Admin and dimensions modules sealed against XSS atacks
[fa-stable.git] / admin / db / users_db.inc
1 <?php
2
3 function add_user($user_id, $real_name, $password, $phone, $email, $full_access, $language)
4 {
5         $sql = "INSERT INTO ".TB_PREF."users (user_id, real_name, password, phone, email, full_access, language)
6                 VALUES (".db_escape($user_id).", 
7                 ".db_escape($real_name).", ".db_escape($password) .",".db_escape($phone).",
8                  ".db_escape($email).", $full_access, ".db_escape($language).")";
9
10         db_query($sql, "could not add user for $user_id");
11 }
12
13 //-----------------------------------------------------------------------------------------------
14
15 function update_user_password($user_id, $password)
16 {
17         $sql = "UPDATE ".TB_PREF."users SET password=".db_escape($password) . "
18                 WHERE user_id = ".db_escape($user_id);
19
20         db_query($sql, "could not update user password for $user_id");
21 }
22
23 //-----------------------------------------------------------------------------------------------
24
25 function update_user($user_id, $real_name, $phone, $email, $full_access, $language)
26 {
27         $sql = "UPDATE ".TB_PREF."users SET real_name=".db_escape($real_name).
28         ", phone=".db_escape($phone).",
29                 email=".db_escape($email).",
30                 full_access=$full_access,
31                 language=".db_escape($language)."
32                 WHERE user_id = ".db_escape($user_id);
33
34         db_query($sql, "could not update user for $user_id");
35 }
36
37 //-----------------------------------------------------------------------------------------------
38
39 function update_user_display_prefs($user_id, $price_dec, $qty_dec, $exrate_dec, $percent_dec, $showgl,
40         $showcodes, $date_format, $date_sep, $tho_sep, $dec_sep, $theme, $pagesize)
41 {
42         $sql = "UPDATE ".TB_PREF."users SET
43                 prices_dec=".db_escape($price_dec).",
44                 qty_dec=".db_escape($qty_dec).",
45                 rates_dec=".db_escape($exrate_dec).",
46                 percent_dec=".db_escape($percent_dec).",
47                 show_gl=".db_escape($showgl).",
48                 show_codes=".db_escape($showcodes).",
49                 date_format=".db_escape($date_format).",
50                 date_sep=".db_escape($date_sep).",
51                 tho_sep=".db_escape($tho_sep).",
52                 dec_sep=".db_escape($dec_sep).",
53                 theme=".db_escape($theme).",
54                 page_size=".db_escape($pagesize)."
55                 WHERE user_id = ".db_escape($user_id);
56
57         db_query($sql, "could not update user display prefs for $user_id");
58 }
59
60 //-----------------------------------------------------------------------------------------------
61
62
63 function get_users()
64 {
65         $sql = "SELECT * FROM ".TB_PREF."users";
66
67         return db_query($sql, "could not get users");
68 }
69
70 //-----------------------------------------------------------------------------------------------
71
72 function get_user($user_id)
73 {
74         $sql = "SELECT * FROM ".TB_PREF."users WHERE user_id = '$user_id'";
75
76         $result = db_query($sql, "could not get user for $user_id");
77
78         return db_fetch($result);
79 }
80
81 //-----------------------------------------------------------------------------------------------
82
83 function delete_user($user_id)
84 {
85         $sql="DELETE FROM ".TB_PREF."users WHERE user_id='$user_id'";
86
87         db_query($sql, "could not delete user $user_id");
88 }
89
90 //-----------------------------------------------------------------------------------------------
91
92 function get_user_for_login($user_id, $password)
93 {
94         set_global_connection();
95
96         $sql = "SELECT * FROM ".TB_PREF."users WHERE user_id = '$user_id' AND password='$password'";
97
98         return db_query($sql, "could not get validate user login for $user_id");
99 }
100
101 //-----------------------------------------------------------------------------------------------
102
103 function update_user_visitdate($user_id)
104 {
105         $sql = "UPDATE ".TB_PREF."users SET last_visit_date='". date("Y-m-d H:i:s") ."'
106                 WHERE user_id=".db_escape($user_id);
107
108         db_query($sql, "could not update last visit date for user $user_id");
109 }
110
111 //-----------------------------------------------------------------------------------------------
112
113 ?>