diff --git a/modules/Accounts/models/Module.php b/modules/Accounts/models/Module.php
index 853d5e5fca447bfd61dbd7970210ba346ba98ed1..5dad3ba8684c418381cd2828a619b9ca782ad484 100644
--- a/modules/Accounts/models/Module.php
+++ b/modules/Accounts/models/Module.php
@@ -48,17 +48,22 @@ class Accounts_Module_Model extends Vtiger_Module_Model {
 		if (($sourceModule == 'Accounts' && $field == 'account_id' && $record)
 				|| in_array($sourceModule, array('Campaigns', 'Products', 'Services', 'Emails'))) {
 
+		    	$db = PearDatabase::getInstance();
+		    	$params = array($record);
 			if ($sourceModule === 'Campaigns') {
-				$condition = " vtiger_account.accountid NOT IN (SELECT accountid FROM vtiger_campaignaccountrel WHERE campaignid = '$record')";
+				$condition = " vtiger_account.accountid NOT IN (SELECT accountid FROM vtiger_campaignaccountrel WHERE campaignid = ?)";
 			} elseif ($sourceModule === 'Products') {
-				$condition = " vtiger_account.accountid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = '$record')";
+				$condition = " vtiger_account.accountid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = ?)";
 			} elseif ($sourceModule === 'Services') {
-				$condition = " vtiger_account.accountid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
-			} elseif ($sourceModule === 'Emails') {
+				$condition = " vtiger_account.accountid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+                		$params = array($record, $record);
+            		} elseif ($sourceModule === 'Emails') {
 				$condition = ' vtiger_account.emailoptout = 0';
+                		$params = array();
 			} else {
-				$condition = " vtiger_account.accountid != '$record'";
+				$condition = " vtiger_account.accountid != ?";
 			}
+            		$condition = $db->convert2Sql($condition, $params);
 
 			$position = stripos($listQuery, 'where');
 			if($position) {
diff --git a/modules/Campaigns/models/Module.php b/modules/Campaigns/models/Module.php
index 67c050e0c131789105026ad796e749b329938c9a..d7547545fa8cc61d8f042bf9a39cf7aa44d6071f 100644
--- a/modules/Campaigns/models/Module.php
+++ b/modules/Campaigns/models/Module.php
@@ -46,8 +46,9 @@ class Campaigns_Module_Model extends Vtiger_Module_Model {
 				case 'Accounts'		: $tableName = 'vtiger_campaignaccountrel';		$relatedFieldName = 'accountid';	break;
 				case 'Contacts'		: $tableName = 'vtiger_campaigncontrel';		$relatedFieldName = 'contactid';	break;
 			}
-
-			$condition = " vtiger_campaign.campaignid NOT IN (SELECT campaignid FROM $tableName WHERE $relatedFieldName = '$record')";
+                	$db = PearDatabase::getInstance();
+			$condition = " vtiger_campaign.campaignid NOT IN (SELECT campaignid FROM $tableName WHERE $relatedFieldName = ?)";
+            		$condition = $db->convert2Sql($condition, array($record));
 			$pos = stripos($listQuery, 'where');
 
 			if ($pos) {
@@ -89,4 +90,4 @@ class Campaigns_Module_Model extends Vtiger_Module_Model {
 		return array();
 	}
 
-}
\ No newline at end of file
+}
diff --git a/modules/Contacts/models/Module.php b/modules/Contacts/models/Module.php
index 5817ded3164010f20c21ff5a49633eff213f6fa0..c2a6ad66a1851088acdf197f6fd2c7022289ea85 100644
--- a/modules/Contacts/models/Module.php
+++ b/modules/Contacts/models/Module.php
@@ -293,15 +293,19 @@ class Contacts_Module_Model extends Vtiger_Module_Model {
 				case 'Products'		: $tableName = 'vtiger_seproductsrel';		$fieldName = 'crmid';		$relatedFieldName ='productid';		break;
 			}
 
