X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=admin%2Fdb%2Fusers_db.inc;h=5200f2c99933bb0d104270218ff587d7bac652b7;hb=3385ff8d1dd47f62bc068191134bbf9406a8960f;hp=694b49d7afdd006f6a82f9c210cd95d1899b6870;hpb=da8311619dd73feae101d246a1957b972e00cbd2;p=fa-stable.git

diff --git a/admin/db/users_db.inc b/admin/db/users_db.inc
index 694b49d7..5200f2c9 100644
--- a/admin/db/users_db.inc
+++ b/admin/db/users_db.inc
@@ -1,9 +1,24 @@
 <?php
-
-function add_user($user_id, $real_name, $password, $phone, $email, $full_access, $language)
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+	Released under the terms of the GNU General Public License, GPL, 
+	as published by the Free Software Foundation, either version 3 
+	of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+
+function add_user($user_id, $real_name, $password, $phone, $email, $full_access, 
+	$language, $profile, $rep_popup, $pos)
 {
-	$sql = "INSERT INTO ".TB_PREF."users (user_id, real_name, password, phone, email, full_access, language)
-		VALUES ('$user_id', '$real_name', '" . $password ."', '$phone', '$email', $full_access, '$language')";
+	$sql = "INSERT INTO ".TB_PREF."users (user_id, real_name, password"
+		.", phone, email, full_access, language, pos, print_profile, rep_popup)
+		VALUES (".db_escape($user_id).", 
+		".db_escape($real_name).", ".db_escape($password) .",".db_escape($phone).",
+		 ".db_escape($email).", $full_access, ".db_escape($language).",
+		 $pos,".db_escape($profile).",$rep_popup)";
 
 	db_query($sql, "could not add user for $user_id");
 }
@@ -12,44 +27,56 @@ function add_user($user_id, $real_name, $password, $phone, $email, $full_access,
 
 function update_user_password($user_id, $password)
 {
-	$sql = "UPDATE ".TB_PREF."users SET password='" . $password . "'
-		WHERE user_id = '$user_id'";
+	$sql = "UPDATE ".TB_PREF."users SET password=".db_escape($password) . "
+		WHERE user_id = ".db_escape($user_id);
 
 	db_query($sql, "could not update user password for $user_id");
 }
 
 //-----------------------------------------------------------------------------------------------
 
-function update_user($user_id, $real_name, $phone, $email, $full_access, $language)
+function update_user($user_id, $real_name, $phone, $email, $full_access, 
+	$language, $profile, $rep_popup, $pos)
 {
-	$sql = "UPDATE ".TB_PREF."users SET real_name='$real_name', phone='$phone',
-		email='$email',
+	$sql = "UPDATE ".TB_PREF."users SET real_name=".db_escape($real_name).
+	", phone=".db_escape($phone).",
+		email=".db_escape($email).",
 		full_access=$full_access,
-		language='$language'
-		WHERE user_id = '$user_id'";
-
+		language=".db_escape($language).",
+		print_profile=".db_escape($profile).",
+		rep_popup=$rep_popup,
+		pos=$pos
+		WHERE user_id = ".db_escape($user_id);
 	db_query($sql, "could not update user for $user_id");
 }
 
 //-----------------------------------------------------------------------------------------------
 
-function update_user_display_prefs($user_id, $price_dec, $qty_dec, $exrate_dec, $percent_dec, $showgl,
-	$showcodes, $date_format, $date_sep, $tho_sep, $dec_sep, $theme, $pagesize)
+function update_user_display_prefs($user_id, $price_dec, $qty_dec, $exrate_dec, 
+	$percent_dec, $showgl, $showcodes, $date_format, $date_sep, $tho_sep, 
+	$dec_sep, $theme, $pagesize, $show_hints, $profile, $rep_popup, $query_size, 
+	$graphic_links,	$lang)
 {
 	$sql = "UPDATE ".TB_PREF."users SET
-		prices_dec=$price_dec,
-		qty_dec=$qty_dec,
-		rates_dec=$exrate_dec,
-		percent_dec=$percent_dec,
-		show_gl=$showgl,
-		show_codes=$showcodes,
-		date_format=$date_format,
-		date_sep=$date_sep,
-		tho_sep=$tho_sep,
-		dec_sep=$dec_sep,
-		theme='$theme',
-		page_size='$pagesize'
-		WHERE user_id = '$user_id'";
+		prices_dec=".db_escape($price_dec).",
+		qty_dec=".db_escape($qty_dec).",
+		rates_dec=".db_escape($exrate_dec).",
+		percent_dec=".db_escape($percent_dec).",
+		show_gl=".db_escape($showgl).",
+		show_codes=".db_escape($showcodes).",
+		date_format=".db_escape($date_format).",
+		date_sep=".db_escape($date_sep).",
+		tho_sep=".db_escape($tho_sep).",
+		dec_sep=".db_escape($dec_sep).",
+		theme=".db_escape($theme).",
+		page_size=".db_escape($pagesize).",
+		show_hints=$show_hints,
+		print_profile=".db_escape($profile).",
+		rep_popup=$rep_popup,
+		query_size=$query_size,
+		graphic_links=$graphic_links,
+		language=".db_escape($lang)."
+		WHERE user_id = ".db_escape($user_id);
 
 	db_query($sql, "could not update user display prefs for $user_id");
 }
@@ -100,7 +127,7 @@ function get_user_for_login($user_id, $password)
 function update_user_visitdate($user_id)
 {
 	$sql = "UPDATE ".TB_PREF."users SET last_visit_date='". date("Y-m-d H:i:s") ."'
-		WHERE user_id='$user_id'";
+		WHERE user_id=".db_escape($user_id);
 
 	db_query($sql, "could not update last visit date for user $user_id");
 }