Security sql statements update against sql injection attacks.
[fa-stable.git] / taxes / tax_types.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security = 3;
13 $path_to_root="..";
14
15 include($path_to_root . "/includes/session.inc");
16 page(_("Tax Types"));
17
18 include_once($path_to_root . "/includes/ui.inc");
19 include_once($path_to_root . "/taxes/db/tax_types_db.inc");
20
21 simple_page_mode(true);
22 //-----------------------------------------------------------------------------------
23
24 function can_process()
25 {
26         global $selected_id;
27         
28         if (strlen($_POST['name']) == 0)
29         {
30                 display_error(_("The tax type name cannot be empty."));
31                 set_focus('name');
32                 return false;
33         }
34         elseif (!check_num('rate', 0))
35         {
36                 display_error( _("The default tax rate must be numeric and not less than zero."));
37                 set_focus('rate');
38                 return false;
39         }
40
41         if (!is_tax_gl_unique(get_post('sales_gl_code', 'purchasing_gl_code', $selected_id))) {
42                 display_error( _("Selected GL Accounts cannot be used by another tax type."));
43                 set_focus('sales_gl_code');
44                 return false;
45         }
46         return true;
47 }
48
49 //-----------------------------------------------------------------------------------
50
51 if ($Mode=='ADD_ITEM' && can_process())
52 {
53
54         add_tax_type($_POST['name'], $_POST['sales_gl_code'],
55                 $_POST['purchasing_gl_code'], input_num('rate', 0));
56         display_notification(_('New tax type has been added'));
57         $Mode = 'RESET';
58 }
59
60 //-----------------------------------------------------------------------------------
61
62 if ($Mode=='UPDATE_ITEM' && can_process())
63 {
64
65         update_tax_type($selected_id, $_POST['name'],
66         $_POST['sales_gl_code'], $_POST['purchasing_gl_code'], input_num('rate'));
67         display_notification(_('Selected tax type has been updated'));
68         $Mode = 'RESET';
69 }
70
71 //-----------------------------------------------------------------------------------
72
73 function can_delete($selected_id)
74 {
75         $sql= "SELECT COUNT(*) FROM ".TB_PREF."tax_group_items  WHERE tax_type_id=".db_escape($selected_id);
76         $result = db_query($sql, "could not query tax groups");
77         $myrow = db_fetch_row($result);
78         if ($myrow[0] > 0)
79         {
80                 display_error(_("Cannot delete this tax type because tax groups been created referring to it."));
81
82                 return false;
83         }
84
85         return true;
86 }
87
88
89 //-----------------------------------------------------------------------------------
90
91 if ($Mode == 'Delete')
92 {
93
94         if (can_delete($selected_id))
95         {
96                 delete_tax_type($selected_id);
97                 display_notification(_('Selected tax type has been deleted'));
98         }
99         $Mode = 'RESET';
100 }
101
102 if ($Mode == 'RESET')
103 {
104         $selected_id = -1;
105         unset($_POST);
106 }
107 //-----------------------------------------------------------------------------------
108
109 $result = get_all_tax_types();
110
111 start_form();
112
113 display_note(_("To avoid problems with manual journal entry all tax types should have unique Sales/Purchasing GL accounts."));
114 start_table($table_style);
115
116 $th = array(_("Description"), _("Default Rate (%)"),
117         _("Sales GL Account"), _("Purchasing GL Account"), "", "");
118 table_header($th);
119
120 $k = 0;
121 while ($myrow = db_fetch($result))
122 {
123
124         alt_table_row_color($k);
125
126         label_cell($myrow["name"]);
127         label_cell(percent_format($myrow["rate"]), "align=right");
128         label_cell($myrow["sales_gl_code"] . "&nbsp;" . $myrow["SalesAccountName"]);
129         label_cell($myrow["purchasing_gl_code"] . "&nbsp;" . $myrow["PurchasingAccountName"]);
130
131         edit_button_cell("Edit".$myrow["id"], _("Edit"));
132         delete_button_cell("Delete".$myrow["id"], _("Delete"));
133
134         end_row();
135 }
136
137 end_table();
138
139 end_form();
140 echo '<br>';
141
142 //-----------------------------------------------------------------------------------
143
144 start_form();
145
146 start_table($table_style2);
147
148 if ($selected_id != -1) 
149 {
150         if ($Mode == 'Edit') {
151                 //editing an existing status code
152
153                 $myrow = get_tax_type($selected_id);
154
155                 $_POST['name']  = $myrow["name"];
156                 $_POST['rate']  = percent_format($myrow["rate"]);
157                 $_POST['sales_gl_code']  = $myrow["sales_gl_code"];
158                 $_POST['purchasing_gl_code']  = $myrow["purchasing_gl_code"];
159         }
160         hidden('selected_id', $selected_id);
161 }
162 text_row_ex(_("Description:"), 'name', 50);
163 small_amount_row(_("Default Rate:"), 'rate', '', "", "%", user_percent_dec());
164
165 gl_all_accounts_list_row(_("Sales GL Account:"), 'sales_gl_code', null);
166 gl_all_accounts_list_row(_("Purchasing GL Account:"), 'purchasing_gl_code', null);
167
168 end_table(1);
169
170 submit_add_or_update_center($selected_id == -1, '', true);
171
172 end_form();
173
174 end_page();
175
176 ?>