left join account_invoice i on (i.move_id=l.move_id) \
-            where i.id in ('+','.join(map(str,ids))+') and l.account_id=i.account_id')
-        res = map(lambda x: x[0], cr.fetchall())
+        cr.execute('SELECT l.id '\
+                   'FROM account_move_line l '\
+                   'LEFT JOIN account_invoice i ON (i.move_id=l.move_id) '\
+                   'WHERE i.id IN %s '\
+                   'AND l.account_id=i.account_id',
+                   (tuple(ids),))
+        res = map(itemgetter(0), cr.fetchall())
         return res
 
     def copy(self, cr, uid, id, default=None, context=None):
@@ -714,8 +717,9 @@
 
     def action_number(self, cr, uid, ids, *args):
         cr.execute('SELECT id, type, number, move_id, reference ' \
-                'FROM account_invoice ' \
-                'WHERE id IN ('+','.join(map(str,ids))+')')
+                   'FROM account_invoice ' \
+                   'WHERE id IN %s',
+                   (tuple(ids),))
         obj_inv = self.browse(cr, uid, ids)[0]
         for (id, invtype, number, move_id, reference) in cr.fetchall():
             if not number:
@@ -949,7 +953,9 @@
         line_ids = []
         total = 0.0
         line = self.pool.get('account.move.line')
-        cr.execute('select id from account_move_line where move_id in ('+str(move_id)+','+str(invoice.move_id.id)+')')
+        cr.execute('SELECT id FROM account_move_line '\
+                   'WHERE move_id in %s',
+                   ((move_id, invoice.move_id.id),))
         lines = line.browse(cr, uid, map(lambda x: x[0], cr.fetchall()) )
         for l in lines+invoice.payment_ids:
             if l.account_id.id==src_account_id:

=== modified file 'account/partner.py'
--- account/partner.py	2010-01-08 11:38:58 +0000
+++ account/partner.py	2010-03-17 11:50:49 +0000
@@ -19,6 +19,7 @@
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
+from operator import itemgetter
 
 from osv import fields, osv
 import ir
@@ -89,22 +90,19 @@
     _name = 'res.partner'
     _inherit = 'res.partner'
     _description = 'Partner'
+
     def _credit_debit_get(self, cr, uid, ids, field_names, arg, context):
         query = self.pool.get('account.move.line')._query_get(cr, uid, context=context)
-        cr.execute(("""select
-                l.partner_id, a.type, sum(l.debit-l.credit)
-            from
-                account_move_line l
-            left join
-                account_account a on (l.account_id=a.id)
-            where
-                a.type in ('receivable','payable') and
-                l.partner_id in (%s) and
-                l.reconcile_id is null and
-                """ % (','.join(map(str, ids)),))+query+"""
-            group by
-                l.partner_id, a.type
-            """)
+        cr.execute("""SELECT l.partner_id, a.type, SUM(l.debit-l.credit)
+                      FROM account_move_line l
+                      LEFT JOIN account_account a ON (l.account_id=a.id)
+                      WHERE a.type IN ('receivable','payable')
+                      AND l.partner_id in %s
+                      AND l.reconcile_id IS NULL
+                      AND """ + query + """
+                      GROUP BY l.partner_id, a.type
+                      """,
+                   (tuple(ids),))
         tinvert = {
             'credit': 'receivable',
             'debit': 'payable'
@@ -118,27 +116,38 @@
             res[pid][maps[type]] = (type=='receivable') and val or -val
         return res
 
+    def _asset_difference_search(self, cr, uid, obj, name, type, args,
+                                 context=None):
+        if not len(args):
+            return []
+        having_values = tuple(map(itemgetter(2), args))
+        where = ' AND '.join(
+            map(lambda x: '(SUM(debit-credit) %(operator)s %%s)' % {
+                                'operator':x[1]},
+                args))
+        query = self.pool.get('account.move.line')._query_get(cr, uid,
+                                                              context=context)
+        cr.execute(('SELECT partner_id FROM account_move_line l '\
+                    'WHERE account_id IN '\
+                        '(SELECT id FROM account_account '\
+                        'WHERE type=%s AND active) '\
+                    'AND reconcile_id IS NULL '\
+                    'AND '+query+' '\
+                    'AND partner_id IS NOT NULL '\
+                    'GROUP BY partner_id HAVING '+where),
+                   (type,) + having_values)
+        res = cr.fetchall()
+        if not len(res):
+            return [('id','=','0')]
+        return [('id','in',map(itemgetter(0), res))]
+
     def _credit_search(self, cr, uid, obj, name, args, context):
-        if not len(args):
-            return []
-        where = ' and '.join(map(lambda x: '(sum(debit-credit)'+x[1]+str(x[2])+')',args))
-        query = self.pool.get('account.move.line')._query_get(cr, uid, context={})
-        cr.execute(('select partner_id from account_move_line l where account_id in (select id from account_account where type=%s and active) and reconcile_id is null and '+query+' and partner_id is not null group by partner_id having '+where), ('receivable',) )
-        res = cr.fetchall()
-        if not len(res):
-            return [('id','=','0')]
-        return [('id','in',map(lambda x:x[0], res))]
+        return self._asset_difference_search(
+            cr, uid, obj, name, 'receivable', args, context=context)
 
     def _debit_search(self, cr, uid, obj, name, args, context):
-        if not len(args):
-            return []
-        query = self.pool.get('account.move.line')._query_get(cr, uid, context={})
-        where = ' and '.join(map(lambda x: '(sum(debit-credit)'+x[1]+str(x[2])+')',args))
-        cr.execute(('select partner_id from account_move_line l where account_id in (select id from account_account where type=%s and active) and reconcile_id is null and '+query+' and partner_id is not null group by partner_id having '+where), ('payable',) )
-        res = cr.fetchall()
-        if not len(res):
-            return [('id','=','0')]
-        return [('id','in',map(lambda x:x[0], res))]
+        return self._asset_difference_search(
+            cr, uid, obj, name, 'payable', args, context=context)
 
     _columns = {
         'credit': fields.function(_credit_debit_get,

=== modified file 'account/project/project.py'
--- account/project/project.py	2010-02-15 07:17:01 +0000
+++ account/project/project.py	2010-03-17 11:50:49 +0000
@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 ##############################################################################
 #
-#    OpenERP, Open Source Management Solution	
+#    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>). All Rights Reserved
 #    $Id$
 #
@@ -19,10 +19,10 @@
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
-
 import time
 import operator
 
+import netsvc
 from osv import fields
 from osv import osv
 
@@ -33,47 +33,52 @@
 class account_analytic_account(osv.osv):
     _name = 'account.analytic.account'
     _description = 'Analytic Accounts'
+    logger = netsvc.Logger()
 
     def _credit_calc(self, cr, uid, ids, name, arg, context={}):
-        r = {}
-        acc_set = ",".join(map(str, ids))
-        
-        for i in ids:
-            r.setdefault(i,0.0)
-            
-        if not acc_set:
-            return r
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  'Entering _credit_calc; ids:%s'%ids)
+        if not ids: return {}
 
         where_date = ''
-        if context.get('from_date',False):
-            where_date += " AND l.date >= '" + context['from_date'] + "'"
-        if context.get('to_date',False):
-            where_date += " AND l.date <= '" + context['to_date'] + "'"
-            
-        cr.execute("SELECT a.id, COALESCE(SUM(l.amount),0) FROM account_analytic_account a LEFT JOIN account_analytic_line l ON (a.id=l.account_id %s) WHERE l.amount<0 and a.id IN (%s) GROUP BY a.id" % (where_date,acc_set))
+        if context.get('from_date'):
+            where_date += " AND l.date >= %(from_date)s"
+        if context.get('to_date'):
+            where_date += " AND l.date <= %(to_date)s"
+
+        cr.execute("SELECT a.id, COALESCE(SUM(l.amount), 0) "
+                   "FROM account_analytic_account a "
+                   "LEFT JOIN account_analytic_line l ON (a.id=l.account_id %s)"
+                   " WHERE l.amount < 0 AND a.id IN %%(ids)s "
+                   "GROUP BY a.id" % (where_date),
+                   dict(context, ids=tuple(ids)))
         r = dict(cr.fetchall())
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  '_credit_calc results: %s'%r)
         for i in ids:
             r.setdefault(i,0.0)
         return r
 
     def _debit_calc(self, cr, uid, ids, name, arg, context={}):
-        r = {}
-        acc_set = ",".join(map(str, ids))
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  'Entering _debit_calc; ids:%s'%ids)
+        if not ids: return {}
 
-        for i in ids:
-            r.setdefault(i,0.0)
-            
-        if not acc_set:
-            return r
-        
         where_date = ''
-        if context.get('from_date',False):
-            where_date += " AND l.date >= '" + context['from_date'] + "'"
-        if context.get('to_date',False):
-            where_date += " AND l.date <= '" + context['to_date'] + "'"
-            
-        cr.execute("SELECT a.id, COALESCE(SUM(l.amount),0) FROM account_analytic_account a LEFT JOIN account_analytic_line l ON (a.id=l.account_id %s) WHERE l.amount>0 and a.id IN (%s) GROUP BY a.id" % (where_date,acc_set))
-        r= dict(cr.fetchall())
+        if context.get('from_date'):
+            where_date += " AND l.date >= %(from_date)s"
+        if context.get('to_date'):
+            where_date += " AND l.date <= %(to_date)s"
+
+        cr.execute("SELECT a.id, COALESCE(SUM(l.amount), 0) "
+                   "FROM account_analytic_account a "
+                   "LEFT JOIN account_analytic_line l ON (a.id=l.account_id %s)"
+                   " WHERE l.amount > 0 AND a.id IN %%(ids)s "
+                   "GROUP BY a.id" % (where_date),
+                   dict(context, ids=tuple(ids)))
+        r = dict(cr.fetchall())
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  '_debut_calc results: %s'%r)
         for i in ids:
             r.setdefault(i,0.0)
         return r
@@ -81,35 +86,49 @@
     def _balance_calc(self, cr, uid, ids, name, arg, context={}):
         res = {}
         ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        acc_set = ",".join(map(str, ids2))
-        
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  'Entering _balance_calc; ids:%s; ids2:%s'%(
+                            ids, ids2))
+
         for i in ids:
             res.setdefault(i,0.0)
-            
-        if not acc_set:
+
+        if not ids2:
             return res
-        
+
         where_date = ''
-        if context.get('from_date',False):
-            where_date += " AND l.date >= '" + context['from_date'] + "'"
-        if context.get('to_date',False):
-            where_date += " AND l.date <= '" + context['to_date'] + "'"
-            
-        cr.execute("SELECT a.id, COALESCE(SUM(l.amount),0) FROM account_analytic_account a LEFT JOIN account_analytic_line l ON (a.id=l.account_id %s) WHERE a.id IN (%s) GROUP BY a.id" % (where_date,acc_set))
-        
+        if context.get('from_date'):
+            where_date += " AND l.date >= %(from_date)s"
+        if context.get('to_date'):
+            where_date += " AND l.date <= %(to_date)s"
+
+        cr.execute("SELECT a.id, COALESCE(SUM(l.amount),0) "
+                   "FROM account_analytic_account a "
+                   "LEFT JOIN account_analytic_line l ON (a.id=l.account_id %s)"
+                   " WHERE a.id IN %%(ids)s "
+                   "GROUP BY a.id" % (where_date),
+                   dict(context, ids=tuple(ids)))
+
         for account_id, sum in cr.fetchall():
             res[account_id] = sum
-
-        cr.execute("SELECT a.id, r.currency_id FROM account_analytic_account a INNER JOIN res_company r ON (a.company_id = r.id) where a.id in (%s)" % acc_set)
-
-        currency= dict(cr.fetchall())
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  '_balance_calc, (id, sum): %s'%res)
+
+        cr.execute("SELECT a.id, r.currency_id "
+                   "FROM account_analytic_account a "
+                   "INNER JOIN res_company r ON (a.company_id = r.id) "
+                   "WHERE a.id in %s", (tuple(ids),))
+
+        currency = dict(cr.fetchall())
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  '_balance_calc currency: %s'%currency)
 
         res_currency= self.pool.get('res.currency')
         for id in ids:
             if id not in ids2:
                 continue
             for child in self.search(cr, uid, [('parent_id', 'child_of', [id])]):
-                if child <> id:
+                if child != id:
                     res.setdefault(id, 0.0)
                     if  currency[child]<>currency[id]:
                         res[id] += res_currency.compute(cr, uid, currency[child], currency[id], res.get(child, 0.0), context=context)
@@ -125,36 +144,40 @@
         return dict([(i, res[i]) for i in ids ])
 
     def _quantity_calc(self, cr, uid, ids, name, arg, context={}):
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  '_quantity_calc ids:%s'%ids)
         #XXX must convert into one uom
         res = {}
         ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        acc_set = ",".join(map(str, ids2))
-        
+
         for i in ids:
             res.setdefault(i,0.0)
-            
-        if not acc_set:
+
+        if not ids2:
             return res
-        
+
         where_date = ''
-        if context.get('from_date',False):
-            where_date += " AND l.date >= '" + context['from_date'] + "'"
-        if context.get('to_date',False):
-            where_date += " AND l.date <= '" + context['to_date'] + "'"
-            
+        if context.get('from_date'):
+            where_date += " AND l.date >= %(from_date)s"
+        if context.get('to_date'):
+            where_date += " AND l.date <= %(to_date)s"
+
         cr.execute('SELECT a.id, COALESCE(SUM(l.unit_amount), 0) \
                 FROM account_analytic_account a \
-                    LEFT JOIN account_analytic_line l ON (a.id = l.account_id ' + where_date + ') \
-                WHERE a.id IN ('+acc_set+') GROUP BY a.id')
+                    LEFT JOIN account_analytic_line l ON (a.id = l.account_id %s) \
+                WHERE a.id IN %%(ids)s GROUP BY a.id'%(where_date),
+                   dict(context, ids=tuple(ids2)))
 
         for account_id, sum in cr.fetchall():
             res[account_id] = sum
+        self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                  '_quantity_calc, (id, sum): %s'%res)
 
         for id in ids:
             if id not in ids2:
                 continue
             for child in self.search(cr, uid, [('parent_id', 'child_of', [id])]):
-                if child <> id:
+                if child != id:
                     res.setdefault(id, 0.0)
                     res[id] += res.get(child, 0.0)
         return dict([(i, res[i]) for i in ids])
@@ -299,4 +322,3 @@
 account_journal()
 
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== modified file 'account/project/report/analytic_balance.py'
--- account/project/report/analytic_balance.py	2009-10-09 11:49:00 +0000
+++ account/project/report/analytic_balance.py	2010-03-17 11:50:49 +0000
@@ -33,15 +33,9 @@
             'get_objects': self._get_objects,
             'lines_g': self._lines_g,
             'move_sum': self._move_sum,
-#            'move_sum_debit': self._move_sum_debit,
-#            'move_sum_credit': self._move_sum_credit,
             'sum_all': self._sum_all,
-#            'sum_debit': self._sum_debit,
-#            'sum_credit': self._sum_credit,
             'sum_balance': self._sum_balance,
-#            'sum_quantity': self._sum_quantity,
             'move_sum_balance': self._move_sum_balance,
-#            'move_sum_quantity': self._move_sum_quantity,
         })
         self.acc_ids = []
         self.read_data = []
@@ -82,10 +76,10 @@
                     sum(aal.amount) AS balance, sum(aal.unit_amount) AS quantity \
                 FROM account_analytic_line AS aal, account_account AS aa \
                 WHERE (aal.general_account_id=aa.id) \
-                    AND (aal.account_id in (" + ','.join(map(str, ids)) + "))\
+                    AND (aal.account_id in %s)\
                     AND (date>=%s) AND (date<=%s) AND aa.active \
                 GROUP BY aal.general_account_id, aa.name, aa.code, aal.code \
-                ORDER BY aal.code", (date1, date2))
+                ORDER BY aal.code", (tuple(ids), date1, date2))
         res = self.cr.dictfetchall()
         
         for r in res:
@@ -108,62 +102,26 @@
             self.acc_data_dict[account_id] = ids
         else:
             ids = self.acc_data_dict[account_id]
-        
+
+        query_params = (tuple(ids), date1, date2)
         if option == "credit" :
             self.cr.execute("SELECT -sum(amount) FROM account_analytic_line \
-                    WHERE account_id in ("+ ','.join(map(str, ids)) +") \
-                        AND date>=%s AND date<=%s AND amount<0",
-                    (date1, date2))
+                    WHERE account_id in %s \
+                        AND date>=%s AND date<=%s AND amount<0", query_params)
         elif option == "debit" :
             self.cr.execute("SELECT sum(amount) FROM account_analytic_line \
-                    WHERE account_id in ("+ ','.join(map(str, ids)) +") \
-                        AND date>=%s AND date<=%s AND amount>0",
-                    (date1, date2))
+                    WHERE account_id in %s \
+                        AND date>=%s AND date<=%s AND amount>0", query_params)
         elif option == "quantity" :
             self.cr.execute("SELECT sum(unit_amount) FROM account_analytic_line \
-                WHERE account_id in ("+ ','.join(map(str, ids)) +") \
-                    AND date>=%s AND date<=%s",
-                (date1, date2))
+                    WHERE account_id in %s \
+                        AND date>=%s AND date<=%s", query_params)
         return self.cr.fetchone()[0] or 0.0
-        
 
-#    def _move_sum_debit(self, account_id, date1, date2):
-#        account_analytic_obj = self.pool.get('account.analytic.account')
-#        ids = account_analytic_obj.search(self.cr, self.uid,
-#                [('parent_id', 'child_of', [account_id])])
-#        self.cr.execute("SELECT sum(amount) \
-#                FROM account_analytic_line \
-#                WHERE account_id in ("+ ','.join(map(str, ids)) +") \
-#                    AND date>=%s AND date<=%s AND amount>0",
-#                (date1, date2))
-#        return self.cr.fetchone()[0] or 0.0
-#
-#    def _move_sum_credit(self, account_id, date1, date2):
-#        account_analytic_obj = self.pool.get('account.analytic.account')
-#        ids = account_analytic_obj.search(self.cr, self.uid,
-#                [('parent_id', 'child_of', [account_id])])
-#        self.cr.execute("SELECT -sum(amount) \
-#                FROM account_analytic_line \
-#                WHERE account_id in ("+ ','.join(map(str, ids)) +") \
-#                    AND date>=%s AND date<=%s AND amount<0",
-#                (date1, date2))
-#        return self.cr.fetchone()[0] or 0.0
-#    
     def _move_sum_balance(self, account_id, date1, date2):
         debit = self._move_sum(account_id, date1, date2, 'debit') 
         credit = self._move_sum(account_id, date1, date2, 'credit')
         return (debit-credit)
-    
-#    def _move_sum_quantity(self, account_id, date1, date2):
-#        account_analytic_obj = self.pool.get('account.analytic.account')
-#        ids = account_analytic_obj.search(self.cr, self.uid,
-#                [('parent_id', 'child_of', [account_id])])
-#        self.cr.execute("SELECT sum(unit_amount) \
-#                FROM account_analytic_line \
-#                WHERE account_id in ("+ ','.join(map(str, ids)) +") \
-#                    AND date>=%s AND date<=%s",
-#                (date1, date2))
-#        return self.cr.fetchone()[0] or 0.0
 
     def _sum_all(self, accounts, date1, date2, option):
         ids = map(lambda x: x['id'], accounts)
@@ -178,72 +136,26 @@
         else:
             ids2 = self.acc_sum_list
 
+        query_params = (tuple(ids2), date1, date2)
         if option == "debit" :
             self.cr.execute("SELECT sum(amount) FROM account_analytic_line \
-                    WHERE account_id IN ("+','.join(map(str, ids2))+") \
-                        AND date>=%s AND date<=%s AND amount>0",
-                    (date1, date2))
+                    WHERE account_id IN %s \
+                        AND date>=%s AND date<=%s AND amount>0", query_params)
         elif option == "credit" :
             self.cr.execute("SELECT -sum(amount) FROM account_analytic_line \
-                    WHERE account_id IN ("+','.join(map(str, ids2))+") \
-                        AND date>=%s AND date<=%s AND amount<0",
-                    (date1, date2))
+                    WHERE account_id IN %s \
+                        AND date>=%s AND date<=%s AND amount<0", query_params)
         elif option == "quantity" :
             self.cr.execute("SELECT sum(unit_amount) FROM account_analytic_line \
-                    WHERE account_id IN ("+','.join(map(str, ids2))+") \
-                        AND date>=%s AND date<=%s",
-                    (date1, date2))
+                    WHERE account_id IN %s \
+                        AND date>=%s AND date<=%s", query_params)
         return self.cr.fetchone()[0] or 0.0
 
