diff --git a/src/main/dao/production-order.dao.ts b/src/main/dao/production-order.dao.ts
index c80b0fb..c4e563e 100644
--- a/src/main/dao/production-order.dao.ts
+++ b/src/main/dao/production-order.dao.ts
@@ -8,14 +8,21 @@ export class ProductionOrderDAO {
     try {
       LoggerService.info(`Querying production orders for ${productionIds.length} IDs`);
 
-      const idsString = productionIds.map((id) => `'${id}'`).join(',');
+      // Validate input
+      if (productionIds.length === 0) {
+        LoggerService.warn('No production IDs provided, returning empty array');
+        return [];
+      }
+
+      // Use parameterized query to prevent SQL injection
+      const placeholders = productionIds.map((_, i) => `@param${i}`).join(',');
       const query = `
         SELECT DISTINCT production_order_no
         FROM production_orders
-        WHERE production_id IN (${idsString})
+        WHERE production_id IN (${placeholders})
       `;
 
-      const result = await this.dbService.executeSQLServerQuery(query);
+      const result = await this.dbService.executeSQLServerQuery(query, productionIds);
       const orderNumbers = result.rows.map((row: any) => row.production_order_no);
 
       LoggerService.info(`Found ${orderNumbers.length} production orders`);
@@ -29,12 +36,24 @@ export class ProductionOrderDAO {
   async readProductionIds(filePath: string): Promise<string[]> {
     try {
       const fs = await import('fs/promises');
+
+      // Validate file existence
+      try {
+        await fs.access(filePath, fs.constants.R_OK);
+      } catch {
+        throw new Error(`Production IDs file not found: ${filePath}`);
+      }
+
       const content = await fs.readFile(filePath, 'utf-8');
       const ids = content
         .split('\n')
         .map((line) => line.trim())
         .filter((line) => line.length > 0);
 
+      if (ids.length === 0) {
+        LoggerService.warn('Production IDs file is empty');
+      }
+
       LoggerService.info(`Read ${ids.length} production IDs from file`);
       return ids;
     } catch (error) {