diff --git a/include/class/fiche.class.php b/include/class/fiche.class.php
index e4942bb4a..b62f6d74c 100644
--- a/include/class/fiche.class.php
+++ b/include/class/fiche.class.php
@@ -291,10 +291,11 @@ class Fiche
      */
     function count_by_modele($p_frd_id,$p_search="",$p_sql="")
     {
-        $sql="select *
+        // Scan for SQL inject
+        $this->cn->search_sql_inject($p_sql);
              from
              fiche join fiche_Def using (fd_id)
-             where frd_id=".$p_frd_id;
+                                 where frd_id=$1 ".$p_sql
         if ( $p_search != "" )
         {
             $a=sql_string($p_search);
diff --git a/include/constant.php b/include/constant.php
index feaf0812c..55308e380 100644
--- a/include/constant.php
+++ b/include/constant.php
@@ -314,6 +314,7 @@ define ('EMAIL_LIMIT',1002);
 define ('EXC_PARAM_VALUE',1005);
 define ('EXC_PARAM_TYPE',1006);
 define ('EXC_DUPLICATE',1200);
+define ('EXC_INVALID',1400);
 define ("UNPINDG","");
 define ("PINDG","");
 
diff --git a/include/lib/database_core.class.php b/include/lib/database_core.class.php
index 2f7bc3246..d7d5cb65b 100644
--- a/include/lib/database_core.class.php
+++ b/include/lib/database_core.class.php
@@ -956,6 +956,24 @@ class DatabaseCore
     static  function nb_column($p_ret) {
         return pg_num_fields($p_ret);
     }
+    /**
+     * FInd if a SQL Select has a SQL stmt to inject or damage Data
+     * When a SELECT SQL string is build, this string could contain a SQL attempt to damage data,
+     *so the statement DELETE TRUNCATE ... are forbidden. Throw an exception EXC_INVALID
+     *
+     */
+    function search_sql_inject($p_sql)
+    {
+        $forbid_sql=array("update","delete","truncate","insert");
+        // protect against SQL inject
+        foreach ($forbid_sql as $forbid_key) {
+            if (stripos($p_sql,$forbid_key) !== false)
+            {
+                throw new Exception(_("Possible SQL inject",EXC_INVALID));
+            }
+
+        }
+    }
 
 }
 
diff --git a/unit-test/include/class/fiche.Test.php b/unit-test/include/class/fiche.Test.php
index 08e2cf425..ccd3b131a 100644
--- a/unit-test/include/class/fiche.Test.php
+++ b/unit-test/include/class/fiche.Test.php
@@ -33,7 +33,6 @@ class FicheTest extends TestCase
 
     /**
      * @covers Fiche::cmp_name
-     * @todo   Implement testCmp_name().
      */
     public function testCmp_name()
     {
@@ -45,7 +44,6 @@ class FicheTest extends TestCase
 
     /**
      * @covers Fiche::get_bk_account
-     * @todo   Implement testGet_bk_account().
      */
     public function testGet_bk_account()
     {
@@ -83,5 +81,31 @@ class FicheTest extends TestCase
         $this->assertEquals ($nb_result,3,"Size array not correct ");
         $this->assertEquals($a_result[0][24]["deb_montant"],204.71);
     }
-
+    
+    /**
+     * @covers Fiche::count_by_modele()
+     */
+    public function testCount_by_modele()
+    {
+        $nb=$this->object->count_by_modele(1,"","");
+        $this->assertEquals(4,$nb,"number of Sales Card ");
+        $nb=$this->object->count_by_modele(3,"eau","");
+        $this->assertEquals(1,$nb,"Purchase card water ");
+        $nb=$this->object->count_by_modele(3,"EAU","");
+        $this->assertEquals(1,$nb,"Purchase card water ");
+        $nb=$this->object->count_by_modele(3,"ZZ","");
+        $this->assertEquals(0,$nb,"no  card  found");
+        $nb=$this->object->count_by_modele(3000,"","");
+        $this->assertEquals(0,$nb,"no  card found");
+        $nb=$this->object->count_by_modele(3,"","");
+        $this->assertEquals(7,$nb,"Purchase cards ");
+        // attempt to inject SQL command, you must get an error
+        try {
+            $nb=@$this->object->count_by_modele(3,""," ;delete from jrn;");
+            $this->assertFalse(true,"Inject SQL command not found");
+        }  catch(Exception $e) {
+            $this->assertTrue(true,"Inject SQL command found");
+        }
+    }
+}
 }