-    
-#    def _sum_debit(self, accounts, date1, date2):
-#        ids = map(lambda x: x['id'], accounts)
-#        if not len(ids):
-#            return 0.0
-#        account_analytic_obj = self.pool.get('account.analytic.account')
-#        ids2 = account_analytic_obj.search(self.cr, self.uid,
-#                [('parent_id', 'child_of', ids)])
-#        self.cr.execute("SELECT sum(amount) \
-#                FROM account_analytic_line \
-#                WHERE account_id IN ("+','.join(map(str, ids2))+") \
-#                    AND date>=%s AND date<=%s AND amount>0",
-#                (date1, date2))
-#        return self.cr.fetchone()[0] or 0.0
-#        
-#    def _sum_credit(self, accounts, date1, date2):
-#        ids = map(lambda x: x['id'], accounts)
-#        if not len(ids):
-#            return 0.0
-#        ids = map(lambda x: x['id'], accounts)
-#        account_analytic_obj = self.pool.get('account.analytic.account')
-#        ids2 = account_analytic_obj.search(self.cr, self.uid,
-#                [('parent_id', 'child_of', ids)])
-#        self.cr.execute("SELECT -sum(amount) \
-#                FROM account_analytic_line \
-#                WHERE account_id IN ("+','.join(map(str, ids2))+") \
-#                    AND date>=%s AND date<=%s AND amount<0",
-#                (date1, date2))
-#        return self.cr.fetchone()[0] or 0.0
-
     def _sum_balance(self, accounts, date1, date2):
         debit = self._sum_all(accounts, date1, date2, 'debit') or 0.0
         credit = self._sum_all(accounts, date1, date2, 'credit') or 0.0
         return (debit-credit)
 
-#    def _sum_quantity(self, accounts, date1, date2):
-#        ids = map(lambda x: x['id'], accounts)
-#        if not len(ids):
-#            return 0.0
-#        account_analytic_obj = self.pool.get('account.analytic.account')
-#        ids2 = account_analytic_obj.search(self.cr, self.uid,
-#                [('parent_id', 'child_of', ids)])
-#        self.cr.execute("SELECT sum(unit_amount) \
-#                FROM account_analytic_line \
-#                WHERE account_id IN ("+','.join(map(str, ids2))+") \
-#                    AND date>=%s AND date<=%s",
-#                (date1, date2))
-#        return self.cr.fetchone()[0] or 0.0
-
 report_sxw.report_sxw('report.account.analytic.account.balance',
         'account.analytic.account', 'addons/account/project/report/analytic_balance.rml',
         parser=account_analytic_balance, header=False)

=== modified file 'account/project/report/analytic_check.py'
--- account/project/report/analytic_check.py	2010-02-24 10:46:58 +0000
+++ account/project/report/analytic_check.py	2010-03-17 11:50:49 +0000
@@ -44,7 +44,6 @@
     def _lines_p(self, date1, date2):
         res = []
         acc_obj = self.pool.get('account.account')
-       # print"3333333acc_obj3333333",acc_obj.read(self.cr, self.uid, self.ids, ['name', 'code','user_type'])
 
         for a in acc_obj.read(self.cr, self.uid, self.ids, ['name', 'code']):
             self.cr.execute("SELECT sum(debit), sum(credit) \
@@ -79,41 +78,6 @@
 
         return res
 
-#    def _lines_p(self, date1, date2):
-#        res = []
-#        acc_obj = self.pool.get('account.account')
-#        for a in acc_obj.read(self.cr, self.uid, self.ids, ['name', 'code','sign']):
-#            self.cr.execute("SELECT sum(debit), sum(credit) \
-#                    FROM account_move_line \
-#                    WHERE date>=%s AND date<=%s AND state<>'draft' AND account_id = %s", (date1, date2, a['id']))
-#            (gd, gc) = self.cr.fetchone()
-#            gd = gd or 0.0
-#            gc = gc or 0.0
-#
-#            self.cr.execute("SELECT abs(sum(amount)) AS balance \
-#                    FROM account_analytic_line \
-#                    WHERE date>=%s AND date<=%s AND amount*%s>0 AND general_account_id = %s", (date1, date2, a['sign'], a['id']))
-#            (ad,) = self.cr.fetchone()
-#            ad = ad or 0.0
-#            self.cr.execute("SELECT abs(sum(amount)) AS balance \
-#                    FROM account_analytic_line \
-#                    WHERE date>=%s AND date<=%s AND amount*%s<0 AND general_account_id = %s", (date1, date2, a['sign'], a['id']))
-#            (ac,) = self.cr.fetchone()
-#            ac = ac or 0.0
-#
-#            res.append({'code': a['code'], 'name': a['name'],
-#                'gen_debit': gd,
-#                'gen_credit': gc,
-#                'ana_debit': ad,
-#                'ana_credit': ac,
-#                'delta_debit': gd - ad,
-#                'delta_credit': gc - ac,})
-#            self.sum_gen_deb += gd
-#            self.sum_gen_cred += gc
-#            self.sum_ana_deb += ad
-#            self.sum_ana_cred += ac
-#        return res
-
     def _gen_deb(self, date1, date2):
         return self.sum_gen_deb
 
@@ -134,5 +98,4 @@
 
 report_sxw.report_sxw('report.account.analytic.account.analytic.check', 'account.analytic.account', 'addons/account/project/report/analytic_check.rml',parser=account_analytic_analytic_check, header=False)
 
-
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== modified file 'account/project/report/cost_ledger.py'
--- account/project/report/cost_ledger.py	2009-10-09 11:49:00 +0000
+++ account/project/report/cost_ledger.py	2010-03-17 11:50:49 +0000
@@ -94,15 +94,20 @@
         ids = map(lambda x: x.id, accounts)
         if not len(ids):
             return 0.0
-        self.cr.execute("SELECT sum(amount) FROM account_analytic_line WHERE account_id IN ("+','.join(map(str, ids))+") AND date>=%s AND date<=%s AND amount>0", (date1, date2))
+        self.cr.execute("SELECT SUM(amount) FROM account_analytic_line "
+                        "WHERE account_id IN %s "
+                        "AND date>=%s AND date<=%s AND amount>0",
+                        (tuple(ids), date1, date2))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_credit(self, accounts, date1, date2):
         ids = map(lambda x: x.id, accounts)
         if not len(ids):
             return 0.0
-        ids = map(lambda x: x.id, accounts)
-        self.cr.execute("SELECT -sum(amount) FROM account_analytic_line WHERE account_id IN ("+','.join(map(str, ids))+") AND date>=%s AND date<=%s AND amount<0", (date1, date2))
+        self.cr.execute("SELECT -SUM(amount) FROM account_analytic_line "
+                        "WHERE account_id IN %s "
+                        "AND date>=%s AND date<=%s AND amount<0",
+                        (tuple(ids), date1, date2))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_balance(self, accounts, date1, date2):
@@ -112,6 +117,5 @@
 
 report_sxw.report_sxw('report.account.analytic.account.cost_ledger', 'account.analytic.account', 'addons/account/project/report/cost_ledger.rml',parser=account_analytic_cost_ledger, header=False)
 
-
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
 

=== modified file 'account/project/report/inverted_analytic_balance.py'
--- account/project/report/inverted_analytic_balance.py	2009-10-09 11:49:00 +0000
+++ account/project/report/inverted_analytic_balance.py	2010-03-17 11:50:49 +0000
@@ -39,10 +39,16 @@
 
     def _lines_g(self, accounts, date1, date2):
         ids = map(lambda x: x.id, accounts)
-        self.cr.execute("SELECT aa.name AS name, aa.code AS code, sum(aal.amount) AS balance, sum(aal.unit_amount) AS quantity, aa.id AS id \
+        self.cr.execute("SELECT aa.name AS name, aa.code AS code, "
+                        "sum(aal.amount) AS balance, "
+                        "sum(aal.unit_amount) AS quantity, aa.id AS id \
                 FROM account_analytic_line AS aal, account_account AS aa \
-                WHERE (aal.general_account_id=aa.id) AND (aal.account_id IN ("+','.join(map(str, ids))+")) AND (date>=%s) AND (date<=%s) AND aa.active \
-                GROUP BY aal.general_account_id, aa.name, aa.code, aal.code, aa.id ORDER BY aal.code", (date1, date2))
+                WHERE (aal.general_account_id=aa.id) "
+                        "AND (aal.account_id IN %s) "
+                        "AND (date>=%s) AND (date<=%s) AND aa.active \
+                GROUP BY aal.general_account_id, aa.name, aa.code, aal.code, aa.id "
+                        "ORDER BY aal.code",
+                        (tuple(ids), date1, date2))
         res = self.cr.dictfetchall()
 
         for r in res:
@@ -59,10 +65,17 @@
 
     def _lines_a(self, accounts, general_account_id, date1, date2):
         ids = map(lambda x: x.id, accounts)
-        self.cr.execute("SELECT sum(aal.amount) AS balance, sum(aal.unit_amount) AS quantity, aaa.code AS code, aaa.name AS name, account_id \
-                FROM account_analytic_line AS aal, account_analytic_account AS aaa \
-                WHERE aal.account_id=aaa.id AND aal.account_id IN ("+','.join(map(str, ids))+") AND aal.general_account_id=%s AND aal.date>=%s AND aal.date<=%s \
-                GROUP BY aal.account_id, general_account_id, aaa.code, aaa.name ORDER BY aal.account_id", (general_account_id, date1, date2))
+        self.cr.execute("SELECT sum(aal.amount) AS balance, "
+                        "sum(aal.unit_amount) AS quantity, "
+                        "aaa.code AS code, aaa.name AS name, account_id \
+                FROM account_analytic_line AS aal, "
+                        "account_analytic_account AS aaa \
+                WHERE aal.account_id=aaa.id AND aal.account_id IN %s "
+                        "AND aal.general_account_id=%s AND aal.date>=%s "
+                        "AND aal.date<=%s \
+                GROUP BY aal.account_id, general_account_id, aaa.code, aaa.name "
+                        "ORDER BY aal.account_id",
+                        (tuple(ids), general_account_id, date1, date2))
         res = self.cr.dictfetchall()
 
         aaa_obj = self.pool.get('account.analytic.account')
@@ -87,14 +100,16 @@
         ids = map(lambda x: x.id, accounts)
         self.cr.execute("SELECT sum(amount) \
                 FROM account_analytic_line \
-                WHERE account_id IN ("+','.join(map(str, ids))+") AND date>=%s AND date<=%s AND amount>0", (date1, date2))
+                WHERE account_id IN %s AND date>=%s AND date<=%s AND amount>0",
+                        (tuple(ids), date1, date2))
         return self.cr.fetchone()[0] or 0.0
         
     def _sum_credit(self, accounts, date1, date2):
         ids = map(lambda x: x.id, accounts)
         self.cr.execute("SELECT -sum(amount) \
                 FROM account_analytic_line \
-                WHERE account_id IN ("+','.join(map(str, ids))+") AND date>=%s AND date<=%s AND amount<0", (date1, date2))
+                WHERE account_id IN %s AND date>=%s AND date<=%s AND amount<0",
+                        (tuple(ids), date1, date2))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_balance(self, accounts, date1, date2):
@@ -106,7 +121,8 @@
         ids = map(lambda x: x.id, accounts)
         self.cr.execute("SELECT sum(unit_amount) \
                 FROM account_analytic_line \
-                WHERE account_id IN ("+','.join(map(str, ids))+") AND date>=%s AND date<=%s", (date1, date2))
+                WHERE account_id IN %s AND date>=%s AND date<=%s",
+                        (tuple(ids), date1, date2))
         return self.cr.fetchone()[0] or 0.0
 
 report_sxw.report_sxw('report.account.analytic.account.inverted.balance', 'account.analytic.account', 'addons/account/project/report/inverted_analytic_balance.rml',parser=account_inverted_analytic_balance, header=False)

=== modified file 'account/project/report/quantity_cost_ledger.py'
--- account/project/report/quantity_cost_ledger.py	2009-10-09 11:49:00 +0000
+++ account/project/report/quantity_cost_ledger.py	2010-03-17 11:50:49 +0000
@@ -53,10 +53,9 @@
                     WHERE (aal.account_id=%s) AND (aal.date>=%s) \
                         AND (aal.date<=%s) AND (aal.general_account_id=aa.id) \
                         AND aa.active \
-                        AND (aal.journal_id IN (" +
-                        ','.join(map(str, journal_ids)) + ")) \
+                        AND (aal.journal_id IN %s) \
                     GROUP BY aa.code, aa.name, aa.id ORDER BY aa.code",
-                    (account_id, date1, date2))
+                    (account_id, date1, date2, tuple(journal_ids)))
         res = self.cr.dictfetchall()
         return res
 
@@ -81,10 +80,10 @@
                         account_analytic_journal AS aaj \
                     WHERE (aal.general_account_id=%s) AND (aal.account_id=%s) \
                         AND (aal.date>=%s) AND (aal.date<=%s) \
-                        AND (aal.journal_id=aaj.id) AND (aaj.id IN (" +
-                        ','.join(map(str, journal_ids)) + ")) \
+                        AND (aal.journal_id=aaj.id) AND (aaj.id IN %s) \
                     ORDER BY aal.date, aaj.code, aal.code",
-                    (general_account_id, account_id, date1, date2))
+                    (general_account_id, account_id,
+                     date1, date2, tuple(journal_ids)))
         res = self.cr.dictfetchall()
         return res
 
@@ -99,9 +98,8 @@
             self.cr.execute("SELECT sum(unit_amount) \
                     FROM account_analytic_line \
                     WHERE account_id = %s AND date >= %s AND date <= %s \
-                        AND journal_id IN (" +
-                        ','.join(map(str, journal_ids)) + ")",
-                        (account_id, date1, date2))
+                        AND journal_id IN %s",
+                        (account_id, date1, date2, tuple(journal_ids)))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_quantity(self, accounts, date1, date2, journals):
@@ -111,18 +109,15 @@
         if not journals or not journals[0][2]:
             self.cr.execute("SELECT sum(unit_amount) \
                     FROM account_analytic_line \
-                    WHERE account_id IN (" +
-                    ','.join(map(str, ids)) + ") AND date>=%s AND date<=%s",
-                    (date1, date2))
+                    WHERE account_id IN %s AND date>=%s AND date<=%s",
+                    (tuple(ids), date1, date2))
         else:
             journal_ids = journals[0][2]
             self.cr.execute("SELECT sum(unit_amount) \
                     FROM account_analytic_line \
-                    WHERE account_id IN (" +
-                    ','.join(map(str, ids)) + ") AND date >= %s AND date <= %s \
-                        AND journal_id IN (" +
-                        ','.join(map(str, journal_ids)) + ")",
-                        (date1, date2))
+                    WHERE account_id IN %s AND date >= %s AND date <= %s \
+                        AND journal_id IN %s",
+                        (tuple(ids), date1, date2, tuple(journal_ids)))
         return self.cr.fetchone()[0] or 0.0
 
 report_sxw.report_sxw('report.account.analytic.account.quantity_cost_ledger',

=== modified file 'account/report/account_balance.py'
--- account/report/account_balance.py	2009-10-09 11:49:00 +0000
+++ account/report/account_balance.py	2010-03-17 11:50:49 +0000
@@ -104,10 +104,7 @@
                 ctx['periods'] = form['periods'][0][2]
                 ctx['date_from'] = form['date_from']
                 ctx['date_to'] =  form['date_to']
-#            accounts = self.pool.get('account.account').browse(self.cr, self.uid, ids, ctx)
-#            def cmp_code(x, y):
-#                return cmp(x.code, y.code)
-#            accounts.sort(cmp_code)
+
             child_ids = self.pool.get('account.account')._get_children_and_consol(self.cr, self.uid, ids, ctx)
             if child_ids:
                 ids = child_ids
@@ -131,18 +128,7 @@
                     }
                 self.sum_debit += account['debit']
                 self.sum_credit += account['credit']
-#                if account.child_id:
-#                    def _check_rec(account):
-#                        if not account.child_id:
-#                            return bool(account.credit or account.debit)
-#                        for c in account.child_id:
-#                            if not _check_rec(c) or _check_rec(c):
-#                                return True
-#                        return False
-#                    if not _check_rec(account) :
-#                        continue
                 if account['parent_id']:
-#                    acc = self.pool.get('account.account').read(self.cr, self.uid, [ account['parent_id'][0] ] ,['name'], ctx)
                     for r in result_acc:
                         if r['id'] == account['parent_id'][0]:
                             res['level'] = r['level'] + 1
@@ -155,16 +141,6 @@
                         result_acc.append(res)
                 else:
                     result_acc.append(res)
-#                if account.child_id:
-#                    acc_id = [acc.id for acc in account.child_id]
-#                    lst_string = ''
-#                    lst_string = '\'' + '\',\''.join(map(str,acc_id)) + '\''
-#                    self.cr.execute("select code,id from account_account where id IN (%s)"%(lst_string))
-#                    a_id = self.cr.fetchall()
-#                    a_id.sort()
-#                    ids2 = [x[1] for x in a_id]
-#
-#                    result_acc += self.lines(form, ids2, done, level+1)
             return result_acc
         
         def _sum_credit(self):

=== modified file 'account/report/aged_trial_balance.py'
--- account/report/aged_trial_balance.py	2009-10-09 11:49:00 +0000
+++ account/report/aged_trial_balance.py	2010-03-17 11:50:49 +0000
@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 ##############################################################################
 #
-#    OpenERP, Open Source Management Solution	
+#    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>). All Rights Reserved
 #    $Id$
 #
@@ -21,207 +21,213 @@
 ##############################################################################
 
 import time
+from operator import itemgetter
 import pooler
 import rml_parse
 from report import report_sxw
 
 class aged_trial_report(rml_parse.rml_parse):
 