+            		$db = PearDatabase::getInstance();
+		    	$params = array($record);
 			if ($sourceModule === 'Services') {
-				$condition = " vtiger_contactdetails.contactid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+				$condition = " vtiger_contactdetails.contactid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+                		$params = array($record , $record);
 			} elseif ($sourceModule === 'Emails') {
 				$condition = ' vtiger_contactdetails.emailoptout = 0';
 			} elseif ($sourceModule === 'Contacts' && $field === 'contact_id') {
-				$condition = " vtiger_contactdetails.contactid != '$record'";
+				$condition = " vtiger_contactdetails.contactid != ?";
 			} else {
-				$condition = " vtiger_contactdetails.contactid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = '$record')";
+				$condition = " vtiger_contactdetails.contactid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = ?)";
 			}
+            		$condition = $db->convert2Sql($condition, $params);
 
 			$position = stripos($listQuery, 'where');
 			if($position) {
@@ -318,4 +322,4 @@ class Contacts_Module_Model extends Vtiger_Module_Model {
         return "lastname";
     }
     
-}
\ No newline at end of file
+}
diff --git a/modules/Documents/models/Module.php b/modules/Documents/models/Module.php
index 535d1c5e9ab55546ed2408949f6ec1125939c557..c1a601df2ca2eb8a7bea8fd25992e1cf943f0e32 100644
--- a/modules/Documents/models/Module.php
+++ b/modules/Documents/models/Module.php
@@ -62,7 +62,9 @@ class Documents_Module_Model extends Vtiger_Module_Model {
 		if($sourceModule === 'Emails' && $field === 'composeEmail') {
 			$condition = ' (( vtiger_notes.filelocationtype LIKE "%I%")) AND vtiger_notes.filename != "" AND vtiger_notes.filestatus = 1';
 		} else {
-			$condition = " vtiger_notes.notesid NOT IN (SELECT notesid FROM vtiger_senotesrel WHERE crmid = '$record') AND vtiger_notes.filestatus = 1";
+            		$db = PearDatabase::getInstance();
+			$condition = " vtiger_notes.notesid NOT IN (SELECT notesid FROM vtiger_senotesrel WHERE crmid = ?) AND vtiger_notes.filestatus = 1";
+            		$condition = $db->convert2Sql($condition, array($record));
 		}
 		$pos = stripos($listQuery, 'where');
 		if($pos) {
diff --git a/modules/HelpDesk/models/Module.php b/modules/HelpDesk/models/Module.php
index f933f9c3b1a04ea0c467dba2dbed736f110bb04a..e0b2c4acfad56cf225365c626216287bdc157833 100644
--- a/modules/HelpDesk/models/Module.php
+++ b/modules/HelpDesk/models/Module.php
@@ -187,7 +187,9 @@ class HelpDesk_Module_Model extends Vtiger_Module_Model {
 	 */
 	public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) {
 		if (in_array($sourceModule, array('Assets', 'Project', 'ServiceContracts', 'Services'))) {
-			$condition = " vtiger_troubletickets.ticketid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+			$condition = " vtiger_troubletickets.ticketid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+			$db = PearDatabase::getInstance();
+            		$condition = $db->convert2Sql($condition, array($record, $record));
 			$pos = stripos($listQuery, 'where');
 
 			if ($pos) {
diff --git a/modules/Leads/models/Module.php b/modules/Leads/models/Module.php
index d64ae21b5ca3b05152580ec7057ac341658fe0fc..08ba884402b00928f9b1247cd125a8eded5018f7 100644
--- a/modules/Leads/models/Module.php
+++ b/modules/Leads/models/Module.php
@@ -344,13 +344,18 @@ class Leads_Module_Model extends Vtiger_Module_Model {
 				case 'Products'		: $tableName = 'vtiger_seproductsrel';		$fieldName = 'crmid';		$relatedFieldName ='productid';		break;
 			}
 
