[FIX] add postgresql version to travis + avoid sql injection

.travis.yml

@@ -4,9 +4,13 @@ python:
   - "2.7"
 
 sudo: false
-cache: pip
+cache:
+  apt: true
+  directories:
+    - $HOME/.pip-cache/
 
 addons:
+  postgresql: "9.6"
   apt:
     packages:
       - expect-dev  # provides unbuffer utility
@@ -28,12 +32,12 @@ virtualenv:
   system_site_packages: true
 
 install:
-  - git clone --depth=1 https://github.com/OCA/maintainer-quality-tools.git ${HOME}/maintainer-quality-tools
+  - git clone --depth=1 https://github.com/avanzosc/maintainer-quality-tools.git ${HOME}/maintainer-quality-tools
   - export PATH=${HOME}/maintainer-quality-tools/travis:${PATH}
   - travis_install_nightly
 
 script:
-  - travis_wait travis_run_tests
+  - travis_run_tests
 
 after_success:
   - travis_after_tests_success

analytic_production_cost_report/report/analytic_production_cost_report.py

@@ -67,5 +67,12 @@ def _group_by(self):
 
     def init(self, cr):
         tools.drop_view_if_exists(cr, self._table)
-        cr.execute("""CREATE or REPLACE VIEW %s as (%s %s %s)
-        """ % (self._table, self._select(), self._from(), self._group_by()))
+        cr.execute(
+            """CREATE or REPLACE VIEW %(table)s AS
+               (%(select)s %(from)s %(group_by)s)""",
+               {
+                   'table': AsIs(self._table)),
+                   'select': AsIs(self._select()),
+                   'from': AsIs(self._from()),
+                   'group_by': AsIs(self._group_by()),
+               }