diff --git a/index.php b/index.php
index 76a6e99..3346d47 100644
--- a/index.php
+++ b/index.php
@@ -1471,7 +1471,7 @@ function renderPagination($currentPage, $totalPages) {
     unset($query['p']);
     $url = 'index.php?' . http_build_query($query) . '&p=';
     
-    $limit = isset($_GET['limit']) ? (int)$_GET['limit'] : 20;
+    $limit = isset($_GET['limit']) ? min(500, max(5, (int)$_GET['limit'])) : 20;
     $limitHtml = "
     <div class='d-flex justify-content-end align-items-center mb-2'>
         <label class='me-2 small text-muted' data-en='Rows per page:' data-ar='الصفوف لكل صفحة:'>Rows per page:</label>
@@ -4621,7 +4621,7 @@ if ($oid != -1) {
     }
 }
 
-$limit = isset($_GET["limit"]) ? max(5, (int)$_GET["limit"]) : 20;
+$limit = isset($_GET["limit"]) ? min(500, max(5, (int)$_GET["limit"])) : 20;
 $page_num = isset($_GET["p"]) ? (int)$_GET["p"] : 1;
 if ($page_num < 1) $page_num = 1;
 $offset = ($page_num - 1) * $limit;
@@ -4883,6 +4883,30 @@ switch ($page) {
         break;
     case 'sales':
     case 'purchases':
+        $salesRequestedLimit = isset($_GET['limit']) ? (int)$_GET['limit'] : (isset($limit) ? (int)$limit : 20);
+        $salesSafeLimit = min(500, max(5, $salesRequestedLimit > 0 ? $salesRequestedLimit : 20));
+        if ($salesRequestedLimit !== $salesSafeLimit) {
+            runtime_debug_mark('page:sales_purchases_limit_normalized', [
+                'page' => (string)$page,
+                'requested_limit' => (string)$salesRequestedLimit,
+                'applied_limit' => (string)$salesSafeLimit,
+            ]);
+            if (function_exists('app_debug_file_log')) {
+                app_debug_file_log(
+                    'runtime_debug.log',
+                    date('Y-m-d H:i:s') . " [sales_purchases_limit_normalized] page=" . (string)$page
+                    . " requested_limit=" . (string)$salesRequestedLimit
+                    . " applied_limit=" . (string)$salesSafeLimit
+                );
+            }
+        }
+        $limit = $salesSafeLimit;
+        $page_num = isset($_GET['p']) ? max(1, (int)$_GET['p']) : (isset($page_num) ? max(1, (int)$page_num) : 1);
+        $offset = ($page_num - 1) * $limit;
+        $_GET['limit'] = (string)$limit;
+        $_REQUEST['limit'] = (string)$limit;
+        $_GET['p'] = (string)$page_num;
+        $_REQUEST['p'] = (string)$page_num;
         runtime_debug_require('pages/sales_purchases_logic.php', ['phase' => 'logic', 'page' => (string)$page]);
         break;
 
diff --git a/pages/sales_purchases_logic.php b/pages/sales_purchases_logic.php
index 72b9ab1..a7fdabe 100644
--- a/pages/sales_purchases_logic.php
+++ b/pages/sales_purchases_logic.php
@@ -1,6 +1,7 @@
 <?php
 // Shared Sales/Purchases data loading extracted from index.php to reduce risk when editing this module.
-        $requestedLimit = isset($limit) ? (int)$limit : (isset($_GET['limit']) ? (int)$_GET['limit'] : 20);
+        $incomingLimit = isset($limit) ? $limit : ($_GET['limit'] ?? 20);
+        $requestedLimit = is_numeric($incomingLimit) ? (int)$incomingLimit : 20;
         if ($requestedLimit < 1) {
             if (function_exists('runtime_debug_mark')) {
                 runtime_debug_mark('page:sales_purchases_limit_fallback', [
@@ -19,7 +20,12 @@
             }
         }
         $limit = min(500, max(5, $requestedLimit > 0 ? $requestedLimit : 20));
-        $page_num = isset($page_num) ? max(1, (int)$page_num) : (isset($_GET['p']) ? max(1, (int)$_GET['p']) : 1);
+        $_GET['limit'] = (string)$limit;
+        $_REQUEST['limit'] = (string)$limit;
+        $incomingPageNum = isset($page_num) ? $page_num : ($_GET['p'] ?? 1);
+        $page_num = is_numeric($incomingPageNum) ? max(1, (int)$incomingPageNum) : 1;
+        $_GET['p'] = (string)$page_num;
+        $_REQUEST['p'] = (string)$page_num;
         $offset = ($page_num - 1) * $limit;
 
         $type = ($page === 'sales') ? 'sale' : 'purchase';
@@ -78,7 +84,7 @@
         $countStmt = db()->prepare("SELECT COUNT(*) FROM $table v LEFT JOIN $cust_supplier_table c ON v.$cust_supplier_col = c.id WHERE $whereSql");
         $countStmt->execute($params);
         $total_records = (int)$countStmt->fetchColumn();
-        $data['total_pages'] = ceil($total_records / $limit);
+        $data['total_pages'] = ceil($total_records / max(1, (int)$limit));
         $data['current_page'] = $page_num;
 
         $customerTaxColumn = entity_tax_column($cust_supplier_table);