-	def __init__(self, cr, uid, name, context):
-		super(aged_trial_report, self).__init__(cr, uid, name, context=context)
-		self.line_query = ''
-		self.total_account = []
-
-
-		self.localcontext.update({
-			'time': time,
-			'get_lines': self._get_lines,
-			'get_total': self._get_total,
-			'get_direction': self._get_direction,
-			'get_for_period': self._get_for_period,
-			'get_company': self._get_company,
-			'get_currency': self._get_currency,
-
-		})
-
-
-	def _get_lines(self, form):
-
-		if (form['result_selection'] == 'customer' ):
-			self.ACCOUNT_TYPE = "('receivable')"
-		elif (form['result_selection'] == 'supplier'):
-			self.ACCOUNT_TYPE = "('payable')"
-		else:
-			self.ACCOUNT_TYPE = "('payable','receivable')"
-
-
-		res = []
-		account_move_line_obj = pooler.get_pool(self.cr.dbname).get('account.move.line')
-		self.line_query = account_move_line_obj._query_get(self.cr, self.uid, obj='line',
-				context={'fiscalyear': form['fiscalyear']})
-		self.cr.execute("""SELECT DISTINCT res_partner.id AS id, 
-					res_partner.name AS name 
-				FROM res_partner,account_move_line AS line, account_account 
-				WHERE (line.account_id=account_account.id) 
-					AND ((reconcile_id IS NULL) 
-					OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > '%s' ))) 
-					AND (line.partner_id=res_partner.id) 
-					AND (account_account.company_id = %s) 
-				ORDER BY res_partner.name""" % (form['date1'],form['company_id']))
-		partners = self.cr.dictfetchall()
-		## mise a 0 du total
-		for i in range(7):
-			self.total_account.append(0)
-		#
-
-		# Build a string like (1,2,3) for easy use in SQL query
-                partner_ids = '(' + ','.join( [str(x['id']) for x in partners] ) + ')'
-
-		# This dictionary will store the debit-credit for all partners, using partner_id as key.
-		totals = {}
-		self.cr.execute("""SELECT partner_id, SUM(debit-credit) 
-					FROM account_move_line AS line, account_account
-				    WHERE (line.account_id = account_account.id) 
-					AND (account_account.type IN %s) 
-					AND (partner_id in %s) 
-					AND ((reconcile_id IS NULL)
-					OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > '%s' ))) 
-					AND (account_account.company_id = %s) 
-					AND account_account.active 
-					GROUP BY partner_id""" % (self.ACCOUNT_TYPE, partner_ids,form['date1'],form['company_id']))
-		t = self.cr.fetchall()
-		for i in t:
-			totals[i[0]] = i[1]
-
-		# This dictionary will store the future or past of all partners
-		future_past = {}
-		if form['direction_selection'] == 'future':
-			self.cr.execute("""SELECT partner_id, SUM(debit-credit) 
-						FROM account_move_line AS line, account_account 
-						WHERE (line.account_id=account_account.id) 
-						AND (account_account.type IN %s) 
-						AND (COALESCE(date_maturity,date) < '%s') 
-						AND (partner_id in %s) 
-						AND ((reconcile_id IS NULL)
-						OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > '%s' ))) 
-						AND (account_account.company_id = %s) 
-						AND account_account.active 
-						GROUP BY partner_id"""% (self.ACCOUNT_TYPE, form['date1'], partner_ids,form['date1'], form['company_id']))
-			t = self.cr.fetchall()
-			for i in t:
-				future_past[i[0]] = i[1]
-		elif form['direction_selection'] == 'past': # Using elif so people could extend without this breaking
-			self.cr.execute("""SELECT partner_id, SUM(debit-credit)
-					FROM account_move_line AS line, account_account
-					WHERE (line.account_id=account_account.id)
-						AND (account_account.type IN %s)
-						AND (COALESCE(date_maturity,date) > '%s')
-						AND (partner_id in %s)
-						AND ((reconcile_id IS NULL)
-						OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > '%s' )))
-						AND (account_account.company_id = %s)
-						AND account_account.active
-						GROUP BY partner_id""" % (self.ACCOUNT_TYPE, form['date1'], partner_ids, form['date1'], form['company_id']))
-			t = self.cr.fetchall()
-			for i in t:
-				future_past[i[0]] = i[1]
-
-		# Use one query per period and store results in history (a list variable)
-		# Each history will contain : history[1] = {'<partner_id>': <partner_debit-credit>}
-                history = []
-                for i in range(5):
-			self.cr.execute("""SELECT partner_id, SUM(debit-credit)
-					FROM account_move_line AS line, account_account
-					WHERE (line.account_id=account_account.id)
-						AND (account_account.type IN %s)
-						AND (COALESCE(date_maturity,date) BETWEEN '%s' AND '%s')
-						AND (partner_id in %s )
-						AND ((reconcile_id IS NULL)
-						OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > '%s' )))
-						AND (account_account.company_id = %s)
-						AND account_account.active
-					GROUP BY partner_id""" % (self.ACCOUNT_TYPE, form[str(i)]['start'], form[str(i)]['stop'],partner_ids ,form['date1'] ,form['company_id']))
-
-			t = self.cr.fetchall()
-			d = {}
-			for i in t:
-				d[i[0]] = i[1]
-			history.append(d)
-
-		for partner in partners:
-			values = {}
-			## If choise selection is in the future
-			if form['direction_selection'] == 'future':
-				# Query here is replaced by one query which gets the all the partners their 'before' value
-				before = False
-				if future_past.has_key(partner['id']):
-					before = [ future_past[partner['id']] ]
-
-				self.total_account[6] = self.total_account[6] + (before and before[0] or 0.0)
-
-				values['direction'] = before and before[0] or 0.0
-			elif form['direction_selection'] == 'past': # Changed this so people could in the future create new direction_selections
-				# Query here is replaced by one query which gets the all the partners their 'after' value
-				after = False
-				if future_past.has_key(partner['id']): # Making sure this partner actually was found by the query
-					after = [ future_past[partner['id']] ]
-
-				self.total_account[6] = self.total_account[6] + (after and after[0] or 0.0)
-				values['direction'] = after and after[0] or ""
-
-			for i in range(5):
-				during = False
-				if history[i].has_key(partner['id']):
-					during = [ history[i][partner['id']] ]
-				# Ajout du compteur
-				self.total_account[(i)] = self.total_account[(i)] + (during and during[0] or 0)
-				values[str(i)] = during and during[0] or ""
-
-			total = False
-			if totals.has_key( partner['id'] ):
-				total = [ totals[partner['id']] ]
-			values['total'] = total and total[0] or 0.0
-			## Add for total
-			self.total_account[(i+1)] = self.total_account[(i+1)] + (total and total[0] or 0.0)
-			values['name'] = partner['name']
-			#t = 0.0
-			#for i in range(5)+['direction']:
-			#	t+= float(values.get(str(i), 0.0) or 0.0)
-			#values['total'] = t
-
-			if values['total']:
-				res.append(values)
-
-		total = 0.0
-		totals = {}
-		for r in res:
-			total += float(r['total'] or 0.0)
-			for i in range(5)+['direction']:
-				totals.setdefault(str(i), 0.0)
-				totals[str(i)] += float(r[str(i)] or 0.0)
-		return res
-
-	def _get_total(self,pos):
-		period = self.total_account[int(pos)]
-		return period
-
-	def _get_direction(self,pos):
-		period = self.total_account[int(pos)]
-		return period
-
-	def _get_for_period(self,pos):
-		period = self.total_account[int(pos)]
-		return period
-
-	def _get_company(self, form):
-		return pooler.get_pool(self.cr.dbname).get('res.company').browse(self.cr, self.uid, form['company_id']).name
-
-	def _get_currency(self, form):
-		return pooler.get_pool(self.cr.dbname).get('res.company').browse(self.cr, self.uid, form['company_id']).currency_id.name
+    def __init__(self, cr, uid, name, context):
+        super(aged_trial_report, self).__init__(cr, uid, name, context=context)
+        self.line_query = ''
+        self.total_account = []
+
+
+        self.localcontext.update({
+            'time': time,
+            'get_lines': self._get_lines,
+            'get_total': self._get_total,
+            'get_direction': self._get_direction,
+            'get_for_period': self._get_for_period,
+            'get_company': self._get_company,
+            'get_currency': self._get_currency,
+
+        })
+
+
+    def _get_lines(self, form):
+
+        if (form['result_selection'] == 'customer' ):
+            self.ACCOUNT_TYPE = "('receivable')"
+        elif (form['result_selection'] == 'supplier'):
+            self.ACCOUNT_TYPE = "('payable')"
+        else:
+            self.ACCOUNT_TYPE = "('payable','receivable')"
+
+
+        res = []
+        account_move_line_obj = pooler.get_pool(self.cr.dbname).get('account.move.line')
+        self.line_query = account_move_line_obj._query_get(self.cr, self.uid, obj='line',
+                context={'fiscalyear': form['fiscalyear']})
+        self.cr.execute("""SELECT DISTINCT res_partner.id AS id,
+                    res_partner.name AS name
+                FROM res_partner,account_move_line AS line, account_account
+                WHERE (line.account_id=account_account.id)
+                    AND ((reconcile_id IS NULL)
+                    OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > '%s' )))
+                    AND (line.partner_id=res_partner.id)
+                    AND (account_account.company_id = %s)
+                ORDER BY res_partner.name""" % (form['date1'],form['company_id']))
+        partners = self.cr.dictfetchall()
+        ## mise a 0 du total
+        for i in range(7):
+            self.total_account.append(0)
+
+        partner_ids = tuple(map(attrgetter('id'), partners))
+        # This dictionary will store the debit-credit for all partners, using partner_id as key.
+        totals = {}
+        self.cr.execute("""SELECT partner_id, SUM(debit-credit)
+                    FROM account_move_line AS line, account_account
+                    WHERE (line.account_id = account_account.id)
+                    AND (account_account.type IN %s)
+                    AND (partner_id in %s)
+                    AND ((reconcile_id IS NULL)
+                    OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > %s )))
+                    AND (account_account.company_id = %s)
+                    AND account_account.active
+                    GROUP BY partner_id""" , (
+                        self.ACCOUNT_TYPE, partner_ids,
+                        form['date1'],form['company_id']))
+        t = self.cr.fetchall()
+        for i in t:
+            totals[i[0]] = i[1]
+
+        # This dictionary will store the future or past of all partners
+        future_past = {}
+        if form['direction_selection'] == 'future':
+            self.cr.execute("""SELECT partner_id, SUM(debit-credit)
+                        FROM account_move_line AS line, account_account
+                        WHERE (line.account_id=account_account.id)
+                        AND (account_account.type IN %s)
+                        AND (COALESCE(date_maturity,date) < %s)
+                        AND (partner_id in %s)
+                        AND ((reconcile_id IS NULL)
+                        OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > %s )))
+                        AND (account_account.company_id = %s)
+                        AND account_account.active
+                        GROUP BY partner_id""", (
+                self.ACCOUNT_TYPE, form['date1'], partner_ids,
+                form['date1'], form['company_id']))
+            t = self.cr.fetchall()
+            for i in t:
+                future_past[i[0]] = i[1]
+        elif form['direction_selection'] == 'past': # Using elif so people could extend without this breaking
+            self.cr.execute("""SELECT partner_id, SUM(debit-credit)
+                    FROM account_move_line AS line, account_account
+                    WHERE (line.account_id=account_account.id)
+                        AND (account_account.type IN %s)
+                        AND (COALESCE(date_maturity,date) > %s)
+                        AND (partner_id in %s)
+                        AND ((reconcile_id IS NULL)
+                        OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > %s )))
+                        AND (account_account.company_id = %s)
+                        AND account_account.active
+                        GROUP BY partner_id""" , (
+                self.ACCOUNT_TYPE, form['date1'], partner_ids,
+                form['date1'], form['company_id']))
+            t = self.cr.fetchall()
+            for i in t:
+                future_past[i[0]] = i[1]
+
+        # Use one query per period and store results in history (a list variable)
+        # Each history will contain : history[1] = {'<partner_id>': <partner_debit-credit>}
+        history = []
+        for i in range(5):
+            self.cr.execute("""SELECT partner_id, SUM(debit-credit)
+                    FROM account_move_line AS line, account_account
+                    WHERE (line.account_id=account_account.id)
+                        AND (account_account.type IN %s)
+                        AND (COALESCE(date_maturity,date) BETWEEN %s AND %s)
+                        AND (partner_id in %s )
+                        AND ((reconcile_id IS NULL)
+                        OR (reconcile_id IN (SELECT recon.id FROM account_move_reconcile AS recon WHERE recon.create_date > %s )))
+                        AND (account_account.company_id = %s)
+                        AND account_account.active
+                    GROUP BY partner_id""" , (
+                self.ACCOUNT_TYPE, form[str(i)]['start'], form[str(i)]['stop'],
+                partner_ids ,form['date1'] ,form['company_id']))
+
+            t = self.cr.fetchall()
+            d = {}
+            for i in t:
+                d[i[0]] = i[1]
+            history.append(d)
+
+        for partner in partners:
+            values = {}
+            ## If choise selection is in the future
+            if form['direction_selection'] == 'future':
+                # Query here is replaced by one query which gets the all the partners their 'before' value
+                before = False
+                if future_past.has_key(partner['id']):
+                    before = [ future_past[partner['id']] ]
+
+                self.total_account[6] = self.total_account[6] + (before and before[0] or 0.0)
+
+                values['direction'] = before and before[0] or 0.0
+            elif form['direction_selection'] == 'past': # Changed this so people could in the future create new direction_selections
+                # Query here is replaced by one query which gets the all the partners their 'after' value
+                after = False
+                if future_past.has_key(partner['id']): # Making sure this partner actually was found by the query
+                    after = [ future_past[partner['id']] ]
+
+                self.total_account[6] = self.total_account[6] + (after and after[0] or 0.0)
+                values['direction'] = after and after[0] or ""
+
+            for i in range(5):
+                during = False
+                if history[i].has_key(partner['id']):
+                    during = [ history[i][partner['id']] ]
+                # Ajout du compteur
+                self.total_account[(i)] = self.total_account[(i)] + (during and during[0] or 0)
+                values[str(i)] = during and during[0] or ""
+
+            total = False
+            if totals.has_key( partner['id'] ):
+                total = [ totals[partner['id']] ]
+            values['total'] = total and total[0] or 0.0
+            ## Add for total
+            self.total_account[(i+1)] = self.total_account[(i+1)] + (total and total[0] or 0.0)
+            values['name'] = partner['name']
+            #t = 0.0
+            #for i in range(5)+['direction']:
+            #   t+= float(values.get(str(i), 0.0) or 0.0)
+            #values['total'] = t
+
+            if values['total']:
+                res.append(values)
+
+        total = 0.0
+        totals = {}
+        for r in res:
+            total += float(r['total'] or 0.0)
+            for i in range(5)+['direction']:
+                totals.setdefault(str(i), 0.0)
+                totals[str(i)] += float(r[str(i)] or 0.0)
+        return res
+
+    def _get_total(self,pos):
+        period = self.total_account[int(pos)]
+        return period
+
+    def _get_direction(self,pos):
+        period = self.total_account[int(pos)]
+        return period
+
+    def _get_for_period(self,pos):
+        period = self.total_account[int(pos)]
+        return period
+
+    def _get_company(self, form):
+        return pooler.get_pool(self.cr.dbname).get('res.company').browse(self.cr, self.uid, form['company_id']).name
+
+    def _get_currency(self, form):
+        return pooler.get_pool(self.cr.dbname).get('res.company').browse(self.cr, self.uid, form['company_id']).currency_id.name
 
 
 report_sxw.report_sxw('report.account.aged_trial_balance', 'res.partner',
-		'addons/account/report/aged_trial_balance.rml',parser=aged_trial_report,header=False)
+        'addons/account/report/aged_trial_balance.rml',parser=aged_trial_report,header=False)
 
 
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== modified file 'account/report/general_journal.py'
--- account/report/general_journal.py	2009-10-09 11:49:00 +0000
+++ account/report/general_journal.py	2010-03-17 11:50:49 +0000
@@ -19,7 +19,7 @@
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
-
+from operator import itemgetter
 import pooler
 import time
 from report import report_sxw
@@ -42,10 +42,12 @@
 
     def set_context(self, objects, data, ids, report_type = None):
         super(journal_print, self).set_context(objects, data, ids, report_type)
-        self.cr.execute('select period_id, journal_id from account_journal_period where id in (' + ','.join([str(id) for id in ids]) + ')')
+        self.cr.execute('SELECT period_id, journal_id '
+                        'FROM account_journal_period '
+                        'WHERE id IN %s',
+                        (tuple(ids),))
         res = self.cr.fetchall()
-        self.period_ids = ','.join([str(x[0]) for x in res])
-        self.journal_ids = ','.join([str(x[1]) for x in res])
+        self.period_ids, self.journal_ids = zip(*res)
 
     # returns a list of period objs
     def periods(self, journal_period_objs):
@@ -75,7 +77,14 @@
                     periods.append(data.period_id.id)
             for period in periods:
                 period_data = self.pool.get('account.period').browse(self.cr, self.uid, period)
-                self.cr.execute('select j.code, j.name, sum(l.debit) as debit, sum(l.credit) as credit from account_move_line l left join account_journal j on (l.journal_id=j.id) where period_id=%s and journal_id in (' + ','.join(map(str, journal_id)) + ') and l.state<>\'draft\' group by j.id, j.code, j.name', (period,))
+                self.cr.execute(
+                    'SELECT j.code, j.name, '
+                    'SUM(l.debit) AS debit, SUM(l.credit) AS credit '
+                    'FROM account_move_line l '
+                    'LEFT JOIN account_journal j ON (l.journal_id=j.id) '
+                    'WHERE period_id=%s AND journal_id IN %s '
+                    'AND l.state<>\'draft\' '
+                    'GROUP BY j.id, j.code, j.name', (period, tuple(journal_id)))
                 res = self.cr.dictfetchall()
                 res[0].update({'period_name':period_data.name})
                 res[0].update({'pid':period})
@@ -83,45 +92,59 @@
             return lines_data
         if not self.journal_ids:
             return []
-        self.cr.execute('select j.code, j.name, sum(l.debit) as debit, sum(l.credit) as credit from account_move_line l left join account_journal j on (l.journal_id=j.id) where period_id=%s and journal_id in (' + self.journal_ids + ') and l.state<>\'draft\' group by j.id, j.code, j.name', (period_id,))
+        self.cr.execute('SELECT j.code, j.name, '
+                        'SUM(l.debit) AS debit, SUM(l.credit) AS credit '
+                        'FROM account_move_line l '
+                        'LEFT JOIN account_journal j ON (l.journal_id=j.id) '
+                        'WHERE period_id=%s AND journal_id IN %s '
+                        'AND l.state<>\'draft\' '
+                        'GROUP BY j.id, j.code, j.name'
+                        (period_id,tuple(self.journal_ids)))
         res = self.cr.dictfetchall()
         return res
 
     def _sum_debit_period(self, period_id,journal_id=None):
-        if type(journal_id)==type([]):
-            self.cr.execute('select sum(debit) from account_move_line where period_id=%s and journal_id in (' + ','.join(map(str, journal_id)) + ') and state<>\'draft\'', (period_id,))
-            return self.cr.fetchone()[0] or 0.0
-        if not self.journal_ids:
+        journals = journal_id or self.journal_ids
+        if not journals:
             return 0.0
-        self.cr.execute('select sum(debit) from account_move_line where period_id=%s and journal_id in (' + self.journal_ids + ') and state<>\'draft\'', (period_id,))
-
+        self.cr.execute('SELECT SUM(debit) FROM account_move_line '
+                        'WHERE period_id=%s AND journal_id IN %s '
+                        'AND state<>\'draft\'',
+                        (period_id, tuple(journals)))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_credit_period(self, period_id,journal_id=None):
-        if type(journal_id)==type([]):
-            self.cr.execute('select sum(credit) from account_move_line where period_id=%s and journal_id in (' + ','.join(map(str, journal_id)) + ') and state<>\'draft\'', (period_id,))
-            return self.cr.fetchone()[0] or 0.0
-        if not self.journal_ids:
+        journals = journal_id or self.journal_ids
+        if not journals:
             return 0.0
-        self.cr.execute('select sum(credit) from account_move_line where period_id=%s and journal_id in (' + self.journal_ids + ') and state<>\'draft\'', (period_id,))
+        self.cr.execute('SELECT SUM(credit) FROM account_move_line '
+                        'WHERE period_id=%s AND journal_id IN %s '
+                        'AND state<>\'draft\'',
+                        (period_id,tuple(journals)))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_debit(self,period_id=None,journal_id=None):
-        if type(period_id)==type([]):
-            self.cr.execute('select sum(debit) from account_move_line where period_id in (' + ','.join(map(str, period_id)) + ') and journal_id in (' + ','.join(map(str, journal_id)) + ') and state<>\'draft\'')
-            return self.cr.fetchone()[0] or 0.0
-        if not self.journal_ids or not self.period_ids:
+        journals = journal_id or self.journal_ids
+        periods = period_id or self.period_ids
+        if not (journals and periods):
             return 0.0
-        self.cr.execute('select sum(debit) from account_move_line where period_id in (' + self.period_ids + ') and journal_id in (' + self.journal_ids + ') and state<>\'draft\'')
+        self.cr.execute('SELECT SUM(debit) FROM account_move_line '
+                        'WHERE period_id IN %s '
+                        'AND journal_id IN %s '
+                        'AND state<>\'draft\'',
+                        (tuple(periods), tuple(journals)))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_credit(self,period_id=None,journal_id=None):
-        if type(period_id)==type([]):
-            self.cr.execute('select sum(credit) from account_move_line where period_id in (' + ','.join(map(str, period_id)) + ') and journal_id in (' + ','.join(map(str, journal_id)) + ') and state<>\'draft\'')
-            return self.cr.fetchone()[0] or 0.0
-        if not self.journal_ids or not self.period_ids:
+        periods = period_id or self.period_ids
+        journals = journal_id or self.journal_ids
+        if not (periods and journals):
             return 0.0
-        self.cr.execute('select sum(credit) from account_move_line where period_id in (' + self.period_ids + ') and journal_id in (' + self.journal_ids + ') and state<>\'draft\'')
+        self.cr.execute('SELECT SUM(credit) FROM account_move_line '
+                        'WHERE period_id IN %s '
+                        'AND journal_id IN %s '
+                        'AND state<>\'draft\'',
+                        (tuple(periods), tuple(journals)))
         return self.cr.fetchone()[0] or 0.0
 report_sxw.report_sxw('report.account.general.journal', 'account.journal.period', 'addons/account/report/general_journal.rml',parser=journal_print)
 report_sxw.report_sxw('report.account.general.journal.wiz', 'account.journal.period', 'addons/account/report/wizard_general_journal.rml',parser=journal_print, header=False)

