[fix] stock: potential sql injection vector in wizard/inventory_merge_zero