diff --git a/htdocs/expensereport/card.php b/htdocs/expensereport/card.php
index 344c65832db..35cf2f69b37 100644
--- a/htdocs/expensereport/card.php
+++ b/htdocs/expensereport/card.php
@@ -1084,7 +1084,7 @@ if (empty($reshook)) {
 
 		$fk_c_exp_tax_cat = GETPOST('fk_c_exp_tax_cat', 'int');
 
-		$qty = GETPOST('qty', 'int');
+		$qty = price2num(GETPOST('qty', 'alpha'));
 		if (empty($qty)) {
 			$qty = 1;
 		}
@@ -1101,21 +1101,21 @@ if (empty($reshook)) {
 			$action = '';
 		}
 
-		// Si aucune date n'est rentrée
+		// If no date entered
 		if (empty($date) || $date == "--") {
 			$error++;
 			setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("Date")), null, 'errors');
+		} elseif ($date < $object->date_debut || $date > ($object->date_fin + (24 * 3600 - 1))) {
+			// Warning if date out of range
+			$langs->load("errors");
+			setEventMessages($langs->trans("WarningDateOfLineMustBeInExpenseReportRange"), null, 'warnings');
 		}
-		// Si aucun prix n'est rentré
+
+		// If no price entered
 		if ($value_unit == 0) {
 			$error++;
 			setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("PriceUTTC")), null, 'errors');
 		}
-		// Warning if date out of range
-		if ($date < $object->date_debut || $date > ($object->date_fin + (24 * 3600 - 1))) {
-			$langs->load("errors");
-			setEventMessages($langs->trans("WarningDateOfLineMustBeInExpenseReportRange"), null, 'warnings');
-		}
 
 		if (!$error) {
 			$type = 0; // TODO What if service ? We should take the type product/service from the type of expense report llx_c_type_fees
@@ -1215,12 +1215,12 @@ if (empty($reshook)) {
 			}
 		}
 
-		$rowid = $_POST['rowid'];
+		$rowid = GETPOST('rowid', 'int');
 		$type_fees_id = GETPOST('fk_c_type_fees', 'int');
 		$fk_c_exp_tax_cat = GETPOST('fk_c_exp_tax_cat', 'int');
 		$projet_id = $fk_project;
 		$comments = GETPOST('comments', 'restricthtml');
-		$qty = GETPOST('qty', 'int');
+		$qty = price2num(GETPOST('qty', 'alpha'));
 		$vatrate = GETPOST('vatrate', 'alpha');
 
 		// if VAT is not used in Dolibarr, set VAT rate to 0 because VAT rate is necessary.
@@ -2511,9 +2511,11 @@ if ($action == 'create') {
 	exit(1);
 }
 
+
 /*
  * Action bar
  */
+
 print '<div class="tabsAction">';
 
 if ($action != 'create' && $action != 'edit') {
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index 9592f9548af..b9b355be9f3 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -2119,7 +2119,7 @@ class ExpenseReport extends CommonObject
 
 			$this->line->fk_ecm_files = $fk_ecm_files;
 
-			$this->line->id = $rowid;
+			$this->line->id = ((int) $rowid);
 
 			// Select des infos sur le type fees
 			$sql = "SELECT c.code as code_type_fees, c.label as libelle_type_fees";
@@ -2811,26 +2811,26 @@ class ExpenseReportLine
 		// Update line in database
 		$sql = "UPDATE ".MAIN_DB_PREFIX."expensereport_det SET";
 		$sql .= " comments='".$this->db->escape($this->comments)."'";
-		$sql .= ",value_unit = ".((float) $this->value_unit);
-		$sql .= ",qty=".((float) $this->qty);
-		$sql .= ",date='".$this->db->idate($this->date)."'";
-		$sql .= ",total_ht=".((float) price2num($this->total_ht, 'MT'))."";
-		$sql .= ",total_tva=".((float) price2num($this->total_tva, 'MT'))."";
-		$sql .= ",total_ttc=".((float) price2num($this->total_ttc, 'MT'))."";
-		$sql .= ",tva_tx=".((float) $this->vatrate);
-		$sql .= ",vat_src_code='".$this->db->escape($this->vat_src_code)."'";
-		$sql .= ",rule_warning_message='".$this->db->escape($this->rule_warning_message)."'";
-		$sql .= ",fk_c_exp_tax_cat=".$this->db->escape($this->fk_c_exp_tax_cat);
-		$sql .= ",fk_ecm_files=".($this->fk_ecm_files > 0 ? ((int) $this->fk_ecm_files) : 'null');
+		$sql .= ", value_unit = ".((float) $this->value_unit);
+		$sql .= ", qty=".((float) $this->qty);
+		$sql .= ", date='".$this->db->idate($this->date)."'";
+		$sql .= ", total_ht=".((float) price2num($this->total_ht, 'MT'))."";
+		$sql .= ", total_tva=".((float) price2num($this->total_tva, 'MT'))."";
+		$sql .= ", total_ttc=".((float) price2num($this->total_ttc, 'MT'))."";
+		$sql .= ", tva_tx=".((float) $this->vatrate);
+		$sql .= ", vat_src_code='".$this->db->escape($this->vat_src_code)."'";
+		$sql .= ", rule_warning_message='".$this->db->escape($this->rule_warning_message)."'";
+		$sql .= ", fk_c_exp_tax_cat=".$this->db->escape($this->fk_c_exp_tax_cat);
+		$sql .= ", fk_ecm_files=".($this->fk_ecm_files > 0 ? ((int) $this->fk_ecm_files) : 'null');
 		if ($this->fk_c_type_fees) {
-			$sql .= ",fk_c_type_fees = ".((int) $this->fk_c_type_fees);
+			$sql .= ", fk_c_type_fees = ".((int) $this->fk_c_type_fees);
 		} else {
-			$sql .= ",fk_c_type_fees=null";
+			$sql .= ", fk_c_type_fees=null";
 		}
 		if ($this->fk_project > 0) {
-			$sql .= ",fk_projet=".((int) $this->fk_project);
+			$sql .= ", fk_projet=".((int) $this->fk_project);
 		} else {
-			$sql .= ",fk_projet=null";
+			$sql .= ", fk_projet=null";
 		}
 		$sql .= " WHERE rowid = ".((int) ($this->rowid ? $this->rowid : $this->id));
 
diff --git a/htdocs/expensereport/tpl/expensereport_linktofile.tpl.php b/htdocs/expensereport/tpl/expensereport_linktofile.tpl.php
index 42be03263a8..9264400a71f 100644
--- a/htdocs/expensereport/tpl/expensereport_linktofile.tpl.php
+++ b/htdocs/expensereport/tpl/expensereport_linktofile.tpl.php
@@ -72,7 +72,7 @@ if (empty($conf->global->EXPENSEREPORT_DISABLE_ATTACHMENT_ON_LINES)) {
 						}
 						// If the preview file is found
 						if (file_exists($fileimage)) {
-							$thumbshown = '<img height="'.$heightforphotref.'" class="photo photowithmargin photowithborder" src="'.DOL_URL_ROOT.'/viewimage.php?modulepart=apercu'.$modulepart.'&amp;file='.urlencode($relativepathimage).'">';
+							$thumbshown = '<img height="'.$heightforphotref.'" class="photo photowithmargin photowithborder" src="'.DOL_URL_ROOT.'/viewimage.php?modulepart=apercu'.urlencode($modulepart).'&file='.urlencode($relativepathimage).'">';
 						}
 					}
 				}