=== modified file 'account/report/general_ledger.py'
--- account/report/general_ledger.py	2010-01-18 07:47:33 +0000
+++ account/report/general_ledger.py	2010-03-17 11:50:49 +0000
@@ -123,14 +123,15 @@
             periods = form['periods'][0][2]
             if not periods:
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.fiscalyear_id = """ + str(form['fiscalyear'])   + """
+                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.fiscalyear_id = %s
                     """
+                sqlargs = (form['fiscalyear'],)
             else:
-                periods_id = ','.join(map(str, periods))
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.id in ( """ + periods_id   + """)
+                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.id in %s
                     """
-            self.cr.execute(sql)
+                sqlargs = (tuple(periods),)
+            self.cr.execute(sql, sqlargs)
             res = self.cr.dictfetchall()
             borne_min = res[0]['start_date']
             borne_max = res[0]['stop_date']
@@ -141,14 +142,21 @@
             periods = form['periods'][0][2]
             if not periods:
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.fiscalyear_id = """ + str(form['fiscalyear'])   + """
+                    SELECT MIN(p.date_start) AS start_date,
+                           MAX(p.date_stop) AS stop_date
+                    FROM account_period AS p
+                    WHERE p.fiscalyear_id = %s
                     """
+                sqlargs = (form['fiscalyear'],)
             else:
-                periods_id = ','.join(map(str, periods))
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.id in ( """ + periods_id   + """)
+                    SELECT MIN(p.date_start) AS start_date,
+                           MAX(p.date_stop) AS stop_date
+                    FROM account_period AS p
+                    WHERE p.id IN %s
                     """
-            self.cr.execute(sql)
+                sqlargs = (tuple(periods),)
+            self.cr.execute(sql, sqlargs)
             res = self.cr.dictfetchall()
             period_min = res[0]['start_date']
             period_max = res[0]['stop_date']
@@ -232,8 +240,12 @@
         else:
             ## We will now compute solde initiaux
             for move in res:
-                SOLDEINIT = "SELECT sum(l.debit) AS sum_debit, sum(l.credit) AS sum_credit FROM account_move_line l WHERE l.account_id = " + str(move.id) +  " AND l.date < '" + self.borne_date['max_date'] + "'" +  " AND l.date > '" + self.borne_date['min_date'] + "'"
-                self.cr.execute(SOLDEINIT)
+                SOLDEINIT = "SELECT SUM(l.debit) AS sum_debit,"\
+                            "       SUM(l.credit) AS sum_credit "\
+                            "FROM account_move_line l "\
+                            "WHERE l.account_id = %s "\
+                            "AND l.date < %s AND l.date > %s"
+                self.cr.execute(SOLDEINIT, (move.id, self.borne_date['max_date'],self.borne_date['min_date']))
                 resultat = self.cr.dictfetchall()
                 if resultat[0] :
                     if resultat[0]['sum_debit'] == None:
@@ -354,7 +366,8 @@
             return 0.0
         self.cr.execute("SELECT sum(debit) "\
                 "FROM account_move_line l "\
-                "WHERE l.account_id in ("+','.join(map(str, self.child_ids))+") AND "+self.query)
+                "WHERE l.account_id in %s AND "+self.query,
+                        (tuple(self.child_ids),))
         sum_debit = self.cr.fetchone()[0] or 0.0
         return sum_debit
 
@@ -363,7 +376,8 @@
             return 0.0
         self.cr.execute("SELECT sum(credit) "\
                 "FROM account_move_line l "\
-                "WHERE l.account_id in ("+','.join(map(str, self.child_ids))+") AND "+self.query)
+                "WHERE l.account_id in %s AND "+self.query,
+                        (tuple(self.child_ids),))
         ## Add solde init to the result
         #
         sum_credit = self.cr.fetchone()[0] or 0.0
@@ -374,7 +388,8 @@
             return 0.0
         self.cr.execute("SELECT (sum(debit) - sum(credit)) as tot_solde "\
                 "FROM account_move_line l "\
-                "WHERE l.account_id in ("+','.join(map(str, self.child_ids))+") AND "+self.query)
+                "WHERE l.account_id in %s AND "+self.query,
+                        (tuple(self.child_ids),))
         sum_solde = self.cr.fetchone()[0] or 0.0
         return sum_solde
 

=== modified file 'account/report/general_ledger_landscape.py'
--- account/report/general_ledger_landscape.py	2010-01-18 07:47:33 +0000
+++ account/report/general_ledger_landscape.py	2010-03-17 11:50:49 +0000
@@ -122,14 +122,15 @@
             periods = form['periods'][0][2]
             if not periods:
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.fiscalyear_id = """ + str(form['fiscalyear'])   + """
+                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.fiscalyear_id = %s
                     """
+                sqlargs = (form['fiscalyear'],)
             else:
-                periods_id = ','.join(map(str, periods))
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.id in ( """ + periods_id   + """)
+                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.id in %s
                     """
-            self.cr.execute(sql)
+                sqlargs = (tuple(periods),)
+            self.cr.execute(sql, sqlargs)
             res = self.cr.dictfetchall()
             borne_min = res[0]['start_date']
             borne_max = res[0]['stop_date']
@@ -140,14 +141,15 @@
             periods = form['periods'][0][2]
             if not periods:
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.fiscalyear_id = """ + str(form['fiscalyear'])   + """
+                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.fiscalyear_id = %s
                     """
+                sqlargs = (form['fiscalyear'],)
             else:
-                periods_id = ','.join(map(str, periods))
                 sql = """
-                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.id in ( """ + periods_id   + """)
+                    Select min(p.date_start) as start_date,max(p.date_stop) as stop_date from account_period as p where p.id in %s
                     """
-            self.cr.execute(sql)
+                sqlargs = (tuple(periods),)
+            self.cr.execute(sql, sqlargs)
             res = self.cr.dictfetchall()
             period_min = res[0]['start_date']
             period_max = res[0]['stop_date']
@@ -233,8 +235,8 @@
         else:
             ## We will now compute solde initiaux
             for move in res:
-                SOLDEINIT = "SELECT sum(l.debit) AS sum_debit, sum(l.credit) AS sum_credit FROM account_move_line l WHERE l.account_id = " + str(move.id) +  " AND l.date < '" + self.borne_date['max_date'] + "'" +  " AND l.date > '" + self.borne_date['min_date'] + "'"
-                self.cr.execute(SOLDEINIT)
+                SOLDEINIT = "SELECT sum(l.debit) AS sum_debit, sum(l.credit) AS sum_credit FROM account_move_line l WHERE l.account_id = %s AND l.date < %s AND l.date > %s"
+                self.cr.execute(SOLDEINIT, (move.id, self.borne_date['max_date'], self.borne_date['min_date']))
                 resultat = self.cr.dictfetchall()
                 if resultat[0] :
                     if resultat[0]['sum_debit'] == None:
@@ -287,7 +289,7 @@
         for l in res:
             line = self.pool.get('account.move.line').browse(self.cr, self.uid, l['id'])
             l['move'] = line.move_id.name
-            self.cr.execute('Select id from account_invoice where move_id =%s'%(line.move_id.id))
+            self.cr.execute('Select id from account_invoice where move_id =%s',(line.move_id.id,))
             tmpres = self.cr.dictfetchall()
             if len(tmpres) > 0 :
                 inv = self.pool.get('account.invoice').browse(self.cr, self.uid, tmpres[0]['id'])
@@ -355,7 +357,8 @@
             return 0.0
         self.cr.execute("SELECT sum(debit) "\
                 "FROM account_move_line l "\
-                "WHERE l.account_id in ("+','.join(map(str, self.child_ids))+") AND "+self.query)
+                "WHERE l.account_id in %s AND "+self.query,
+                        (tuple(self.child_ids),))
         sum_debit = self.cr.fetchone()[0] or 0.0
         return sum_debit
 
@@ -364,7 +367,8 @@
             return 0.0
         self.cr.execute("SELECT sum(credit) "\
                 "FROM account_move_line l "\
-                "WHERE l.account_id in ("+','.join(map(str, self.child_ids))+") AND "+self.query)
+                "WHERE l.account_id in %s AND "+self.query,
+                        (tuple(self.child_ids),))
         ## Add solde init to the result
         #
         sum_credit = self.cr.fetchone()[0] or 0.0
@@ -375,7 +379,8 @@
             return 0.0
         self.cr.execute("SELECT (sum(debit) - sum(credit)) as tot_solde "\
                 "FROM account_move_line l "\
-                "WHERE l.account_id in ("+','.join(map(str, self.child_ids))+") AND "+self.query)
+                "WHERE l.account_id in %s AND "+self.query,
+                        (tuple(self.child_ids),))
         sum_solde = self.cr.fetchone()[0] or 0.0
         return sum_solde
 

=== modified file 'account/report/partner_balance.py'
--- account/report/partner_balance.py	2009-10-09 11:49:00 +0000
+++ account/report/partner_balance.py	2010-03-17 11:50:49 +0000
@@ -30,7 +30,6 @@
     def __init__(self, cr, uid, name, context):
         super(partner_balance, self).__init__(cr, uid, name, context=context)
         self.date_lst = []
-        self.date_lst_string = ''
         self.account_ids = ''
         self.localcontext.update( {
             'time': time,
@@ -164,29 +163,23 @@
 
             self.transform_both_into_date_array(data)
 
-        ##
-        self.date_lst_string =''
-        if self.date_lst:
-            self.date_lst_string = '\'' + '\',\''.join(map(str,self.date_lst)) + '\''
-
-
         ## Compute Code
         account_move_line_obj = pooler.get_pool(self.cr.dbname).get('account.move.line')
         #
         if (data['form']['result_selection'] == 'customer' ):
-            self.ACCOUNT_TYPE = "('receivable')"
+            self.ACCOUNT_TYPE = ('receivable',)
         elif (data['form']['result_selection'] == 'supplier'):
-            self.ACCOUNT_TYPE = "('payable')"
+            self.ACCOUNT_TYPE = ('payable',)
         else:
-            self.ACCOUNT_TYPE = "('payable','receivable')"
+            self.ACCOUNT_TYPE = ('payable','receivable')
         #
         self.cr.execute("SELECT a.id " \
                 "FROM account_account a " \
                 "LEFT JOIN account_account_type t " \
                     "ON (a.type = t.code) " \
                 "WHERE a.company_id = %s " \
-                    "AND a.type IN " + self.ACCOUNT_TYPE + " " \
-                    "AND a.active", (data['form']['company_id'],))
+                    "AND a.type IN %s " \
+                    "AND a.active", (data['form']['company_id'],self.ACCOUNT_TYPE))
         self.account_ids = ','.join([str(a) for (a,) in self.cr.fetchall()])
 
         super(partner_balance, self).set_context(objects, data, ids, report_type)
@@ -196,7 +189,7 @@
         account_move_line_obj = pooler.get_pool(self.cr.dbname).get('account.move.line')
         full_account = []
         result_tmp = 0.0
-        if self.date_lst_string:
+        if self.date_lst:
             self.cr.execute(
                 "SELECT p.ref,l.account_id,ac.name as account_name,ac.code as code ,p.name, sum(debit) as debit, sum(credit) as credit, " \
                         "CASE WHEN sum(debit) > sum(credit) " \
@@ -210,16 +203,17 @@
                         "(SELECT sum(debit-credit) " \
                             "FROM account_move_line l " \
                             "WHERE partner_id = p.id " \
-                                "AND l.date IN (" + self.date_lst_string + ") " \
+                                "AND l.date IN %s " \
                                 "AND blocked = TRUE " \
                         ") AS enlitige " \
                 "FROM account_move_line l LEFT JOIN res_partner p ON (l.partner_id=p.id) " \
                 "JOIN account_account ac ON (l.account_id = ac.id)" \
-                "WHERE ac.type IN " + self.ACCOUNT_TYPE + " " \
-                    "AND l.date IN (" + self.date_lst_string + ") " \
-                    "AND ac.company_id = "+ str(data['form']['company_id']) +" " \
+                "WHERE ac.type IN %s " \
+                    "AND l.date IN %s " \
+                    "AND ac.company_id = %s " \
                 "GROUP BY p.id, p.ref, p.name,l.account_id,ac.name,ac.code " \
-                "ORDER BY l.account_id,p.name")
+                "ORDER BY l.account_id,p.name",
+                (tuple(self.date_lst), self.ACCOUNT_TYPE, tuple(self.date_lst), data['form']['company_id']))
             res = self.cr.dictfetchall()
             for r in res:
                 full_account.append(r)
@@ -352,12 +346,13 @@
         account_move_line_obj = pooler.get_pool(self.cr.dbname).get('account.move.line')
         result_tmp = 0.0
         temp_res = 0.0
-        if self.date_lst_string:
+        if self.date_lst:
             self.cr.execute(
                     "SELECT sum(debit) " \
                     "FROM account_move_line AS l " \
                     "WHERE l.account_id IN (" + self.account_ids + ") " \
-                        "AND l.date IN (" + self.date_lst_string + ") " )
+                        "AND l.date IN %s",
+                (tuple(self.date_lst),))
             temp_res = float(self.cr.fetchone()[0] or 0.0)
         result_tmp = result_tmp + temp_res
 
@@ -370,12 +365,13 @@
 
         result_tmp = 0.0
         temp_res = 0.0
-        if self.date_lst_string:
+        if self.date_lst:
             self.cr.execute(
                     "SELECT sum(credit) " \
                     "FROM account_move_line AS l " \
                     "WHERE l.account_id IN (" + self.account_ids + ") " \
-                        "AND l.date IN (" + self.date_lst_string + ") " )
+                        "AND l.date IN %s",
+                (tuple(self.date_lst),))
             temp_res = float(self.cr.fetchone()[0] or 0.0)
         result_tmp = result_tmp + temp_res
 
@@ -387,13 +383,14 @@
         account_move_line_obj = pooler.get_pool(self.cr.dbname).get('account.move.line')
         result_tmp = 0.0
         temp_res = 0.0
-        if self.date_lst_string:
+        if self.date_lst:
             self.cr.execute(
                     "SELECT sum(debit-credit) " \
                     "FROM account_move_line AS l " \
                     "WHERE l.account_id IN (" + self.account_ids + ") " \
-                        "AND l.date IN (" + self.date_lst_string + ") " \
-                        "AND l.blocked=TRUE " )
+                        "AND l.date IN %s " \
+                        "AND l.blocked=TRUE ",
+                (tuple(self.date_lst),))
             temp_res = float(self.cr.fetchone()[0] or 0.0)
         result_tmp = result_tmp + temp_res
 
@@ -405,7 +402,7 @@
         account_move_line_obj = pooler.get_pool(self.cr.dbname).get('account.move.line')
         result_tmp = 0.0
         a = 0.0
-        if self.date_lst_string:
+        if self.date_lst:
             self.cr.execute(
                 "SELECT CASE WHEN sum(debit) > sum(credit) " \
                         "THEN sum(debit) - sum(credit) " \
@@ -413,8 +410,9 @@
                     "END " \
                 "FROM account_move_line AS l " \
                 "WHERE l.account_id IN (" + self.account_ids + ") " \
-                    "AND l.date IN (" + self.date_lst_string + ") " \
-                "GROUP BY l.partner_id")
+                    "AND l.date IN %s " \
+                "GROUP BY l.partner_id",
+                (tuple(self.date_lst),))
             a = self.cr.fetchone()[0]
 
             if self.cr.fetchone() != None:
@@ -432,7 +430,7 @@
 
         result_tmp = 0.0
         a = 0.0
-        if self.date_lst_string:
+        if self.date_lst:
             self.cr.execute(
                 "SELECT CASE WHEN sum(debit) < sum(credit) " \
                         "THEN sum(credit) - sum(debit) " \
@@ -440,8 +438,9 @@
                     "END " \
                 "FROM account_move_line AS l " \
                 "WHERE l.account_id IN (" + self.account_ids + ") " \
-                "AND l.date IN (" + self.date_lst_string + ") " \
-                "GROUP BY l.partner_id")
+                "AND l.date IN %s " \
+                "GROUP BY l.partner_id",
+                (tuple(self.date_lst),))
             a = self.cr.fetchone()[0] or 0.0
 
             if self.cr.fetchone() != None:

=== modified file 'account/report/tax_report.py'
--- account/report/tax_report.py	2009-10-09 11:49:00 +0000
+++ account/report/tax_report.py	2010-03-17 11:50:49 +0000
@@ -90,7 +90,7 @@
 
 	def _get_general(self, tax_code_id,period_list ,company_id, based_on):
 		res=[]
-		period_sql_list =  ','.join(map(str, period_list[0][2]))
+		periods_ids = tuple(period_list[0][2])
 		if based_on == 'payments':
 			self.cr.execute('SELECT SUM(line.tax_amount) AS tax_amount, \
 						SUM(line.debit) AS debit, \
@@ -109,11 +109,11 @@
 						AND line.account_id = account.id \
 						AND account.company_id = %s \
 						AND move.id = line.move_id \
-						AND line.period_id IN ('+ period_sql_list +') \
+						AND line.period_id IN %s \
 						AND ((invoice.state = %s) \
 							OR (invoice.id IS NULL))  \
-					GROUP BY account.id,account.name,account.code', ('draft',tax_code_id,
-						company_id, 'paid'))
+					GROUP BY account.id,account.name,account.code',
+						('draft',tax_code_id,company_id,periods_ids,'paid'))
 
 		else :
 			self.cr.execute('SELECT SUM(line.tax_amount) AS tax_amount, \
@@ -129,10 +129,10 @@
 						AND line.tax_code_id = %s  \
 						AND line.account_id = account.id \
 						AND account.company_id = %s \
-						AND line.period_id IN ('+ period_sql_list +') \
+						AND line.period_id IN %s \
 						AND account.active \
-					GROUP BY account.id,account.name,account.code', ('draft',tax_code_id,
-						company_id))
+					GROUP BY account.id,account.name,account.code',
+						('draft',tax_code_id,company_id,periods_ids))
 		res = self.cr.dictfetchall()
 		
 						#AND line.period_id IN ('+ period_sql_list +') \

=== modified file 'account/wizard/wizard_account_balance_report.py'
--- account/wizard/wizard_account_balance_report.py	2009-09-07 07:09:31 +0000
+++ account/wizard/wizard_account_balance_report.py	2010-03-17 11:50:49 +0000
@@ -112,8 +112,8 @@
 
     def _check_date(self, cr, uid, data, context):
         sql = """
-            SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where '%s' between f.date_start and f.date_stop """%(data['form']['date_from'])
-        cr.execute(sql)
+            SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where %s between f.date_start and f.date_stop """
+        cr.execute(sql, (data['form']['date_from'],))
         res = cr.dictfetchall()
         if res:
             if (data['form']['date_to'] > res[0]['date_stop'] or data['form']['date_to'] < res[0]['date_start']):

=== modified file 'account/wizard/wizard_general_ledger_report.py'
--- account/wizard/wizard_general_ledger_report.py	2009-09-07 07:09:31 +0000
+++ account/wizard/wizard_general_ledger_report.py	2010-03-17 11:50:49 +0000
@@ -106,8 +106,8 @@
 def _check_date(self, cr, uid, data, context):
     
     sql = """
-        SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where '%s' between f.date_start and f.date_stop """%(data['form']['date_from'])
-    cr.execute(sql)
+        SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where %s between f.date_start and f.date_stop """
+    cr.execute(sql, (data['form']['date_from'],))
     res = cr.dictfetchall()
     if res:
         if (data['form']['date_to'] > res[0]['date_stop'] or data['form']['date_to'] < res[0]['date_start']):

=== modified file 'account/wizard/wizard_open_closed_fiscalyear.py'
--- account/wizard/wizard_open_closed_fiscalyear.py	2009-01-27 11:15:46 +0000
+++ account/wizard/wizard_open_closed_fiscalyear.py	2010-03-17 11:50:49 +0000
@@ -43,16 +43,7 @@
     period_journal = data_fyear.end_journal_period_id
     ids_move = pool.get('account.move').search(cr,uid,[('journal_id','=',period_journal.journal_id.id),('period_id','=',period_journal.period_id.id)])
     if ids_move:
-        cr.execute('delete from account_move where id in ('+','.join(map(str,ids_move))+')')
-    #cr.execute('UPDATE account_journal_period ' \
-    #        'SET state = %s ' \
-    #        'WHERE period_id IN (SELECT id FROM account_period WHERE fiscalyear_id = %s)',
-    #        ('draft',data_fyear))
-    #cr.execute('UPDATE account_period SET state = %s ' \
-    #        'WHERE fiscalyear_id = %s', ('draft',data_fyear))
-    #cr.execute('UPDATE account_fiscalyear ' \
-    #        'SET state = %s, end_journal_period_id = null '\
-    #        'WHERE id = %s', ('draft',data_fyear))
+        cr.execute('delete from account_move where id in %s', (tuple(ids_move),))
     return {}
 
 class open_closed_fiscal(wizard.interface):

=== modified file 'account/wizard/wizard_partner_balance_report.py'
--- account/wizard/wizard_partner_balance_report.py	2009-04-29 07:42:01 +0000
+++ account/wizard/wizard_partner_balance_report.py	2010-03-17 11:50:49 +0000
@@ -102,8 +102,8 @@
     def _check_date(self, cr, uid, data, context):
         
         sql = """
-            SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where '%s' between f.date_start and f.date_stop """%(data['form']['date1'])
-        cr.execute(sql)
+            SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where %s between f.date_start and f.date_stop """
+        cr.execute(sql, (data['form']['date1'],))
         res = cr.dictfetchall()
         if res:
             if (data['form']['date2'] > res[0]['date_stop'] or data['form']['date2'] < res[0]['date_start']):