+            		$db = PearDatabase::getInstance();
+		    	$params = array($record);
 			if ($sourceModule === 'Services') {
-				$condition = " vtiger_leaddetails.leadid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+				$condition = " vtiger_leaddetails.leadid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+                		$params = array($record, $record);
 			} elseif ($sourceModule === 'Emails') {
 				$condition = ' vtiger_leaddetails.emailoptout = 0';
+                		$params = array();
 			} else {
-				$condition = " vtiger_leaddetails.leadid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = '$record')";
+				$condition = " vtiger_leaddetails.leadid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = ?)";
 			}
+			$condition = $db->convert2Sql($condition, $params);
 
 			$position = stripos($listQuery, 'where');
 			if($position) {
@@ -373,4 +378,4 @@ class Leads_Module_Model extends Vtiger_Module_Model {
 	public function getUtilityActionsNames() {
 		return array('Import', 'Export', 'Merge', 'ConvertLead', 'DuplicatesHandling');
 	}
-}
\ No newline at end of file
+}
diff --git a/modules/Potentials/models/Module.php b/modules/Potentials/models/Module.php
index 15616aa7cafd1bcaab982de5de4d787495cdbba0..d33ec91eb2dcd255324ad32d200910e48c93e665 100644
--- a/modules/Potentials/models/Module.php
+++ b/modules/Potentials/models/Module.php
@@ -331,11 +331,15 @@ class Potentials_Module_Model extends Vtiger_Module_Model {
 	 */
 	public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) {
 		if (in_array($sourceModule, array('Products', 'Services'))) {
+            		$db = PearDatabase::getInstance();
+		    	$params = array($record);
 			if ($sourceModule === 'Products') {
-				$condition = " vtiger_potential.potentialid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = '$record')";
+				$condition = " vtiger_potential.potentialid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = ?)";
 			} elseif ($sourceModule === 'Services') {
-				$condition = " vtiger_potential.potentialid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+				$condition = " vtiger_potential.potentialid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+                		$params = array($record, $record);
 			}
+			$condition = $db->convert2Sql($condition, $params);
 
 			$pos = stripos($listQuery, 'where');
 			if ($pos) {
@@ -390,4 +394,4 @@ class Potentials_Module_Model extends Vtiger_Module_Model {
     function getUtilityActionsNames() {
         return array('Import', 'Export', 'DuplicatesHandling');
     }
-}
\ No newline at end of file
+}
diff --git a/modules/PriceBooks/models/Module.php b/modules/PriceBooks/models/Module.php
index 34a78e9ed7fa34eb18e1a5071a250d0d035fc9c8..92e25cbc506bc6cd5223e83d138771a47b7a5620 100644
--- a/modules/PriceBooks/models/Module.php
+++ b/modules/PriceBooks/models/Module.php
@@ -67,13 +67,15 @@ class PriceBooks_Module_Model extends Vtiger_Module_Model {
 		$relatedModulesList = array('Products', 'Services');
 		if (in_array($sourceModule, $relatedModulesList)) {
 			$pos = stripos($listQuery, ' where ');
+            		$db = PearDatabase::getInstance();
 			if ($currencyId && in_array($field, array('productid', 'serviceid'))) {
-				$condition = " vtiger_pricebook.pricebookid IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = $record)
+				$condition = " vtiger_pricebook.pricebookid IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = ?)
 								AND vtiger_pricebook.currency_id = $currencyId AND vtiger_pricebook.active = 1";
 			} else if($field == 'productsRelatedList') {
-				$condition = "vtiger_pricebook.pricebookid NOT IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = $record)
+				$condition = "vtiger_pricebook.pricebookid NOT IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = ?)
 								AND vtiger_pricebook.active = 1";
 			}
+            		$condition = $db->convert2Sql($condition, array($record));
 			if ($pos) {
 				$split = preg_split('/ where /i', $listQuery);
 				$overRideQuery = $split[0] . ' WHERE ' . $split[1] . ' AND ' . $condition;
diff --git a/modules/Products/models/Module.php b/modules/Products/models/Module.php
index 6703da9eabdebe687d0e5da064a7021c8ac4e4ab..ec0493ad048972fbf487f2afffd6aae1c4438705 100644
--- a/modules/Products/models/Module.php
+++ b/modules/Products/models/Module.php
@@ -25,15 +25,21 @@ class Products_Module_Model extends Vtiger_Module_Model {
 				|| in_array($sourceModule, getInventoryModules())) {
 
