Additional security fixes in sql statements.
[fa-stable.git] / includes / db / inventory_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 function get_qoh_on_date($stock_id, $location=null, $date_=null, $exclude=0)
13 {
14         if ($date_ == null)
15                 $date_ = Today();
16
17         $date = date2sql($date_);
18
19         $sql = "SELECT SUM(qty) FROM ".TB_PREF."stock_moves
20                 WHERE stock_id=".db_escape($stock_id)."
21                 AND tran_date <= '$date'";
22
23         if ($location != null)
24                 $sql .= " AND loc_code = ".db_escape($location);
25
26         $result = db_query($sql, "QOH calulcation failed");
27
28         $myrow = db_fetch_row($result);
29         if ($exclude > 0)
30         {
31                 $sql = "SELECT SUM(qty) FROM ".TB_PREF."stock_moves
32                         WHERE stock_id=".db_escape($stock_id)
33                         ." AND type=".db_escape($exclude)
34                         ." AND tran_date = '$date'";
35
36                 $result = db_query($sql, "QOH calulcation failed");
37                 $myrow2 = db_fetch_row($result);
38                 if ($myrow2 !== false)
39                         $myrow[0] -= $myrow2[0];
40         }
41
42         return $myrow[0];
43 }
44
45 //--------------------------------------------------------------------------------------
46
47 function get_item_edit_info($stock_id)
48 {
49         $sql = "SELECT material_cost + labour_cost + overhead_cost AS standard_cost, units, decimals
50                 FROM ".TB_PREF."stock_master,".TB_PREF."item_units
51                 WHERE stock_id=".db_escape($stock_id)
52                 ." AND ".TB_PREF."stock_master.units=".TB_PREF."item_units.abbr";
53         $result = db_query($sql, "The standard cost cannot be retrieved");
54
55         return db_fetch($result);
56 }
57
58 //--------------------------------------------------------------------------------------
59
60 function get_standard_cost($stock_id)
61 {
62         $sql = "SELECT material_cost + labour_cost + overhead_cost AS std_cost
63                 FROM ".TB_PREF."stock_master WHERE stock_id=".db_escape($stock_id);
64         $result = db_query($sql, "The standard cost cannot be retrieved");
65
66         $myrow = db_fetch_row($result);
67
68         return $myrow[0];
69 }
70
71 //--------------------------------------------------------------------------------------
72
73 function is_inventory_item($stock_id)
74 {
75         $sql = "SELECT stock_id FROM ".TB_PREF."stock_master
76                 WHERE stock_id=".db_escape($stock_id)." AND mb_flag <> 'D'";
77         $result = db_query($sql, "Cannot query is inventory item or not");
78
79         return db_num_rows($result) > 0;
80 }
81
82 //-------------------------------------------------------------------
83
84 Function get_stock_gl_code($stock_id)
85 {
86         /*Gets the GL Codes relevant to the item account  */
87
88         $sql = "SELECT inventory_account, cogs_account,
89                 adjustment_account, sales_account, assembly_account, dimension_id, dimension2_id FROM
90                 ".TB_PREF."stock_master WHERE stock_id = ".db_escape($stock_id);
91
92         $get = db_query($sql,"retreive stock gl code");
93         return db_fetch($get);
94 }
95
96 //--------------------------------------------------------------------------------------
97
98 // $date_ - display / non-sql date
99 // $std_cost - in HOME currency
100 // $show_or_hide - wil this move be visible in reports, etc
101 // $price - in $person_id's currency
102
103 function add_stock_move($type, $stock_id, $trans_no, $location,
104     $date_, $reference, $quantity, $std_cost, $person_id=0, $show_or_hide=1,
105     $price=0, $discount_percent=0, $error_msg="")
106 {
107         // do not add a stock move if it's a non-inventory item
108         if (!is_inventory_item($stock_id))
109                 return null;
110
111         $date = date2sql($date_);
112
113         $sql = "INSERT INTO ".TB_PREF."stock_moves (stock_id, trans_no, type, loc_code,
114                 tran_date, person_id, reference, qty, standard_cost, visible, price,
115                 discount_percent) VALUES (".db_escape($stock_id)
116                 .", ".db_escape($trans_no).", ".db_escape($type)
117                 .",     ".db_escape($location).", '$date', "
118                 .db_escape($person_id).", ".db_escape($reference).", "
119                 .db_escape($quantity).", ".db_escape($std_cost).","
120                 .db_escape($show_or_hide).", ".db_escape($price).", "
121                 .db_escape($discount_percent).")";
122
123         if ($error_msg == "")
124                 $error_msg = "The stock movement record cannot be inserted";
125
126         db_query($sql, $error_msg);
127
128         return db_insert_id();
129 }
130
131 function update_stock_move_pid($type, $stock_id, $from, $to, $pid, $cost)
132 {
133         $from = date2sql($from);
134         $to = date2sql($to);
135                 $sql = "UPDATE ".TB_PREF."stock_moves SET standard_cost=".db_escape($cost)
136                         ." WHERE type=".db_escape($type)
137                         ."      AND stock_id=".db_escape($stock_id)
138                         ."  AND tran_date>='$from' AND tran_date<='$to' 
139                         AND person_id = ".db_escape($pid);
140         db_query($sql, "The stock movement standard_cost cannot be updated");
141 }
142
143 //--------------------------------------------------------------------------------------------------
144
145 function get_stock_moves($type, $type_no, $visible=false)
146 {
147         $sql = "SELECT ".TB_PREF."stock_moves.*, ".TB_PREF."stock_master.description, "
148                 .TB_PREF."stock_master.units,".TB_PREF."locations.location_name,"
149                 .TB_PREF."stock_master.material_cost + "
150                         .TB_PREF."stock_master.labour_cost + "
151                         .TB_PREF."stock_master.overhead_cost AS FixedStandardCost
152                 FROM ".TB_PREF."stock_moves,".TB_PREF."locations,".TB_PREF."stock_master
153                 WHERE ".TB_PREF."stock_moves.stock_id = ".TB_PREF."stock_master.stock_id
154                 AND ".TB_PREF."locations.loc_code=".TB_PREF."stock_moves.loc_code
155                 AND type=".db_escape($type)." AND trans_no=".db_escape($type_no)." ORDER BY trans_id";
156         if ($visible)
157                 $sql .= " AND ".TB_PREF."stock_moves.visible=1";
158
159         return db_query($sql, "Could not get stock moves");
160 }
161
162 //--------------------------------------------------------------------------------------------------
163
164 function void_stock_move($type, $type_no)
165 {
166         $sql = "UPDATE ".TB_PREF."stock_moves SET qty=0, price=0, discount_percent=0,
167                 standard_cost=0 WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no);
168
169         db_query($sql, "Could not void stock moves");
170 }
171
172 //--------------------------------------------------------------------------------------------------
173
174 function get_location_name($loc_code)
175 {
176         $sql = "SELECT location_name FROM ".TB_PREF."locations WHERE loc_code="
177                 .db_escape($loc_code);
178
179         $result = db_query($sql, "could not retreive the location name for $loc_code");
180
181         if (db_num_rows($result) == 1)
182         {
183                 $row = db_fetch_row($result);
184                 return $row[0];
185         }
186
187         display_db_error("could not retreive the location name for $loc_code", $sql, true);
188 }
189
190 //--------------------------------------------------------------------------------------------------
191
192
193 ?>