=== modified file 'account/wizard/wizard_third_party_ledger.py'
--- account/wizard/wizard_third_party_ledger.py	2009-05-29 11:35:52 +0000
+++ account/wizard/wizard_third_party_ledger.py	2010-03-17 11:50:49 +0000
@@ -114,8 +114,8 @@
     def _check_date(self, cr, uid, data, context):
 
         sql = """
-            SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where '%s' between f.date_start and f.date_stop """%(data['form']['date1'])
-        cr.execute(sql)
+            SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where %s between f.date_start and f.date_stop """
+        cr.execute(sql, (data['form']['date1'],))
         res = cr.dictfetchall()
         if res:
             if (data['form']['date2'] > res[0]['date_stop'] or data['form']['date2'] < res[0]['date_start']):

=== modified file 'account_analytic_plans/report/crossovered_analytic.py'
--- account_analytic_plans/report/crossovered_analytic.py	2009-10-09 11:49:00 +0000
+++ account_analytic_plans/report/crossovered_analytic.py	2010-03-17 11:50:49 +0000
@@ -72,13 +72,19 @@
 
         self.dict_acc_ref = {}
         if form['journal_ids'][0][2]:
-            journal = " in (" + ','.join(map(lambda x: str(x), form['journal_ids'][0][2])) + ")"
+            journal_filter = "in %s"
+            sql_args = (tuple(form['journal_ids'][0][2]),)
         else:
-            journal = 'is not null'
-
-        query_general = "select id from account_analytic_line where (journal_id " + journal +") AND date>='"+ str(form['date1']) +"'"" AND date<='" + str(form['date2']) + "'"
-
-        self.cr.execute(query_general)
+            journal_filter = 'is not null'
+            sql_args = ()
+
+        query_general = "SELECT id FROM account_analytic_line "\
+                        "WHERE (journal_id %s) "\
+                        "AND date>=%%s "\
+                        "AND date<=%%s"%(
+            journal_filter)
+
+        self.cr.execute(query_general, sql_args + (form['date1'], form['date2']))
         l_ids=self.cr.fetchall()
         line_ids = [x[0] for x in l_ids]
 
@@ -98,10 +104,16 @@
         self.final_list = children_list
         selected_ids = line_pool.search(self.cr,self.uid,[('account_id','in',self.final_list)])
 
-        query="SELECT sum(aal.amount) AS amt, sum(aal.unit_amount) AS qty FROM account_analytic_line AS aal, account_analytic_account AS aaa \
-                WHERE aal.account_id=aaa.id AND aal.id IN ("+','.join(map(str,selected_ids))+") AND (aal.journal_id " + journal +") AND aal.date>='"+ str(form['date1']) +"'"" AND aal.date<='" + str(form['date2']) + "'"
+        query="SELECT SUM(aal.amount) AS amt, SUM(aal.unit_amount) AS qty "\
+               "FROM account_analytic_line AS aal, account_analytic_account AS aaa "\
+               "WHERE aal.account_id=aaa.id "\
+               "AND aal.id IN %%s "\
+               "AND (aal.journal_id %s) "\
+               "AND aal.date>=%%s "\
+               "AND aal.date<=%%s"%(journal_filter)
 
-        self.cr.execute(query)
+        self.cr.execute(
+            query, (tuple(selected_ids),) + sql_args + (form['date1'],form['date2']))
         info=self.cr.dictfetchall()
 
         res['ref_qty']=info[0]['qty']
@@ -116,9 +128,11 @@
             ids = self.ids
 
         if form['journal_ids'][0][2]:
-            journal=" in (" + ','.join(map(lambda x: str(x), form['journal_ids'][0][2])) + ")"
+            journal_filter = " in %s"
+            sql_args = (tuple(form['journal_ids'][0][2]),)
         else:
-            journal= 'is not null'
+            journal_filter = 'is not null'
+            sql_args = ()
 
         acc_pool = self.pool.get('account.analytic.account')
         line_pool=self.pool.get('account.analytic.line')
@@ -132,10 +146,22 @@
         for acc_id in self.final_list:
             selected_ids = line_pool.search(self.cr,self.uid,[('account_id','=',acc_id),('move_id','in',self.dict_acc_ref[form['ref']])])
             if selected_ids:
-                query="SELECT aaa.code as code , sum(aal.amount) AS amt, sum(aal.unit_amount) AS qty,aaa.name as acc_name,aal.account_id as id  FROM account_analytic_line AS aal, account_analytic_account AS aaa \
-                WHERE aal.account_id=aaa.id AND aal.id IN ("+','.join(map(str,selected_ids))+") AND (aal.journal_id " + journal +") AND aal.date>='"+ str(form['date1']) +"'"" AND aal.date<='" + str(form['date2']) + "'"" GROUP BY aal.account_id,aaa.name,aaa.code ORDER BY aal.account_id"
+                query="SELECT aaa.code as code , SUM(aal.amount) AS amt, "\
+                       "SUM(aal.unit_amount) AS qty, aaa.name AS acc_name, "\
+                       "aal.account_id AS id "\
+                       "FROM account_analytic_line AS aal, account_analytic_account AS aaa "\
+                       "WHERE aal.account_id=aaa.id "\
+                       "AND aal.id IN %%s "\
+                       "AND (aal.journal_id %s) "\
+                       "AND aal.date>=%%s "\
+                       "AND aal.date<=%%s "\
+                       "GROUP BY aal.account_id, aaa.name, aaa.code "\
+                       "ORDER BY aal.account_id" % (
+                    journal_filter
+                    )
 
-                self.cr.execute(query)
+                self.cr.execute(query, (tuple(selected_ids),) + sql_args \
+                                + (form['date1'], form['date2']))
                 res = self.cr.dictfetchall()
                 if res:
                     for element in res:

=== modified file 'account_payment/account_move_line.py'
--- account_payment/account_move_line.py	2010-01-08 11:38:58 +0000
+++ account_payment/account_move_line.py	2010-03-17 11:50:49 +0000
@@ -19,7 +19,7 @@
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
-
+from operator import itemgetter
 from osv import fields, osv
 from tools.translate import _
 
@@ -43,7 +43,7 @@
                         WHERE move_line_id = ml.id
                         AND po.state != 'cancel') as amount
                     FROM account_move_line ml
-                    WHERE id in (%s)""" % (",".join(map(str, ids))))
+                    WHERE id in %s""", (tuple(ids),))
         r=dict(cr.fetchall())
         return r
 
@@ -59,8 +59,10 @@
         END - coalesce(sum(pl.amount_currency), 0)
         FROM payment_line pl
         INNER JOIN payment_order po ON (pl.order_id = po.id)
-        WHERE move_line_id = l.id AND po.state != 'cancel')''' \
-        + x[1] + str(x[2])+' ',args))
+        WHERE move_line_id = l.id
+        AND po.state != 'cancel'
+        ) %(operator)s %%s ''' % {'operator': x[1]}, args))
+        sql_args = tuple(map(itemgetter(2), args))
 
         cr.execute(('''select id
             from account_move_line l
@@ -69,7 +71,7 @@
                 where type=%s and active)
             and reconcile_id is null
             and credit > 0
-            and ''' + where + ' and ' + query), ('payable',) )
+            and ''' + where + ' and ' + query), ('payable',)+sql_args )
 
         res = cr.fetchall()
         if not len(res):

=== modified file 'account_payment/payment.py'
--- account_payment/payment.py	2009-02-26 14:31:43 +0000
+++ account_payment/payment.py	2010-03-17 11:50:49 +0000
@@ -65,8 +65,6 @@
             join payment_mode pm on (pm.type = pt.id)
             where pm.id = %s """, [payment_code])
         return [x[0] for x in cr.fetchall()]
-
-
 payment_mode()
 
 
@@ -150,19 +148,8 @@
     _name = 'payment.line'
     _description = 'Payment Line'
 
-    #~ def partner_payable(self, cr, uid, ids, name, args, context={}):
-        #~ if not ids: return {}
-        #~ partners= self.read(cr, uid, ids, ['partner_id'], context)
-        #~ partners= dict(map(lambda x: (x['id'], x['partner_id'][0]), partners))
-        #~ debit = self.pool.get('res.partner')._debit_get(cr, uid,
-                #~ partners.values(), name, args, context)
-        #~ for i in partners:
-            #~ partners[i] = debit[partners[i]]
-        #~ return partners
-
     def translate(self, orig):
         return {
-#               "to_pay": "credit",
                 "due_date": "date_maturity",
                 "reference": "ref"}.get(orig, orig)
 
@@ -224,8 +211,8 @@
             from account_move_line ml
                 inner join payment_line pl
                 on (ml.id = pl.move_line_id)
-            where pl.id in (%s)"""%
-            (self.translate(name), ','.join(map(str,ids))) )
+            where pl.id in %%s"""% self.translate(name),
+                   (tuple(ids),))
         res = dict(cr.fetchall())
 
         if name == 'partner_id':
@@ -244,61 +231,6 @@
                 res.setdefault(id, (False, ""))
         return res
 
-#   def _currency(self, cursor, user, ids, name, args, context=None):
-#       if not ids:
-#           return {}
-#       res = {}
-#
-#       currency_obj = self.pool.get('res.currency')
-#       account_obj = self.pool.get('account.account')
-#       cursor.execute('''SELECT pl.id, ml.currency_id, ml.account_id
-#       FROM account_move_line ml
-#           INNER JOIN payment_line pl
-#               ON (ml.id = pl.move_line_id)
-#       WHERE pl.id in (''' + ','.join([str(x) for x in ids]) + ')')
-#
-#       res2 = {}
-#       account_ids = []
-#       for payment_line_id, currency_id, account_id in cursor.fetchall():
-#           res2[payment_line_id] = [currency_id, account_id]
-#           account_ids.append(account_id)
-#
-#       account2currency_id = {}
-#       for account in account_obj.browse(cursor, user, account_ids,
-#               context=context):
-#           account2currency_id[account.id] = account.company_currency_id.id
-#
-#       for payment_line_id in ids:
-#           if res2[payment_line_id][0]:
-#               res[payment_line_id] = res2[payment_line_id][0]
-#           else:
-#               res[payment_line_id] = \
-#                       account2currency_id[res2[payment_line_id][1]]
-#
-#       currency_names = {}
-#       for currency_id, name in currency_obj.name_get(cursor, user, res.values(),
-#               context=context):
-#           currency_names[currency_id] = name
-#       for payment_line_id in ids:
-#           res[payment_line_id] = (res[payment_line_id],
-#                   currency_names[res[payment_line_id]])
-#       return res
-#
-#   def _to_pay_currency(self, cursor, user, ids, name , args, context=None):
-#       if not ids:
-#           return {}
-#
-#       cursor.execute('''SELECT pl.id,
-#           CASE WHEN ml.amount_currency < 0
-#               THEN - ml.amount_currency
-#               ELSE ml.credit
-#           END
-#       FROM account_move_line ml
-#           INNER JOIN payment_line pl
-#               ON (ml.id = pl.move_line_id)
-#       WHERE pl.id in (''' + ','.join([str(x) for x in ids]) + ')')
-#       return dict(cursor.fetchall())
-
     def _amount(self, cursor, user, ids, name, args, context=None):
         if not ids:
             return {}
@@ -334,15 +266,6 @@
         else:
             return self.pool.get('res.currency').search(cr, uid, [('rate','=',1.0)])[0]
 
-#   def select_move_lines(*a):
-#       print a
-#       return []
-
-#   def create(self, cr, uid, vals, context):
-#       print "created!!!"
-#       vals['company_currency'] = self._get_currency(cr, uid, context)
-#       return super(payment_line, self).create(cr, uid, vals, context)
-
     def _get_ml_inv_ref(self, cr, uid, ids, *a):
         res={}
         for id in self.browse(cr, uid, ids):
@@ -377,11 +300,6 @@
         'move_line_id': fields.many2one('account.move.line','Entry line', domain=[('reconcile_id','=', False), ('account_id.type', '=','payable')],help='This Entry Line will be referred for the information of the ordering customer.'),
         'amount_currency': fields.float('Amount in Partner Currency', digits=(16,2),
             required=True, help='Payment amount in the partner currency'),
-#       'to_pay_currency': fields.function(_to_pay_currency, string='To Pay',
-#           method=True, type='float',
-#           help='Amount to pay in the partner currency'),
-#       'currency': fields.function(_currency, string='Currency',
-#           method=True, type='many2one', obj='res.currency'),
         'currency': fields.many2one('res.currency','Partner Currency',required=True),
         'company_currency': fields.many2one('res.currency','Company Currency',readonly=True),
         'bank_id': fields.many2one('res.partner.bank', 'Destination Bank account'),
@@ -391,21 +309,12 @@
         'amount': fields.function(_amount, string='Amount in Company Currency',
             method=True, type='float',
             help='Payment amount in the company currency'),
-#       'to_pay': fields.function(select_by_name, string="To Pay", method=True,
-#           type='float', help='Amount to pay in the company currency'),
-#       'due_date': fields.function(select_by_name, string="Due date",
-#           method=True, type='date'),
         'ml_date_created': fields.function(_get_ml_created_date, string="Effective Date",
             method=True, type='date',help="Invoice Effective Date"),
-#       'reference': fields.function(select_by_name, string="Ref", method=True,
-#           type='char'),
         'ml_maturity_date': fields.function(_get_ml_maturity_date, method=True, type='date', string='Maturity Date'),
         'ml_inv_ref': fields.function(_get_ml_inv_ref, method=True, type='many2one', relation='account.invoice', string='Invoice Ref.'),
         'info_owner': fields.function(info_owner, string="Owner Account", method=True, type="text",help='Address of the Main Partner'),
         'info_partner': fields.function(info_partner, string="Destination Account", method=True, type="text",help='Address of the Ordering Customer.'),
-#        'partner_payable': fields.function(partner_payable, string="Partner payable", method=True, type='float'),
-#       'value_date': fields.function(_value_date, string='Value Date',
-#           method=True, type='date'),
         'date': fields.date('Payment Date',help="If no payment date is specified, the bank will treat this payment line directly"),
         'create_date': fields.datetime('Created' ,readonly=True),
         'state': fields.selection([('normal','Free'), ('structured','Structured')], 'Communication Type', required=True)

=== modified file 'account_voucher/account.py'
--- account_voucher/account.py	2010-01-20 17:19:31 +0000
+++ account_voucher/account.py	2010-03-17 11:50:49 +0000
@@ -67,9 +67,11 @@
     def compute_total(self, cr, uid, ids, yr_st_date, yr_end_date, st_date, end_date, field_names, context={}):
         if not (st_date >= yr_st_date and end_date <= yr_end_date):
             return {}
-        query = "l.date >= '%s' AND l.date <= '%s'" (st_date, end_date)
-        return self.__compute(cr, uid, ids, field_names, context=context, query=query)
-        
+        return self.__compute(
+            cr, uid, ids, field_names, context=context,
+            query="l.date >= '%s' AND l.date <= '%s'",
+            query_params=(st_date, end_date))
+
     def create(self, cr, uid, vals, context={}):
         name=self.search(cr,uid,[('name','ilike',vals['name']),('company_id','=',vals['name'])])
         if name:

=== modified file 'account_voucher/voucher.py'
--- account_voucher/voucher.py	2010-03-08 07:19:28 +0000
+++ account_voucher/voucher.py	2010-03-17 11:50:49 +0000
@@ -407,7 +407,8 @@
     def action_number(self, cr, uid, ids, *args):
         cr.execute('SELECT id, type, number, move_id, reference ' \
                 'FROM account_voucher ' \
-                'WHERE id IN ('+','.join(map(str,ids))+')')
+                'WHERE id IN %s',
+                   (tuple(ids),))
         for (id, invtype, number, move_id, reference) in cr.fetchall():
             if not number:
                 number = self.pool.get('ir.sequence').get(cr, uid, invtype)

=== modified file 'auction/auction.py'
--- auction/auction.py	2009-08-24 11:51:52 +0000
+++ auction/auction.py	2010-03-17 11:50:49 +0000
@@ -95,12 +95,19 @@
         RETURN: True
         """
         # objects vendus mais non factures
-        cr.execute('select count(*) as c from auction_lots where auction_id in ('+','.join(map(str,ids))+') and state=%s and obj_price>0', ('draft',))
+        cr.execute('SELECT COUNT(*) AS c '
+                   'FROM auction_lots '
+                   'WHERE auction_id IN %s '
+                   'AND state=%s AND obj_price>0', (tuple(ids), 'draft'))
         nbr = cr.fetchone()[0]
         ach_uids = {}
-        cr.execute('select id from auction_lots where auction_id in ('+','.join(map(str,ids))+') and state=%s and obj_price>0', ('draft',))
+        cr.execute('SELECT id FROM auction_lots '
+                   'WHERE auction_id IN %s '
+                   'AND state=%s AND obj_price>0', (tuple(ids), 'draft'))
         r=self.pool.get('auction.lots').lots_invoice(cr, uid, [x[0] for x in cr.fetchall()],{},None)
-        cr.execute('select id from auction_lots where auction_id in ('+','.join(map(str,ids))+') and obj_price>0')
+        cr.execute('SELECT id FROM auction_lots '
+                   'WHERE auction_id IN %s '
+                   'AND obj_price>0', (tuple(ids),))
         ids2 = [x[0] for x in cr.fetchall()]
     #   for auction in auction_ids:
         c=self.pool.get('auction.lots').seller_trans_create(cr, uid, ids2,{})
@@ -113,7 +120,9 @@
 # Deposits
 #----------------------------------------------------------
 def _inv_uniq(cr, ids):
-    cr.execute('select name from auction_deposit where id in ('+','.join(map(lambda x: str(x), ids))+')')
+    cr.execute('SELECT name FROM auction_deposit '
+               'WHERE id IN %s',
+               (tuple(ids),))
     for datas in cr.fetchall():
         cr.execute('select count(*) from auction_deposit where name=%s', (datas[0],))
         if cr.fetchone()[0]>1:
@@ -229,7 +238,9 @@
 # Lots
 #----------------------------------------------------------
 def _inv_constraint(cr, ids):
-    cr.execute('select id, bord_vnd_id, lot_num from auction_lots where id in ('+','.join(map(lambda x: str(x), ids))+')')
+    cr.execute('SELECT id, bord_vnd_id, lot_num FROM auction_lots '
+               'WHERE id IN %s',
+               (tuple(ids),))
     for datas in cr.fetchall():
         cr.execute('select count(*) from auction_lots where bord_vnd_id=%s and lot_num=%s', (datas[1],datas[2]))
         if cr.fetchone()[0]>1:

=== modified file 'auction/report/auction_objects.py'
--- auction/report/auction_objects.py	2009-10-09 11:49:00 +0000
+++ auction/report/auction_objects.py	2010-03-17 11:50:49 +0000
@@ -29,20 +29,7 @@
         super(auction_objects, self).__init__(cr, uid, name, context=context)
         self.localcontext.update({
             'time': time,
-            #'lines': self.lines
-            #'get_data' : self.get_data
         })
-
-#   def lines(self, auction_id):
-#
-#        cr.execute('select ad.name from auction_dates ad, a1uction_lots al where ad.id=al.%d group by ad.name',(auction_id))
-#        return self.cr.fetchone()[0]
-#   def get_data(self, auction_id):
-#       res = self.pool.get('auction.bid.lines').read(self.cr,self.uid,[lot_id])
-#       return True
-
-
-
 report_sxw.report_sxw('report.auction.objects', 'auction.lots', 'addons/auction/report/auction_objects.rml', parser=auction_objects)
 
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== modified file 'auction/report/auction_total_rml.py'
--- auction/report/auction_total_rml.py	2009-10-09 11:49:00 +0000
+++ auction/report/auction_total_rml.py	2010-03-17 11:50:49 +0000
@@ -55,7 +55,10 @@
         for lot_id  in objects:
             auc_lot_ids.append(lot_id.id)
         self.total_obj=auc_lot_ids
-        self.cr.execute('select auction_id from auction_lots where id in ('+','.join(map(str,auc_lot_ids))+') group by auction_id')
+        self.cr.execute('SELECT auction_id FROM auction_lots '
+                        'WHERE id IN %s '
+                        'GROUP BY auction_id',
+                        (tuple(auc_lot_ids),))
         auc_date_ids = self.cr.fetchall()
         auct_dat=[]
         for ad_id in auc_date_ids:

=== modified file 'auction/report/buyer_list.py'
--- auction/report/buyer_list.py	2009-10-09 11:49:00 +0000
+++ auction/report/buyer_list.py	2010-03-17 11:50:49 +0000
@@ -51,7 +51,8 @@
         for lot_id  in objects:
             auc_lot_ids.append(lot_id.id)
         self.auc_lot_ids=auc_lot_ids
-        self.cr.execute('select auction_id from auction_lots where id in ('+','.join(map(str,auc_lot_ids))+') group by auction_id')
+        self.cr.execute('SELECT auction_id FROM auction_lots WHERE id IN %s GROUP BY auction_id',
+                        (tuple(auc_lot_ids),))
         auc_date_ids = self.cr.fetchall()
         auct_dat=[]
         for ad_id in auc_date_ids:
@@ -71,13 +72,16 @@
 
         auc_date_ids = self.pool.get('auction.dates').search(self.cr,self.uid,([('name','like',obj['name'])]))
 