 			$condition = " vtiger_products.discontinued = 1 ";
+            		$db = PearDatabase::getInstance();
+		    	$params = array($record);
 			if ($sourceModule === $this->getName()) {
-				$condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE setype = '". $this->getName(). "' UNION SELECT crmid FROM vtiger_seproductsrel WHERE productid = '$record') AND vtiger_products.productid <> '$record' ";
+				$condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE setype = '". $this->getName(). "' UNION SELECT crmid FROM vtiger_seproductsrel WHERE productid = ?) AND vtiger_products.productid <> ? ";
+                		$params = array($record, $record);
 			} elseif ($sourceModule === 'PriceBooks') {
-				$condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = '$record') ";
+				$condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = ?) ";
 			} elseif ($sourceModule === 'Vendors') {
-				$condition .= " AND vtiger_products.vendor_id != '$record' ";
+				$condition .= " AND vtiger_products.vendor_id != ? ";
 			} elseif (in_array($sourceModule, $supportedModulesList)) {
-				$condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE crmid = '$record')";
+				$condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE crmid = ?)";
+			} else {
+                $params = array();
 			}
+			$condition = $db->convert2Sql($condition, $params);
 
 			$pos = stripos($listQuery, 'where');
 			if ($pos) {
diff --git a/modules/Users/models/Module.php b/modules/Users/models/Module.php
index 150d45865762eee27f72a4688f0578b9f8f42134..5658b32f4e435fc881d9d16cd73fcb45a94cce7d 100644
--- a/modules/Users/models/Module.php
+++ b/modules/Users/models/Module.php
@@ -21,8 +21,10 @@ class Users_Module_Model extends Vtiger_Module_Model {
 		if($sourceModule == 'Users' && $field == 'reports_to_id') {
 			$overRideQuery = $listQuery;
 			if(!empty($record)){
+                		$db = PearDatabase::getInstance();
+                		$condition = $db->convert2Sql(' AND vtiger_users.id != ? ', array($record));
 				$currentUser = Users_Record_Model::getCurrentUserModel();
-				$overRideQuery = $overRideQuery. " AND vtiger_users.id != ". $record;
+				$overRideQuery = $overRideQuery. $condition;
 				$allSubordinates = $currentUser->getAllSubordinatesByReportsToField($record);
 				if(count($allSubordinates) > 0) {
 					$overRideQuery .= " AND vtiger_users.id NOT IN (". implode(',',$allSubordinates) .")"; // do not allow the subordinates
diff --git a/packages/vtiger/mandatory/ServiceContracts.zip b/packages/vtiger/mandatory/ServiceContracts.zip
index a1b53c07d50540611cdc1a5be5c707111424f86f..5053520885a4041540aec076d57277a5ea6b0044 100644
Binary files a/packages/vtiger/mandatory/ServiceContracts.zip and b/packages/vtiger/mandatory/ServiceContracts.zip differ
diff --git a/packages/vtiger/mandatory/Services.zip b/packages/vtiger/mandatory/Services.zip
index 3ac879a4b0605a462c915f8cd831c09f1bb37ed3..88e18feae69c9e004f828a33f535bc8456ba651c 100644
Binary files a/packages/vtiger/mandatory/Services.zip and b/packages/vtiger/mandatory/Services.zip differ
diff --git a/packages/vtiger/optional/Assets.zip b/packages/vtiger/optional/Assets.zip
index af8d02ed29d9344d2d93e77fca2f6461cd874068..8e0ec347b21d361b1f9ba7b6629006e55636c0d4 100644
Binary files a/packages/vtiger/optional/Assets.zip and b/packages/vtiger/optional/Assets.zip differ
diff --git a/packages/vtiger/optional/Projects.zip b/packages/vtiger/optional/Projects.zip
index d229cba4fe29fc6c33f3fd14185dd5b0fd87e196..c38ca829d839b7eb1f23894cb3796bce1d71a04c 100644
Binary files a/packages/vtiger/optional/Projects.zip and b/packages/vtiger/optional/Projects.zip differ
diff --git a/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php b/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php
index fd971c2516777f6019ac5758318bad795bd8e80f..3dcb5f63bc5a8bb13bb9819b6aa708c62aac87f8 100644
--- a/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php
+++ b/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php
@@ -12,7 +12,9 @@ class Assets_Module_Model extends Vtiger_Module_Model {
 
