diff --git a/addons/account/account.py b/addons/account/account.py
index ca5584a2c20..0abdd2af7e0 100644
--- a/addons/account/account.py
+++ b/addons/account/account.py
@@ -1144,6 +1144,7 @@ class account_move(osv.osv):
         return amount
 
     def _centralise(self, cr, uid, move, mode, context=None):
+        assert(mode in ('debit', 'credit'), 'Invalid Mode') #to prevent sql injection
         if context is None:
             context = {}
 
@@ -1191,10 +1192,7 @@ class account_move(osv.osv):
         else:
             line_id2 = 0
 
-        cr.execute('SELECT SUM('+mode+') '\
-                   'FROM account_move_line '\
-                   'WHERE move_id=%s AND id<>%s',
-                   (move.id, line_id2))
+        cr.execute('SELECT SUM(%s) FROM account_move_line WHERE move_id=%%s AND id!=%%s' % (mode,), (move.id, line_id2))
         result = cr.fetchone()[0] or 0.0
         cr.execute('update account_move_line set '+mode2+'=%s where id=%s', (result, line_id))
         return True