-#       self.cr.execute('select ach_uid,count(1) as no_lot, sum(obj_price) as adj_price, sum(buyer_price)-sum(obj_price) as buyer_cost ,sum(buyer_price) as to_pay from auction_lots where id in ('+','.join(map(str,self.auc_lot_ids))+') and  auction_id=%s  and ach_uid is not null group by ach_uid ', (auc_date_ids[0],))
-        self.cr.execute('select ach_login as ach_uid,count(1) as no_lot, sum(obj_price) as adj_price, sum(buyer_price)-sum(obj_price) as buyer_cost ,sum(buyer_price) as to_pay from auction_lots where  id in ('+','.join(map(str,self.auc_lot_ids))+') and  auction_id=%s and ach_login is not null  group by ach_login order by ach_login', (auc_date_ids[0],))
+        self.cr.execute('SELECT ach_login AS ach_uid, COUNT(1) AS no_lot, '\
+                        'SUM(obj_price) AS adj_price, '\
+                        'SUM(buyer_price)-SUM(obj_price) AS buyer_cost, '\
+                        'SUM(buyer_price) AS to_pay '\
+                        'FROM auction_lots WHERE id IN %s '\
+                        'AND auction_id=%s AND ach_login IS NOT NULL '\
+                        'GROUP BY ach_login ORDER BY ach_login',
+                        (tuple(self.auc_lot_ids), auc_date_ids[0],))
         res = self.cr.dictfetchall()
         for r in res:
-#           if r['ach_uid']:
-#               tnm=self.pool.get('res.partner').read(self.cr,self.uid,[r['ach_uid']],['name'])#
-#               r.__setitem__('ach_uid',tnm[0]['name'])
                 self.sum_adj_price_val = self.sum_adj_price_val + r['adj_price']
                 self.sum_buyer_obj_price_val = self.sum_buyer_obj_price_val + r['buyer_cost']
                 self.sum_buyer_price_val = self.sum_buyer_price_val + r['to_pay']

=== modified file 'base_module_quality/speed_test/speed_test.py'
--- base_module_quality/speed_test/speed_test.py	2010-02-18 15:23:03 +0000
+++ base_module_quality/speed_test/speed_test.py	2010-03-17 11:50:49 +0000
@@ -62,7 +62,9 @@
 
         # remove osv_memory class becaz it does not have demo data
         if obj_list:
-            cr.execute("select w.res_model from ir_actions_todo as t left join ir_act_window as w on t.action_id=w.id where w.res_model in ('%s')"% ("','".join(obj_list)))
+            cr.execute("SELECT w.res_model FROM ir_actions_todo AS t "\
+                       "LEFT JOIN ir_act_window AS w ON t.action_id=w.id "\
+                       "WHERE w.res_model IN %s", (tuple(obj_list),))
             res = cr.fetchall()
             for remove_obj in res:
                 if remove_obj and (remove_obj[0] in obj_list):

=== modified file 'crm/crm.py'
--- crm/crm.py	2009-08-10 06:20:35 +0000
+++ crm/crm.py	2010-03-17 11:50:49 +0000
@@ -75,7 +75,9 @@
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from crm_case_section where id in ('+','.join(map(str,ids))+')')
+            cr.execute('SELECT DISTINCT parent_id FROM crm_case_section '\
+                       'WHERE id IN %s',
+                       (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False

=== modified file 'crm/report/report_businessopp.py'
--- crm/report/report_businessopp.py	2010-02-17 10:53:29 +0000
+++ crm/report/report_businessopp.py	2010-03-17 11:50:49 +0000
@@ -56,7 +56,13 @@
         minbenef = 999999999999999999999
         maxbenef = 0
 
-        cr.execute('select probability, planned_revenue, planned_cost, user_id, res_users.name as name from crm_case left join res_users on (crm_case.user_id=res_users.id) where crm_case.id in ('+','.join(map(str,ids))+') order by user_id')
+        cr.execute('SELECT probability, planned_revenue, planned_cost, '\
+                   'user_id, res_users.name AS name '\
+                   'FROM crm_case '\
+                   'LEFT JOIN res_users ON (crm_case.user_id=res_users.id) '\
+                   'WHERE crm_case.id IN %s '\
+                   'ORDER BY user_id',
+                   (tuple(ids),))
         res = cr.dictfetchall()
 
         for row in res:

=== modified file 'crm_profiling/crm_profiling.py'
--- crm_profiling/crm_profiling.py	2009-01-27 11:15:46 +0000
+++ crm_profiling/crm_profiling.py	2010-03-17 11:50:49 +0000
@@ -28,17 +28,17 @@
     query = """
     select distinct(answer)
     from profile_question_yes_rel
-    where profile in (%s)"""% ','.join([str(i) for i in ids ])
+    where profile in %s"""
 
-    cr.execute(query)
+    cr.execute(query, (tuple(ids),))
     ans_yes = [x[0] for x in cr.fetchall()]
 
     query = """
     select distinct(answer)
     from profile_question_no_rel
-    where profile in (%s)"""% ','.join([str(i) for i in ids ])
+    where profile in %s"""
 
-    cr.execute(query)
+    cr.execute(query, (tuple(ids),))
     ans_no = [x[0] for x in cr.fetchall()]
 
     return [ans_yes, ans_no]
@@ -50,7 +50,8 @@
      select distinct(parent_id)
      from crm_segmentation
      where parent_id is not null
-     and id in (%s)""" % ','.join([str(i) for i in ids ]))
+     and id in %s""",
+               (tuple(ids),))
 
     parent_ids = [x[0] for x in cr.fetchall()]
 
@@ -86,30 +87,31 @@
 
 
 def _recompute_categ(self, cr, uid, pid, answers_ids):
-    ok =  []
     cr.execute('''
-        select r.category_id 
+        select r.category_id
         from res_partner_category_rel r left join crm_segmentation s on (r.category_id = s.categ_id) 
         where r.partner_id = %s and (s.exclusif = false or s.exclusif is null)
         ''', (pid,))
-    for x in cr.fetchall():
-        ok.append(x[0])
+    categories = [x[0] for x in cr.fetchall()]
 
     query = '''
-        select id, categ_id 
-        from crm_segmentation 
-        where profiling_active = true''' 
-    if ok != []:
-        query = query +''' and categ_id not in(%s)'''% ','.join([str(i) for i in ok ])
-    query = query + ''' order by id '''
+        select id, categ_id
+        from crm_segmentation
+        where profiling_active = true'''
+    if not categories:
+        query_params = ()
+    else:
+        query += ' and categ_id not in %s'
+        query_params = (tuple(categories),)
+    query += ' order by id '
 
-    cr.execute(query)
+    cr.execute(query, query_params)
     segm_cat_ids = cr.fetchall()
 
     for (segm_id, cat_id) in segm_cat_ids:
         if test_prof(cr, uid, segm_id, pid, answers_ids):
-            ok.append(cat_id)
-    return ok
+            categories.append(cat_id)
+    return categories
 
 
 class question(osv.osv):

=== modified file 'document/document.py'
--- document/document.py	2010-01-08 11:38:58 +0000
+++ document/document.py	2010-03-17 11:50:49 +0000
@@ -302,7 +302,8 @@
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from document_directory where id in ('+','.join(map(str,ids))+')')
+            cr.execute('SELECT DISTINCT parent_id FROM document_directory '\
+                       'WHERE id in %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
@@ -524,7 +525,8 @@
 
     def _data_get(self, cr, uid, ids, name, arg, context):
         result = {}
-        cr.execute('select id,store_fname,link from ir_attachment where id in ('+','.join(map(str,ids))+')')
+        cr.execute('SELECT id, store_fname, link FROM ir_attachment '\
+                   'WHERE id IN %s', (tuple(ids),))
         for id,r,l in cr.fetchall():
             try:
                 value = file(os.path.join(self._get_filestore(cr), r), 'rb').read()

=== modified file 'event/event.py'
--- event/event.py	2009-04-09 10:02:19 +0000
+++ event/event.py	2010-03-17 11:50:49 +0000
@@ -77,8 +77,8 @@
     def _get_register(self, cr, uid, ids, name, args, context=None):
         res={}
         for event in self.browse(cr, uid, ids, context):
-            query = """select sum(nb_register) from crm_case c left join crm_case_section s on (c.section_id=s.id) right join event_event e on (e.section_id=s.id) right join event_registration r on (r.case_id=c.id) where e.section_id = %s and c.state in ('open','done')""" % event.section_id.id
-            cr.execute(query)
+            query = """select sum(nb_register) from crm_case c left join crm_case_section s on (c.section_id=s.id) right join event_event e on (e.section_id=s.id) right join event_registration r on (r.case_id=c.id) where e.section_id = %s and c.state in ('open','done')"""
+            cr.execute(query,(event.section_id.id,))
             res2 = cr.fetchone()
             if res2 and res2[0]:
                 res[event.id] = res2[0]
@@ -89,8 +89,8 @@
     def _get_prospect(self, cr, uid, ids, name, args, context=None):
         res={}
         for event in self.browse(cr, uid, ids, context):
-            query = """select sum(nb_register) from crm_case c left join crm_case_section s on (c.section_id=s.id) right join event_event e on (e.section_id=s.id) right join event_registration r on (r.case_id=c.id) where e.section_id = %s and c.state = 'draft'""" % event.section_id.id
-            cr.execute(query)
+            query = """select sum(nb_register) from crm_case c left join crm_case_section s on (c.section_id=s.id) right join event_event e on (e.section_id=s.id) right join event_registration r on (r.case_id=c.id) where e.section_id = %s and c.state = 'draft'"""
+            cr.execute(query, (event.section_id.id,))
             res2 = cr.fetchone()
             if res2 and res2[0]:
                 res[event.id] = res2[0]

=== modified file 'event_project/event.py'
--- event_project/event.py	2009-01-04 22:12:50 +0000
+++ event_project/event.py	2010-03-17 11:50:49 +0000
@@ -37,8 +37,8 @@
         for id in ids:
             res[id] = []
         for id in ids:
-            query = "select project_id from event_event where id = %i" %id
-            cr.execute(query)
+            query = "select project_id from event_event where id = %s"
+            cr.execute(query, (id,))
             project_ids = [ x[0] for x in cr.fetchall()]
             ids2 = obj.pool.get(self._obj).search(cr, user, [(self._fields_id,'in',project_ids),('state','<>','done')], limit=self._limit)
             for r in obj.pool.get(self._obj)._read_flat(cr, user, ids2, [self._fields_id], context=context, load='_classic_write'):

=== modified file 'hr/hr.py'
--- hr/hr.py	2009-06-04 06:58:39 +0000
+++ hr/hr.py	2010-03-17 11:50:49 +0000
@@ -102,7 +102,8 @@
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from hr_employee_category where id in ('+','.join(map(str,ids))+')')
+            cr.execute('SELECT DISTINCT parent_id FROM hr_employee_category '\
+                       'WHERE id IN %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
@@ -151,7 +152,8 @@
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from hr_employee where id in ('+','.join(map(str,ids))+')')
+            cr.execute('SELECT DISTINCT parent_id FROM hr_employee '\
+                       'WHERE id IN %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False

=== modified file 'hr/hr_department.py'
--- hr/hr_department.py	2010-01-08 11:38:58 +0000
+++ hr/hr_department.py	2010-03-17 11:50:49 +0000
@@ -44,7 +44,8 @@
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from hr_department where id in ('+','.join(map(str,ids))+')')
+            cr.execute('SELECT DISTINCT parent_id FROM hr_department '\
+                       'WHERE id IN %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
@@ -128,4 +129,4 @@
 
 res_users()
 
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
\ No newline at end of file
+# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== modified file 'hr_attendance/hr_attendance.py'
--- hr_attendance/hr_attendance.py	2009-01-04 22:12:50 +0000
+++ hr_attendance/hr_attendance.py	2010-03-17 11:50:49 +0000
@@ -68,8 +68,8 @@
             and name <= (select name from hr_attendance where id=%s)
             order by name desc
             limit 2
-            ''' % (id, id)
-            cr.execute(sql)
+            '''
+            cr.execute(sql, (id, id))
             atts = cr.fetchall()
             if not ((len(atts)==1 and atts[0][0] == 'sign_in') or (atts[0][0] != atts[1][0] and atts[0][1] != atts[1][1])):
                 return False
@@ -98,7 +98,7 @@
                     ON (hr_attendance.employee_id = foo.employee_id \
                         AND hr_attendance.name = foo.name) \
                 WHERE hr_attendance.employee_id \
-                    in (' + ','.join([str(x) for x in ids]) + ')')
+                    in %s', (tuple(ids),))
         for res in cr.fetchall():
             result[res[1]] = res[0] == 'sign_in' and 'present' or 'absent'
         return result

=== modified file 'hr_attendance/wizard/print_attendance_error.py'
--- hr_attendance/wizard/print_attendance_error.py	2010-01-21 11:52:07 +0000
+++ hr_attendance/wizard/print_attendance_error.py	2010-03-17 11:50:49 +0000
@@ -43,9 +43,12 @@
 def _check_data(self, cr, uid, data, *args):
     date_from = data['form']['init_date']
     date_to = data['form']['end_date']
-    emp_ids = (','.join([str(x) for x in data['ids']]))
-                  
-    cr.execute("select id from hr_attendance where employee_id in (%s) and to_char(name,'YYYY-mm-dd')<='%s' and to_char(name,'YYYY-mm-dd')>='%s' and action in ('%s','%s') order by name" %(emp_ids, date_to, date_from, 'sign_in', 'sign_out'))
+    cr.execute("SELECT id FROM hr_attendance "\
+               "WHERE employee_id IN %s "\
+               "AND to_char(name,'YYYY-mm-dd')<=%s "\
+               "and to_char(name,'YYYY-mm-dd')>=%s "\
+               "and action in (%s, %s) order by name",
+               (tuple(data['ids']), date_to, date_from, 'sign_in', 'sign_out'))
     attendance_ids = [x[0] for x in cr.fetchall()]
     if not attendance_ids:
         raise wizard.except_wizard(_('No Data Available'), _('No records found for your selection!'))    

=== modified file 'hr_expense/hr_expense.py'
--- hr_expense/hr_expense.py	2009-10-13 14:50:16 +0000
+++ hr_expense/hr_expense.py	2010-03-17 11:50:49 +0000
@@ -39,10 +39,13 @@
         return super(hr_expense_expense, self).copy(cr, uid, id, default, context)
 
     def _amount(self, cr, uid, ids, field_name, arg, context):
-        id_set = ",".join(map(str, ids))
-        cr.execute("SELECT s.id,COALESCE(SUM(l.unit_amount*l.unit_quantity),0) AS amount FROM hr_expense_expense s LEFT OUTER JOIN hr_expense_line l ON (s.id=l.expense_id) WHERE s.id IN ("+id_set+") GROUP BY s.id ")
-        res = dict(cr.fetchall())
-        return res
+        cr.execute("SELECT s.id, "\
+                   "COALESCE(SUM(l.unit_amount*l.unit_quantity),0) AS amount "\
+                   "FROM hr_expense_expense s "\
+                   "LEFT OUTER JOIN hr_expense_line l ON (s.id=l.expense_id) "\
+                   "WHERE s.id IN %s GROUP BY s.id ",
+                   (tuple(ids),))
+        return dict(cr.fetchall())
 
     def _get_currency(self, cr, uid, context):
         user = self.pool.get('res.users').browse(cr, uid, [uid])[0]
@@ -188,10 +191,11 @@
     def _amount(self, cr, uid, ids, field_name, arg, context):
         if not len(ids):
             return {}
-        id_set = ",".join(map(str, ids))
-        cr.execute("SELECT l.id,COALESCE(SUM(l.unit_amount*l.unit_quantity),0) AS amount FROM hr_expense_line l WHERE id IN ("+id_set+") GROUP BY l.id ")
-        res = dict(cr.fetchall())
-        return res
+        cr.execute("SELECT l.id, "\
+                   "COALESCE(SUM(l.unit_amount*l.unit_quantity),0) AS amount "\
+                   "FROM hr_expense_line l WHERE id IN %s "\
+                   "GROUP BY l.id", (tuple(ids),))
+        return dict(cr.fetchall())
 
     _columns = {
         'name': fields.char('Short Description', size=128, required=True),

=== modified file 'hr_holidays/hr.py'
--- hr_holidays/hr.py	2010-01-05 08:07:22 +0000
+++ hr_holidays/hr.py	2010-03-17 11:50:49 +0000
@@ -146,7 +146,7 @@
                         
     def _check_date(self, cr, uid, ids):
         if ids:
-            cr.execute('select number_of_days from hr_holidays where id in ('+','.join(map(str, ids))+')')
+            cr.execute('select number_of_days from hr_holidays where id in %s', (tuple(ids),))
             res =  cr.fetchall()
             if res and res[0][0] < 0:
                 return False

=== modified file 'hr_timesheet_invoice/wizard/hr_timesheet_invoice_create.py'
--- hr_timesheet_invoice/wizard/hr_timesheet_invoice_create.py	2009-12-10 09:40:49 +0000
+++ hr_timesheet_invoice/wizard/hr_timesheet_invoice_create.py	2010-03-17 11:50:49 +0000
@@ -43,7 +43,7 @@
             if obj_acc.invoice_id and obj_acc.invoice_id.state !='cancel':
                 raise wizard.except_wizard(_('Warning'),_('The analytic entry "%s" is already invoiced!')%(obj_acc.name,))
         
-        cr.execute("SELECT distinct(account_id) from account_analytic_line where id IN (%s)"% (','.join(map(str,data['ids'])),))
+        cr.execute("SELECT distinct(account_id) from account_analytic_line where id IN %s", (tuple(data['ids']),))
         account_ids = cr.fetchall()
         return {'accounts': [x[0] for x in account_ids]}
 
@@ -96,9 +96,10 @@
             cr.execute("SELECT product_id, to_invoice, sum(unit_amount) " \
                     "FROM account_analytic_line as line " \
                     "WHERE account_id = %s " \
-                        "AND id IN (" + ','.join([str(x) for x in data['ids']]) + ") " \
+                        "AND id IN %s " \
                         "AND to_invoice IS NOT NULL " \
-                    "GROUP BY product_id,to_invoice", (account.id,))
+                    "GROUP BY product_id,to_invoice",
+                       (account.id, tuple(data['ids'])))
 
             for product_id,factor_id,qty in cr.fetchall():
                 product = pool.get('product.product').browse(cr, uid, product_id, context2)
@@ -144,11 +145,11 @@
                 #
                 cr.execute("SELECT * "  # TODO optimize this
                            "  FROM account_analytic_line"
-                           " WHERE account_id=%%s"
-                           "   AND id IN (%s)"
-                           "   AND product_id=%%s"
-                           "   AND to_invoice=%%s" % ','.join(['%s']*len(data['ids'])),
-                           tuple([account.id]+ data['ids']+[ product_id, factor_id]))
+                           " WHERE account_id=%s"
+                           "   AND id IN %s"
+                           "   AND product_id=%s"
+                           "   AND to_invoice=%s",
+                           (account.id, tuple(data['ids']), product_id, factor_id))
                 line_ids = cr.dictfetchall()
                 note = []
                 for line in line_ids:
@@ -169,8 +170,9 @@
 
                 curr_line['note'] = "\n".join(map(lambda x: x or '',note))
                 pool.get('account.invoice.line').create(cr, uid, curr_line)
-                strids = ','.join(map(str, data['ids']))
-                cr.execute("update account_analytic_line set invoice_id=%%s WHERE account_id = %%s and id IN (%s)" % strids, (last_invoice,account.id,))
+                cr.execute("UPDATE account_analytic_line SET invoice_id=%s "\
+                           "WHERE account_id = %s AND id IN %s",
+                           (last_invoice,account.id, tuple(data['ids'])))
                 
         pool.get('account.invoice').button_reset_taxes(cr, uid, [last_invoice], context)
         

