Security statements update against sql injection attacks.
[fa-stable.git] / inventory / includes / db / items_locations_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 function add_item_location($loc_code, $location_name, $delivery_address, $phone, $fax, $email, $contact)
13 {
14         $sql = "INSERT INTO ".TB_PREF."locations (loc_code, location_name, delivery_address, phone, fax, email, contact)
15                 VALUES (".db_escape($loc_code).", ".db_escape($location_name)
16                 .", ".db_escape($delivery_address).", ".db_escape($phone)
17                 .", ".db_escape($fax).", ".db_escape($email).", ".db_escape($contact).")";
18         db_query($sql,"a location could not be added");
19
20         /* Also need to add loc_stock records for all existing items */
21         $sql = "INSERT INTO ".TB_PREF."loc_stock (loc_code, stock_id, reorder_level)
22                 SELECT ".db_escape($loc_code).", ".TB_PREF."stock_master.stock_id, 0 FROM ".TB_PREF."stock_master";
23
24         db_query($sql,"a location could not be added");
25 }
26
27 //------------------------------------------------------------------------------------
28
29 function update_item_location($loc_code, $location_name, $delivery_address, $phone, $fax, $email, $contact)
30
31 {
32     $sql = "UPDATE ".TB_PREF."locations SET location_name=".db_escape($location_name).",
33         delivery_address=".db_escape($delivery_address).",
34         phone=".db_escape($phone).", fax=".db_escape($fax).",
35         email=".db_escape($email).", contact=".db_escape($contact)."
36         WHERE loc_code = ".db_escape($loc_code);
37
38         db_query($sql,"a location could not be updated");
39 }
40
41 //------------------------------------------------------------------------------------
42
43 function delete_item_location($item_location)
44 {
45         $sql="DELETE FROM ".TB_PREF."locations WHERE loc_code=".db_escape($item_location);
46         db_query($sql,"a location could not be deleted");
47
48         $sql = "DELETE FROM ".TB_PREF."loc_stock WHERE loc_code =".db_escape($item_location);
49         db_query($sql,"a location could not be deleted");
50 }
51
52 //------------------------------------------------------------------------------------
53
54 function get_item_location($item_location)
55 {
56         $sql="SELECT * FROM ".TB_PREF."locations WHERE loc_code=".db_escape($item_location);
57
58         $result = db_query($sql,"a location could not be retrieved");
59
60         return db_fetch($result);
61 }
62
63 //------------------------------------------------------------------------------------
64
65 function set_reorder_level($stock_id, $loc_code, $reorder_level)
66 {
67         $sql = "UPDATE ".TB_PREF."loc_stock SET reorder_level = $reorder_level
68                 WHERE stock_id = ".db_escape($stock_id)." AND loc_code = ".db_escape($loc_code);
69
70         db_query($sql,"an item reorder could not be set");
71 }
72
73 //------------------------------------------------------------------------------------
74
75 function get_loc_details($stock_id)
76 {
77         $sql = "SELECT ".TB_PREF."loc_stock.*, ".TB_PREF."locations.location_name
78                 FROM ".TB_PREF."loc_stock, ".TB_PREF."locations
79                 WHERE ".TB_PREF."loc_stock.loc_code=".TB_PREF."locations.loc_code
80                 AND ".TB_PREF."loc_stock.stock_id = ".db_escape($stock_id) 
81                 ." ORDER BY ".TB_PREF."loc_stock.loc_code";
82         return db_query($sql,"an item reorder could not be retreived");
83 }
84
85 //------------------------------------------------------------------------------------
86
87 ?>