 	public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) {
 		if ($sourceModule == 'HelpDesk') {
-			$condition = " vtiger_assets.assetsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+			$condition = " vtiger_assets.assetsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+            		$db = PearDatabase::getInstance();
+            		$condition = $db->convert2Sql($condition, array($record, $record));
 
 			$pos = stripos($listQuery, 'where');
 			if ($pos) {
diff --git a/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php b/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php
index db54192133ba9facccee5d8436491a1e1b931a86..62d28531dcaf914f2033403e74e5792e2b2d191d 100644
--- a/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php
+++ b/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php
@@ -82,7 +82,9 @@ class Project_Module_Model extends Vtiger_Module_Model {
 	 */
 	public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) {
 		if ($sourceModule === 'HelpDesk') {
-			$condition = " vtiger_project.projectid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+			$condition = " vtiger_project.projectid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+            		$db = PearDatabase::getInstance();
+            		$condition = $db->convert2Sql($condition, array($record, $record));
 
 			$pos = stripos($listQuery, 'where');
 			if ($pos) {
@@ -95,4 +97,4 @@ class Project_Module_Model extends Vtiger_Module_Model {
 		}
 	}
 
-}
\ No newline at end of file
+}
diff --git a/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php b/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php
index cb238c0fe9139a2f310f87ab6b125028916c6587..5deb84001deccf5af9b4083ed97e0ddbc457ddf5 100755
--- a/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php
+++ b/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php
@@ -35,7 +35,9 @@ class ServiceContracts_Module_Model extends Vtiger_Module_Model {
 	 */
 	public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) {
 		if ($sourceModule === 'HelpDesk') {
-			$condition = " vtiger_servicecontracts.servicecontractsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+			$condition = " vtiger_servicecontracts.servicecontractsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+            		$db = PearDatabase::getInstance();
+            		$condition = $db->convert2Sql($condition, array($record, $record));
 
 			$pos = stripos($listQuery, 'where');
 			if ($pos) {
diff --git a/pkg/vtiger/modules/Services/modules/Services/models/Module.php b/pkg/vtiger/modules/Services/modules/Services/models/Module.php
index 86e8babf672573165694a9064ef8160524d05f4a..f21567290acac1e9933822bb25eb242308317665 100644
--- a/pkg/vtiger/modules/Services/modules/Services/models/Module.php
+++ b/pkg/vtiger/modules/Services/modules/Services/models/Module.php
@@ -26,11 +26,16 @@ class Services_Module_Model extends Products_Module_Model {
 
 			$condition = " vtiger_service.discontinued = 1 ";
 
+            		$db = PearDatabase::getInstance();
+            		$params = array();
 			if ($sourceModule == 'PriceBooks' && $field == 'priceBookRelatedList') {
-				$condition .= " AND vtiger_service.serviceid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = '$record') ";
+				$condition .= " AND vtiger_service.serviceid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = ?) ";
+                		$params = array($record);
 			} elseif (in_array($sourceModule, $supportedModulesList)) {
-				$condition .= " AND vtiger_service.serviceid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') ";
+				$condition .= " AND vtiger_service.serviceid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) ";
+                		$params = array($record, $record);
 			}
+            		$condition = $db->convert2Sql($condition, $params);
 
 			$pos = stripos($listQuery, 'where');
 			if ($pos) {
@@ -71,4 +76,4 @@ class Services_Module_Model extends Products_Module_Model {
     function getUtilityActionsNames() {
         return array('Import', 'Export', 'DuplicatesHandling');
     }
-}
\ No newline at end of file
+}