=== modified file 'hr_timesheet_sheet/hr_timesheet_sheet.py'
--- hr_timesheet_sheet/hr_timesheet_sheet.py	2010-03-11 15:43:08 +0000
+++ hr_timesheet_sheet/hr_timesheet_sheet.py	2010-03-17 11:50:49 +0000
@@ -104,7 +104,7 @@
                 LEFT JOIN hr_timesheet_sheet_sheet_day AS day \
                     ON (sheet.id = day.sheet_id \
                         AND day.name = sheet.date_current) \
-                WHERE sheet.id in (' + ','.join([str(x) for x in ids]) + ')')
+                WHERE sheet.id in %s', (tuple(ids),))
         return dict(cr.fetchall())
 
     def _total(self, cr, uid, ids, name, args, context):
@@ -112,8 +112,8 @@
                 FROM hr_timesheet_sheet_sheet s \
                     LEFT JOIN hr_timesheet_sheet_sheet_day d \
                         ON (s.id = d.sheet_id) \
-                WHERE s.id in ('+ ','.join(map(str, ids)) + ') \
-                GROUP BY s.id')
+                WHERE s.id in %s \
+                GROUP BY s.id', (tuple(ids),))
         return dict(cr.fetchall())
 
     def _state_attendance(self, cr, uid, ids, name, args, context):
@@ -330,8 +330,8 @@
                         ON (s.date_to >= al.date \
                             AND s.date_from <= al.date \
                             AND s.user_id = al.user_id) \
-                WHERE l.id in (' + ','.join([str(x) for x in ids]) + ') \
-                GROUP BY l.id')
+                WHERE l.id in %s \
+                GROUP BY l.id', (tuple(ids),))
         res = dict(cursor.fetchall())
         sheet_names = {}
         for sheet_id, name in sheet_obj.name_get(cursor, user, res.values(),
@@ -448,8 +448,8 @@
                         ON (s.date_to >= to_date(to_char(a.name, 'YYYY-MM-dd'),'YYYY-MM-dd') \
                             AND s.date_from <= to_date(to_char(a.name, 'YYYY-MM-dd'),'YYYY-MM-dd') \
                             AND s.user_id = e.user_id) \
-                WHERE a.id in (" + ",".join([str(x) for x in ids]) + ") \
-                GROUP BY a.id")
+                WHERE a.id in %s \
+                GROUP BY a.id", (tuple(ids),))
         res = dict(cursor.fetchall())
         sheet_names = {}
         for sheet_id, name in sheet_obj.name_get(cursor, user, res.values(),

=== modified file 'idea/idea.py'
--- idea/idea.py	2009-01-04 22:12:50 +0000
+++ idea/idea.py	2010-03-17 11:50:49 +0000
@@ -48,40 +48,40 @@
         if not len(ids):
             return {}
 
-        sql = """select i.id, avg(v.score::integer) 
+        sql = """select i.id, avg(v.score::integer)
                    from idea_idea i left outer join idea_vote v on i.id = v.idea_id
-                    where i.id in (%s)
+                    where i.id in %s
                     group by i.id
-                """ % ','.join(['%d']*len(ids))
+                """
 
-        cr.execute(sql, ids)
+        cr.execute(sql, (tuple(ids),))
         return dict(cr.fetchall())
 
     def _vote_count(self,cr,uid,ids,name,arg,context=None):
         if not len(ids):
             return {}
 
-        sql = """select i.id, count(1) 
+        sql = """select i.id, count(1)
                    from idea_idea i left outer join idea_vote v on i.id = v.idea_id
-                    where i.id in (%s)
+                    where i.id in %s
                     group by i.id
-                """ % ','.join(['%d']*len(ids))
+                """
 
-        cr.execute(sql, ids)
+        cr.execute(sql, (tuple(ids),))
         return dict(cr.fetchall())
 
     def _comment_count(self,cr,uid,ids,name,arg,context=None):
         if not len(ids):
             return {}
 
-        sql = """select i.id, count(1) 
+        sql = """select i.id, count(1)
                    from idea_idea i left outer join idea_comment c on i.id = c.idea_id
-                    where i.id in (%s)
+                    where i.id in %s
                     group by i.id
-                """ % ','.join(['%d']*len(ids))
-
-
-        cr.execute(sql,ids)
+                """
+
+
+        cr.execute(sql, (tuple(ids),))
         return dict(cr.fetchall())
 
     def _vote_read(self, cr, uid, ids, name, arg, context = None):

=== modified file 'l10n_be/wizard/wizard_vat_intra.py'
--- l10n_be/wizard/wizard_vat_intra.py	2009-03-24 11:01:43 +0000
+++ l10n_be/wizard/wizard_vat_intra.py	2010-03-17 11:50:49 +0000
@@ -169,11 +169,9 @@
                 start_date = fiscal_periods[3].date_start
                 end_date = fiscal_periods[3].date_stop
 
-        period = "to_date('" + str(start_date) + "','yyyy-mm-dd') and to_date('" + str(end_date) +"','yyyy-mm-dd')"
         record = {}
 
         for p_id in p_id_list:
-            list_partner = []
             partner = pool.get('res.partner').browse(cr, uid, p_id)
             go_ahead = False
             country_code = ''
@@ -185,27 +183,22 @@
             if not go_ahead:
                 continue
 
-            cr.execute('select sum(debit)-sum(credit) as amount from account_move_line l left join account_account a on (l.account_id=a.id) where a.type in ('"'receivable'"') and l.partner_id=%%s and l.date between %s' % (period,), (p_id,))
+            cr.execute('SELECT SUM(debit)-SUM(credit) AS amount '\
+                       'FROM account_move_line l '\
+                       'LEFT JOIN account_account a ON (l.account_id=a.id) '\
+                       'WHERE a.type IN ('"'receivable'"') '\
+                       'AND l.partner_id=%s '\
+                       'AND l.date BETWEEN to_date(%s, \'yyyy-mm-dd\') '\
+                       '               AND to_date(%s, \'yyyy-mm-dd\')',
+                       (p_id, start_date, end_date))
             res = cr.dictfetchall()
-            list_partner.append(res[0]['amount'])
-            list_partner.append('T') #partner.ref ...should be check
-            list_partner.append(partner.vat)
-            list_partner.append(country_code)
-            #...deprecated...
-#            addr = pool.get('res.partner').address_get(cr, uid, [partner.id], ['invoice'])
-#            if addr.get('invoice',False):
-#                ads = pool.get('res.partner.address').browse(cr,uid,[addr['invoice']])[0]
-#
-#                if ads.country_id:
-#                    code_country = ads.country_id.code
-#                    list_partner.append(code_country)
-#                else:
-#                    error_message.append('Data Insufficient! : '+ 'The Partner "'+partner.name + '"'' has no country associated with its Invoice address!')
-#            if len(list_partner)<4:
-#                list_partner.append('')
-#                error_message.append('Data Insufficient! : '+ 'The Partner "'+partner.name + '"'' has no Invoice address!')
-#            list_partner.append(code_country or 'not avail')
-            record[p_id] = list_partner
+
+            record[p_id] = (
+                res[0]['amount'],
+                'T', #partner.ref ...should be check
+                partner.vat,
+                country_code
+            )
 
         if len(error_message):
             data['form']['msg'] = 'Exception : \n' +'-'*50+'\n'+ '\n'.join(error_message)
@@ -235,4 +228,4 @@
             'result': {'type':'form', 'arch':msg_form, 'fields':msg_fields, 'state':[('end','Ok')]},
                 }
              }
-parter_vat_intra('vat.intra.xml')
\ No newline at end of file
+parter_vat_intra('vat.intra.xml')

=== modified file 'membership/membership.py'
--- membership/membership.py	2010-02-26 13:36:01 +0000
+++ membership/membership.py	2010-03-17 11:50:49 +0000
@@ -148,8 +148,8 @@
             )
         JOIN account_invoice ai ON (
             ai.id = ail.invoice_id)
-        WHERE ml.id in (%s)
-        ''' % ','.join([str(id) for id in ids]))
+        WHERE ml.id in %s
+        ''', (tuple(ids),))
 
         res = cr.fetchall()
         for r in res:
@@ -414,7 +414,7 @@
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct associate_member from res_partner where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select distinct associate_member from res_partner where id in %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False

=== modified file 'membership/wizard/invoice_membership.py'
--- membership/wizard/invoice_membership.py	2009-11-13 06:33:46 +0000
+++ membership/wizard/invoice_membership.py	2010-03-17 11:50:49 +0000
@@ -32,9 +32,8 @@
     cr.execute('''
             SELECT partner_id, id, type
             FROM res_partner_address
-            WHERE partner_id IN (%s)
-            ''' % ','.join([str(id) for id in partner_ids])
-            )
+            WHERE partner_id IN %s
+            ''', (tuple(partner_ids),))
     fetchal = cr.fetchall()
     if not fetchal:
         raise wizard.except_wizard(_('Error !'), _('No Address defined for this partner'))

=== modified file 'mrp/mrp.py'
--- mrp/mrp.py	2010-03-10 08:51:21 +0000
+++ mrp/mrp.py	2010-03-17 11:50:49 +0000
@@ -216,7 +216,7 @@
     def _check_recursion(self, cr, uid, ids):
         level = 500
         while len(ids):
-            cr.execute('select distinct bom_id from mrp_bom where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select distinct bom_id from mrp_bom where id in %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False

=== modified file 'mrp/report/workcenter_load.py'
--- mrp/report/workcenter_load.py	2009-09-28 14:26:44 +0000
+++ mrp/report/workcenter_load.py	2010-03-17 11:50:49 +0000
@@ -99,14 +99,13 @@
     def create(self, cr, uid, ids, datas, context={}):
         assert len(ids), 'You should provide some ids!'
         colors = choice_colors(len(ids))
-        ids_str = ','.join(map(str, ids))
         cr.execute(
             "SELECT MAX(mrp_production.date_planned) AS stop,MIN(mrp_production.date_planned) AS start "\
             "FROM mrp_workcenter, mrp_production, mrp_production_workcenter_line "\
             "WHERE mrp_production_workcenter_line.production_id=mrp_production.id "\
             "AND mrp_production_workcenter_line.workcenter_id=mrp_workcenter.id "\
             "AND mrp_production.state NOT IN ('cancel','done') "\
-            "AND mrp_workcenter.id IN (%s)" % ids_str)
+            "AND mrp_workcenter.id IN %s", (tuple(ids),))
         res = cr.dictfetchone()
         if not res['stop']:
             res['stop'] = time.strftime('%Y-%m-%d %H:%M:%S')
@@ -137,8 +136,8 @@
         # select workcenters
         cr.execute(
             "SELECT id, name FROM mrp_workcenter " \
-            "WHERE id in (%s) "\
-            "ORDER BY mrp_workcenter.id" % ids_str)
+            "WHERE id in %s "\
+            "ORDER BY mrp_workcenter.id", (tuple(ids),))
         workcenters = cr.dictfetchall()
 
         data = []

=== modified file 'point_of_sale/pos.py'
--- point_of_sale/pos.py	2010-02-03 05:47:12 +0000
+++ point_of_sale/pos.py	2010-03-17 11:50:49 +0000
@@ -60,7 +60,6 @@
         return {'value': {'pricelist_id': pricelist}}
 
     def _amount_total(self, cr, uid, ids, field_name, arg, context):
-        id_set = ",".join(map(str, ids))
         cr.execute("""
         SELECT
             p.id,
@@ -69,7 +68,7 @@
                 ) AS amount
         FROM pos_order p
             LEFT OUTER JOIN pos_order_line l ON (p.id=l.order_id)
-        WHERE p.id IN (""" + id_set +""") GROUP BY p.id """)
+        WHERE p.id IN %s GROUP BY p.id """, (tuple(ids),))
         res = dict(cr.fetchall())
 
         for rec in self.browse(cr, uid, ids, context):
@@ -113,8 +112,8 @@
         return res
 
     def payment_get(self, cr, uid, ids, context=None):
-        cr.execute("select id from pos_payment where order_id in (%s)" % \
-                    ','.join([str(i) for i in ids]))
+        cr.execute("select id from pos_payment where order_id in %s",
+                    (tuple(ids),))
         return [i[0] for i in cr.fetchall()]
 
     def _sale_journal_get(self, cr, uid, context):

=== modified file 'product/pricelist.py'
--- product/pricelist.py	2010-02-04 07:12:40 +0000
+++ product/pricelist.py	2010-03-17 11:50:49 +0000
@@ -22,7 +22,6 @@
 
 from osv import fields, osv
 
-#from tools.misc import currency
 from _common import rounding
 import time
 from tools import config
@@ -91,8 +90,6 @@
             res.append((type['key'],type['name']))
 
         return res
-#        cr.execute('select key,name from product_pricelist_type order by name')
-#        return cr.fetchall()
     _name = "product.pricelist"
     _description = "Pricelist"
     _columns = {
@@ -179,9 +176,11 @@
                                     'you have defined cyclic categories ' \
                                     'of products!'))
             if categ_ids:
-                categ_where = '(categ_id IN (' + ','.join(categ_ids) + '))'
+                categ_where = '(categ_id IN %s)'
+                sqlargs = (tuple(categ_ids),)
             else:
                 categ_where = '(categ_id IS NULL)'
+                sqlargs = ()
 
             cr.execute(
                 'SELECT i.*, pl.currency_id '
@@ -194,7 +193,7 @@
                     'AND (min_quantity IS NULL OR min_quantity <= %s) '
                     'AND i.price_version_id = v.id AND v.pricelist_id = pl.id '
                 'ORDER BY sequence LIMIT 1',
-                (tmpl_id, prod_id, plversion['id'], qty))
+                (tmpl_id, prod_id) + sqlargs + ( plversion['id'], qty))
             res = cr.dictfetchone()
             if res:
                 if res['base'] == -1:
@@ -218,10 +217,10 @@
                     if sinfo:
                         cr.execute('SELECT * ' \
                                 'FROM pricelist_partnerinfo ' \
-                                'WHERE suppinfo_id IN (' + \
-                                    ','.join(map(str, sinfo)) + ') ' \
+                                'WHERE suppinfo_id IN %s ' \
                                     'AND min_quantity <= %s ' \
-                                'ORDER BY min_quantity DESC LIMIT 1', (qty,))
+                                'ORDER BY min_quantity DESC LIMIT 1',
+                                   (tuple(sinfo), qty))
                         res2 = cr.dictfetchone()
                         if res2:
                             price = res2['price']
@@ -382,7 +381,4 @@
         return {}
 product_pricelist_item()
 
-
-
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== modified file 'product/product.py'
--- product/product.py	2010-03-15 11:10:51 +0000
+++ product/product.py	2010-03-17 11:50:49 +0000
@@ -206,7 +206,7 @@
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from product_category where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select distinct parent_id from product_category where id in %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False

=== modified file 'product_margin/product_margin.py'
--- product_margin/product_margin.py	2009-01-04 22:12:50 +0000
+++ product_margin/product_margin.py	2010-03-17 11:50:49 +0000
@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 ##############################################################################
 #
-#    OpenERP, Open Source Management Solution	
+#    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>). All Rights Reserved
 #    $Id$
 #
@@ -25,53 +25,52 @@
 from tools import config
 import time
 
+states = {
+    'paid': ('paid',),
+    'open_paid': ('open','paid'),
+    'draft_open_paid': ('draft','open','paid')
+}
+
 class product_product(osv.osv):
-    _inherit = "product.product"     
-    
-    
+    _inherit = "product.product"
+
+
     def _product_margin(self, cr, uid, ids, field_names, arg, context):
-        res = {}               
+        res = {}
         for val in self.browse(cr, uid, ids,context=context):
             res[val.id] = {}
-            date_from=context.get('date_from', time.strftime('%Y-01-01'))	
-            date_to=context.get('date_to', time.strftime('%Y-12-31'))	
-            invoice_state=context.get('invoice_state', 'open_paid')	
+            date_from=context.get('date_from', time.strftime('%Y-01-01'))
+            date_to=context.get('date_to', time.strftime('%Y-12-31'))
+            invoice_state=context.get('invoice_state', 'open_paid')
             if 'date_from' in field_names:
-            	res[val.id]['date_from']=date_from
+                res[val.id]['date_from']=date_from
             if 'date_to' in field_names:
                 res[val.id]['date_to']=date_to
             if 'invoice_state' in field_names:
-            	res[val.id]['invoice_state']=invoice_state
+                res[val.id]['invoice_state']=invoice_state
 
-            
-            invoice_types=[]
-            states=[]
-            if invoice_state=='paid':
-                states=['paid']
-            elif invoice_state=='open_paid':
-                states=['open','paid']
-            elif invoice_state=='draft_open_paid':
-                states=['draft','open','paid']
-            
+            invoice_types=()
             if 'sale_avg_price' in field_names or 'sale_num_invoiced' in field_names or 'turnover' in field_names or 'sale_expected' in field_names:
-                invoice_types=['out_invoice','in_refund']
+                invoice_types=('out_invoice','in_refund')
             if 'purchase_avg_price' in field_names or 'purchase_num_invoiced' in field_names or 'total_cost' in field_names or 'normal_cost' in field_names:
-                invoice_types=['in_invoice','out_refund']
-            if len(invoice_types):
+                invoice_types=('in_invoice','out_refund')
+
+            if invoice_types:
                 sql="""
-                select 
-                	avg(l.price_unit) as avg_unit_price,
-                	sum(l.quantity) as num_qty,
-                	sum(l.quantity * l.price_unit) as total,
-                	sum(l.quantity * product.list_price) as sale_expected,
-                	sum(l.quantity * product.standard_price) as normal_cost	
+                select
+                    avg(l.price_unit) as avg_unit_price,
+                    sum(l.quantity) as num_qty,
+                    sum(l.quantity * l.price_unit) as total,
+                    sum(l.quantity * product.list_price) as sale_expected,
+                    sum(l.quantity * product.standard_price) as normal_cost
                 from account_invoice_line l
                 left join account_invoice i on (l.invoice_id = i.id)
-                left join product_template product on (product.id=l.product_id)                
-                where l.product_id = %s and i.state in ('%s') and i.type in ('%s') and i.date_invoice>='%s' and i.date_invoice<='%s'           
-                """%(val.id,"','".join(states),"','".join(invoice_types),date_from,date_to)                
-                cr.execute(sql)
-                result=cr.fetchall()[0]                
+                left join product_template product on (product.id=l.product_id)
+                where l.product_id = %s and i.state in %s and i.type in %s and i.date_invoice>=%s and i.date_invoice<=%s
+                """
+                cr.execute(sql, (val.id, states[invoice_state],
+                                 invoice_types, date_from, date_to))
+                result=cr.fetchall()[0]
                 if 'sale_avg_price' in field_names or 'sale_num_invoiced' in field_names or 'turnover' in field_names or 'sale_expected' in field_names:
                     res[val.id]['sale_avg_price']=result[0] and result[0] or 0.0
                     res[val.id]['sale_num_invoiced']=result[1] and result[1] or 0.0
@@ -83,8 +82,8 @@
                     res[val.id]['purchase_num_invoiced']=result[1] and result[1] or 0.0
                     res[val.id]['total_cost']=result[2] and result[2] or 0.0
                     res[val.id]['normal_cost']=result[4] and result[4] or 0.0
-                    res[val.id]['purchase_gap']=res[val.id]['normal_cost']-res[val.id]['total_cost']                 
-            
+                    res[val.id]['purchase_gap']=res[val.id]['normal_cost']-res[val.id]['total_cost']
+
             if 'total_margin' in field_names:
                 res[val.id]['total_margin']=val.turnover-val.total_cost
             if 'expected_margin' in field_names:
@@ -92,15 +91,15 @@
             if 'total_margin_rate' in field_names:
                 res[val.id]['total_margin_rate']=val.turnover and val.total_margin * 100 / val.turnover or 0.0
             if 'expected_margin_rate' in field_names:
-                res[val.id]['expected_margin_rate']=val.sale_expected and val.expected_margin * 100 / val.sale_expected or 0.0 
+                res[val.id]['expected_margin_rate']=val.sale_expected and val.expected_margin * 100 / val.sale_expected or 0.0
         return res
-    
+
     _columns = {
         'date_from': fields.function(_product_margin, method=True, type='date', string='From Date', multi=True),
         'date_to': fields.function(_product_margin, method=True, type='date', string='To Date', multi=True),
         'invoice_state': fields.function(_product_margin, method=True, type='selection', selection=[
-			('paid','Paid'),('open_paid','Open and Paid'),('draft_open_paid','Draft, Open and Paid')
-			], string='Invoice State',multi=True, readonly=True),        
+            ('paid','Paid'),('open_paid','Open and Paid'),('draft_open_paid','Draft, Open and Paid')
+            ], string='Invoice State',multi=True, readonly=True),
         'sale_avg_price' : fields.function(_product_margin, method=True, type='float', string='Avg. Unit Price', multi='sale',help="Avg. Price in Customer Invoices)"),
         'purchase_avg_price' : fields.function(_product_margin, method=True, type='float', string='Avg. Unit Price', multi='purchase',help="Avg. Price in Supplier Invoices "),
         'sale_num_invoiced' : fields.function(_product_margin, method=True, type='float', string='# Invoiced', multi='sale',help="Sum of Quantity in Customer Invoices"),

=== modified file 'project/project.py'
--- project/project.py	2009-11-17 07:10:35 +0000
+++ project/project.py	2010-03-17 11:50:49 +0000
@@ -64,10 +64,11 @@
                 FROM
                     project_task 
                 WHERE
-                    project_id in ('''+','.join(map(str,ids2))+''') AND
+                    project_id in %s AND
                     state<>'cancelled'
                 GROUP BY
-                    project_id''')
+                    project_id''',
+                       (tuple(ids2),))
             progress = dict(map(lambda x: (x[0], (x[1],x[2],x[3])), cr.fetchall()))
         for project in self.browse(cr, uid, ids, context=context):
             s = [0.0,0.0,0.0]
@@ -166,7 +167,7 @@
             default['name'] = proj.name+_(' (copy)')
         res = super(project, self).copy(cr, uid, id, default, context)
         ids = self.search(cr, uid, [('parent_id','child_of', [res])])
-        cr.execute('update project_task set active=True where project_id in ('+','.join(map(str,ids))+')')
+        cr.execute('update project_task set active=True where project_id in %s', (tuple(ids,)))
         return res
 
     def duplicate_template(self, cr, uid, ids,context={}):
@@ -228,8 +229,7 @@
 
 # Compute: effective_hours, total_hours, progress
     def _hours_get(self, cr, uid, ids, field_names, args, context):
-        task_set = ','.join(map(str, ids))
-        cr.execute(("SELECT task_id, COALESCE(SUM(hours),0) FROM project_task_work WHERE task_id in (%s) GROUP BY task_id") % (task_set,))
+        cr.execute("SELECT task_id, COALESCE(SUM(hours),0) FROM project_task_work WHERE task_id in %s GROUP BY task_id", (tuple(ids),))
         hours = dict(cr.fetchall())
         res = {}
         for task in self.browse(cr, uid, ids, context=context):

=== modified file 'purchase/purchase.py'
--- purchase/purchase.py	2010-03-10 09:01:40 +0000
+++ purchase/purchase.py	2010-03-17 11:50:49 +0000
@@ -112,8 +112,9 @@
             LEFT JOIN
                 stock_picking p on (p.id=m.picking_id)
             WHERE
-                p.purchase_id in ('''+','.join(map(str,ids))+''')
-            GROUP BY m.state, p.purchase_id''')
+                p.purchase_id in %s
+            GROUP BY m.state, p.purchase_id''',
+                   (tuple(ids),))
         for oid,nbr,state in cr.fetchall():
             if state=='cancel':
                 continue

=== modified file 'report_account/report_receivable.py'
--- report_account/report_receivable.py	2009-04-15 04:56:13 +0000
+++ report_account/report_receivable.py	2010-03-17 11:50:49 +0000
@@ -105,9 +105,9 @@
            date1,date2 = period['name'].split(' to ')
            query = "SELECT SUM(credit-debit) FROM account_move_line AS line, account_account as ac  \
                         WHERE (line.account_id=ac.id) AND ac.type='receivable' \
-                            AND (COALESCE(line.date,date) BETWEEN '%s' AND  '%s') \
-                            AND (reconcile_id IS NULL) AND ac.active"%(str(date2),str(date1))
-           cr.execute(query)
+                            AND (COALESCE(line.date,date) BETWEEN %s AND  %s) \
+                            AND (reconcile_id IS NULL) AND ac.active"
+           cr.execute(query, (date2, date1))
            amount = cr.fetchone()
            amount = amount[0] or 0.00
            res[period['id']] = amount

=== modified file 'report_analytic_planning/report_analytic_planning.py'
--- report_analytic_planning/report_analytic_planning.py	2009-01-04 22:12:50 +0000
+++ report_analytic_planning/report_analytic_planning.py	2010-03-17 11:50:49 +0000
@@ -119,8 +119,10 @@
         result = {}
         for line in self.browse(cr, uid, ids, context):
             where = ''
+            sqlarg = ()
             if line.user_id:
-                where='user_id='+str(line.user_id.id)+' and '
+                where='user_id=%s and '
+                sqlarg = (line.user_id.id)
             cr.execute('''select
                     sum(planned_hours)
                 from
@@ -129,11 +131,11 @@
                 '''+where+'''
                     project_id in (select id from project_project where category_id=%s) and
                     date_close>=%s and
-                    date_close<=%s''', (
-                line.account_id.id,
-                line.planning_id.date_from,
-                line.planning_id.date_to)
-            )
+                    date_close<=%s''',
+                       sqlarg + (
+                           line.account_id.id,
+                           line.planning_id.date_from,
+                           line.planning_id.date_to))
             result[line.id] = cr.fetchone()[0]
         return result
     _columns = {

=== modified file 'report_crm/report_crm.py'
--- report_crm/report_crm.py	2009-03-20 11:28:18 +0000
+++ report_crm/report_crm.py	2010-03-17 11:50:49 +0000
@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 ##############################################################################
 #
-#    OpenERP, Open Source Management Solution	
+#    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>). All Rights Reserved
 #    $Id$
 #
@@ -111,29 +111,29 @@
     _name = "report.crm.case.section"
     _description = "Cases by Section"
     _auto = False
-    
+
     def _get_data(self, cr, uid, ids, field_name, arg, context={}):
         res = {}
         state_perc = 0.0
         avg_ans = 0.0
-        
+
         for case in self.browse(cr, uid, ids, context):
             if field_name != 'avg_answers':
                 state = field_name[5:]
-                cr.execute("select count(*) from crm_case where section_id =%s and state='%s'"%(case.section_id.id,state))
+                cr.execute("select count(*) from crm_case where section_id =%s and state=%s", (case.section_id.id,state))
                 state_cases = cr.fetchone()[0]
                 perc_state = (state_cases / float(case.nbr_cases) ) * 100
-                
+
                 res[case.id] = perc_state
             else:
-                cr.execute('select count(*) from crm_case_log l  where l.section_id=%s'%(case.section_id.id))
+                cr.execute('select count(*) from crm_case_log l where l.section_id=%s', (case.section_id.id,))
                 logs = cr.fetchone()[0]
-                
+
                 avg_ans = logs / case.nbr_cases
-                res[case.id] = avg_ans       
-        
+                res[case.id] = avg_ans
+
         return res
-    
+
     _columns = {
         'name': fields.date('Month', readonly=True),
 #        'user_id':fields.many2one('res.users', 'User', readonly=True),
@@ -181,7 +181,7 @@
         'create_date' : fields.datetime('Create Date', readonly=True)
     }
     _order = 'date_closed, create_date'
-    
+
     def init(self, cr):
         cr.execute("""create or replace view report_crm_case_service_dashboard as (
             select
@@ -195,12 +195,12 @@
             where
                 ((to_date(to_char(cse.date_closed, 'YYYY-MM-dd'),'YYYY-MM-dd') <= CURRENT_DATE)
                     AND
-                (to_date(to_char(cse.date_closed, 'YYYY-MM-dd'),'YYYY-MM-dd') > (CURRENT_DATE-15)) 
+                (to_date(to_char(cse.date_closed, 'YYYY-MM-dd'),'YYYY-MM-dd') > (CURRENT_DATE-15))
                     AND
                     cse.state='done')
-                
+
                 OR
-                
+
                 ((to_date(to_char(cse.create_date, 'YYYY-MM-dd'),'YYYY-MM-dd') <= CURRENT_DATE)
                     AND
                 (to_date(to_char(cse.create_date, 'YYYY-MM-dd'),'YYYY-MM-dd') > (CURRENT_DATE-15))
@@ -211,4 +211,3 @@
 
 
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== modified file 'report_timesheet/report_timesheet.py'
--- report_timesheet/report_timesheet.py	2009-06-09 23:35:34 +0000
+++ report_timesheet/report_timesheet.py	2010-03-17 11:50:49 +0000
@@ -194,11 +194,11 @@
                 account_analytic_line line, hr_department dept,hr_department_user_rel dept_user
             where
                 (dept.id = dept_user.department_id AND dept_user.user_id=line.user_id AND line.user_id is not null)
-                AND (dept.manager_id = """ + str(uid) + """ ) 
+                AND (dept.manager_id = %s)
                 AND (line.date <= CURRENT_DATE AND line.date > (CURRENT_DATE-3))
             LIMIT 10
             )
-            """ )
+            """, (uid,))
 
 report_random_timsheet()
 

=== modified file 'sale/sale.py'
--- sale/sale.py	2010-03-02 11:50:52 +0000
+++ sale/sale.py	2010-03-17 11:50:49 +0000
@@ -101,8 +101,8 @@
             LEFT JOIN
                 stock_picking p on (p.id=m.picking_id)
             WHERE
-                p.sale_id in ('''+','.join(map(str, ids))+''')
-            GROUP BY m.state, p.sale_id''')
+                p.sale_id in %s
+            GROUP BY m.state, p.sale_id''', (tuple(ids),))
         for oid, nbr, state in cr.fetchall():
             if state == 'cancel':
                 continue
@@ -297,7 +297,7 @@
     def action_cancel_draft(self, cr, uid, ids, *args):
         if not len(ids):
             return False
-        cr.execute('select id from sale_order_line where order_id in ('+','.join(map(str, ids))+')', ('draft',))
+        cr.execute('select id from sale_order_line where order_id in %s', (tuple(ids),))
         line_ids = map(lambda x: x[0], cr.fetchall())
         self.write(cr, uid, ids, {'state': 'draft', 'invoice_ids': [], 'shipped': 0})
         self.pool.get('sale.order.line').write(cr, uid, line_ids, {'invoiced': False, 'state': 'draft', 'invoice_lines': [(6, 0, [])]})

=== modified file 'scrum/report/_burndown.py'
--- scrum/report/_burndown.py	2009-01-04 22:12:50 +0000
+++ scrum/report/_burndown.py	2010-03-17 11:50:49 +0000
@@ -26,15 +26,15 @@
 
 def compute_burndown(cr, uid, tasks_id, date_start, date_stop):
     latest = False
-    if len(tasks_id):
-        cr.execute('select id,create_date,state,planned_hours from project_task where id in ('+','.join(map(str,tasks_id))+') order by create_date')
+    if tasks_id:
+        cr.execute('select id,create_date,state,planned_hours from project_task where id in %s order by create_date', (tuple(tasks_id),))
         tasks = cr.fetchall()
 
-        cr.execute('select w.date,w.hours from project_task_work w left join project_task t on (t.id=w.task_id) where t.id in ('+','.join(map(str,tasks_id))+') and t.state in (\'open\',\'progress\') order by date')
+        cr.execute('select w.date,w.hours from project_task_work w left join project_task t on (t.id=w.task_id) where t.id in %s and t.state in (\'open\',\'progress\') order by date', (tuple(tasks_id),))
 
         tasks2 = cr.fetchall()
 
-        cr.execute('select date_close,planned_hours from project_task where id in ('+','.join(map(str,tasks_id))+') and state in (\'cancelled\',\'done\') order by date_close')
+        cr.execute('select date_close,planned_hours from project_task where id in %s and state in (\'cancelled\',\'done\') order by date_close', (tuple(tasks_id),))
         tasks2 += cr.fetchall()
         tasks2.sort()
     else:
@@ -63,7 +63,4 @@
     result.append( (int(time.mktime(time.strptime(date_stop,'%Y-%m-%d'))), 0) )
     return result
 
-
-
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== modified file 'scrum/report/task_burndown.py'
--- scrum/report/task_burndown.py	2009-01-04 22:12:50 +0000
+++ scrum/report/task_burndown.py	2010-03-17 11:50:49 +0000
@@ -43,9 +43,9 @@
 
 def burndown_chart(cr, uid, tasks_id, date_start, date_stop):
     latest = False
-    cr.execute('select id,date_start,state,planned_hours from project_task where id in ('+','.join(map(str,tasks_id))+') order by date_start')
+    cr.execute('select id,date_start,state,planned_hours from project_task where id in %s order by date_start', (tuple(tasks_id),))
     tasks = cr.fetchall()
-    cr.execute('select id,date_close,state,planned_hours*progress/100 from project_task where id in ('+','.join(map(str,tasks_id))+') and state in (%s,%s) order by date_close', ('progress','done'))
+    cr.execute('select id,date_close,state,planned_hours*progress/100 from project_task where id in %s and state in (%s,%s) order by date_close', (tuple(tasks_id), 'progress','done'))
     tasks2 = cr.fetchall()
     current_date = date_start
     total = 0
@@ -72,14 +72,14 @@
         io = StringIO.StringIO()
 
         if 'date_start' not in datas:
-            cr.execute('select min(date_start) from project_task where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select min(date_start) from project_task where id in %s', (tuple(ids),))
             dt = cr.fetchone()[0]
             if dt:
                 datas['date_start'] = dt[:10]
             else:
                 datas['date_start'] = time.strftime('%Y-%m-%d')
         if 'date_stop' not in datas:
-            cr.execute('select max(date_start),max(date_close) from project_task where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select max(date_start),max(date_close) from project_task where id in %s', (tuple(ids),))
             res = cr.fetchone()
             datas['date_stop'] = (res[0] and res[0][:10]) or time.strftime('%Y-%m-%d')
             if res[1] and datas['date_stop']<res[1]:

=== modified file 'stock/product.py'
--- stock/product.py	2010-02-22 13:58:43 +0000
+++ stock/product.py	2010-03-17 11:50:49 +0000
@@ -89,37 +89,43 @@
 
         from_date=context.get('from_date',False)
         to_date=context.get('to_date',False)
-        date_str=False
+        date_str = ''
+        date_args = ()
         if from_date and to_date:
-            date_str="date_planned>='%s' and date_planned<='%s'"%(from_date,to_date)
+            date_str = "and date_planned>=%s and date_planned<=%s"
+            date_args = (from_date, to_date)
         elif from_date:
-            date_str="date_planned>='%s'"%(from_date)
+            date_str = "and date_planned>=%s"
+            date_args = (from_date,)
         elif to_date:
-            date_str="date_planned<='%s'"%(to_date)
+            date_str = "and date_planned<=%s"
+            date_args = (to_date,)
 
         if 'in' in what:
             # all moves from a location out of the set to a location in the set
             cr.execute(
                 'select sum(product_qty), product_id, product_uom '\
                 'from stock_move '\
-                'where location_id not in ('+location_ids_str+') '\
-                'and location_dest_id in ('+location_ids_str+') '\
-                'and product_id in ('+prod_ids_str+') '\
-                'and state in ('+states_str+') '+ (date_str and 'and '+date_str+' ' or '') +''\
-                'group by product_id,product_uom'
-            )
+                'where location_id not in %s '\
+                'and location_dest_id in %s '\
+                'and product_id in %s '\
+                'and state in %s '+ date_str + ' '\
+                'group by product_id,product_uom',
+                (tuple(location_ids), tuple(location_ids), tuple(ids),
+                 tuple(states)) + date_args)
             results = cr.fetchall()
         if 'out' in what:
             # all moves from a location in the set to a location out of the set
             cr.execute(
                 'select sum(product_qty), product_id, product_uom '\
                 'from stock_move '\
-                'where location_id in ('+location_ids_str+') '\
-                'and location_dest_id not in ('+location_ids_str+') '\
-                'and product_id in ('+prod_ids_str+') '\
-                'and state in ('+states_str+') '+ (date_str and 'and '+date_str+' ' or '') + ''\
-                'group by product_id,product_uom'
-            )
+                'where location_id in %s '\
+                'and location_dest_id not in %s '\
+                'and product_id in %s '\
+                'and state in %s '+ date_str + ' '\
+                'group by product_id,product_uom',
+                (tuple(location_ids), tuple(location_ids), tuple(ids),
+                 tuple(states)) + date_args)
             results2 = cr.fetchall()
         uom_obj = self.pool.get('product.uom')
         uoms = map(lambda x: x[2], results) + map(lambda x: x[2], results2)

=== modified file 'stock/stock.py'
--- stock/stock.py	2010-03-12 11:08:43 +0000
+++ stock/stock.py	2010-03-17 11:50:49 +0000
@@ -368,13 +368,15 @@
             ids = [ids]
         for pick in self.browse(cr, uid, ids, context):
             sql_str = """update stock_move set
-                    date_planned='%s'
+                    date_planned=%s
                 where
-                    picking_id=%d """ % (value, pick.id)
+                    picking_id=%s """
+            sqlargs = (value, pick.id)
 
             if pick.max_date:
-                sql_str += " and (date_planned='" + pick.max_date + "' or date_planned>'" + value + "')"
-            cr.execute(sql_str)
+                sql_str += " and (date_planned=%s or date_planned>%s)"
+                sqlargs += (pick.max_date, value)
+            cr.execute(sql_str, sqlargs)
         return True
 
     def _set_minimum_date(self, cr, uid, ids, name, value, arg, context):
@@ -384,12 +386,14 @@
             ids = [ids]
         for pick in self.browse(cr, uid, ids, context):
             sql_str = """update stock_move set
-                    date_planned='%s'
+                    date_planned=%s
                 where
-                    picking_id=%s """ % (value, pick.id)
+                    picking_id=%s """
+            sqlargs = (value, pick.id)
             if pick.min_date:
-                sql_str += " and (date_planned='" + pick.min_date + "' or date_planned<'" + value + "')"
-            cr.execute(sql_str)
+                sql_str += " and (date_planned=%s or date_planned<%s)"
+                sqlargs += (pick.min_date, value)
+            cr.execute(sql_str, sqlargs)
         return True
 
     def get_min_max_date(self, cr, uid, ids, field_name, arg, context={}):
@@ -405,9 +409,9 @@
             from
                 stock_move
             where
-                picking_id in (""" + ','.join(map(str, ids)) + """)
+                picking_id in %s
             group by
-                picking_id""")
+                picking_id""", (tuple(ids),))
         for pick, dt1, dt2 in cr.fetchall():
             res[pick]['min_date'] = dt1
             res[pick]['max_date'] = dt2
@@ -841,11 +845,11 @@
                 from
                     stock_report_prodlots
                 where
-                    location_id in ('''+','.join(map(str, locations))+''')  and
-                    prodlot_id in  ('''+','.join(map(str, ids))+''')
+                    location_id in %s  and
+                    prodlot_id in  %s
                 group by
                     prodlot_id
-            ''')
+            ''', (tuple(locations), tuple(ids)))
             res.update(dict(cr.fetchall()))
         return res
 
@@ -857,11 +861,11 @@
             from
                 stock_report_prodlots
             where
-                location_id in ('''+','.join(map(str, locations)) + ''')
+                location_id in %s
             group by
                 prodlot_id
-            having  sum(name)  ''' + str(args[0][1]) + ''' ''' + str(args[0][2])
-        )
+            having sum(name) ''' + str(args[0][1]) + ' %s',
+                   (tuple(locations), args[0][2]))
         res = cr.fetchall()
         ids = [('id', 'in', map(lambda x: x[0], res))]
         return ids
@@ -1204,7 +1208,6 @@
                         r = res.pop(0)
                         move_id = self.copy(cr, uid, move.id, {'product_qty': r[0], 'location_id': r[1]})
                         done.append(move_id)
-                        #cr.execute('insert into stock_move_history_ids values (%s,%s)', (move.id,move_id))
         if done:
             count += len(done)
             self.write(cr, uid, done, {'state': 'assigned'})
@@ -1547,4 +1550,3 @@
             )""")
 
 report_stock_lines_date()
-

=== modified file 'stock/wizard/inventory_merge_zero.py'
--- stock/wizard/inventory_merge_zero.py	2009-04-09 10:02:19 +0000
+++ stock/wizard/inventory_merge_zero.py	2010-03-17 11:50:49 +0000
@@ -53,11 +53,11 @@
         raise wizard.except_wizard(_('Warning'),
                                    _('Please select one and only one inventory !'))
 
-    loc = str(data['form']['location_id'])
+    loc = data['form']['location_id']
 
     cr.execute('select distinct location_id,product_id from stock_inventory_line where inventory_id=%s', (data['ids'][0],))
     inv = cr.fetchall()
-    cr.execute('select distinct product_id from stock_move where (location_dest_id='+loc+') or (location_id='+loc+')')
+    cr.execute('select distinct product_id from stock_move where (location_dest_id=%(location_id)s) or (location_id=%(location_id)s)', data['form'])
     stock = cr.fetchall()
     for s in stock:
         if (loc,s[0]) not in inv:

=== modified file 'wiki/wizard/make_index.py'
--- wiki/wizard/make_index.py	2009-04-09 10:02:19 +0000
+++ wiki/wizard/make_index.py	2010-03-17 11:50:49 +0000
@@ -35,10 +35,9 @@
     ids = data['ids']
     pool = pooler.get_pool(cr.dbname)
     wiki_pool = pool.get('wiki.wiki')
-    
-    iid = ','.join([str(x) for x in ids])
-    sSQL = "Select id, section from wiki_wiki where id in (%s) order by section " % (iid)
-    cr.execute(sSQL)
+
+    sSQL = "Select id, section from wiki_wiki where id in %s order by section "
+    cr.execute(sSQL, (tuple(ids),))
     lst0 = cr.fetchall()
     lst = []
     ids = {}