Security statements update against sql injection attacks.
[fa-stable.git] / admin / db / company_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12
13 function update_company_gl_setup($debtors_act, $pyt_discount_act, $creditors_act,
14                 $freight_act,
15                 $exchange_diff_act,
16                 $default_sales_act,
17                 $default_sales_discount_act,
18                 $default_prompt_payment_act,
19                 $default_inventory_act,
20                 $default_cogs_act,
21                 $default_adj_act,
22                 $default_inv_sales_act,
23                 $default_assembly_act,
24                 $allow_negative_stock,
25                 $po_over_receive,
26                 $po_over_charge,
27                 $accumulate_shipping,
28                 $legal_text,
29                 $past_due_days,
30                 $default_credit_limit,
31                 $default_workorder_required,
32                 $default_dim_required)
33 {
34         $sql = "UPDATE ".TB_PREF."company SET
35                 debtors_act=".db_escape($debtors_act).", pyt_discount_act=".db_escape($pyt_discount_act).",
36                 creditors_act=".db_escape($creditors_act).",
37                 freight_act=".db_escape($freight_act).",
38                 exchange_diff_act=".db_escape($exchange_diff_act).",
39                 default_sales_act=".db_escape($default_sales_act).",
40                 default_sales_discount_act=".db_escape($default_sales_discount_act).",
41                 default_prompt_payment_act=".db_escape($default_prompt_payment_act).",
42                 default_inventory_act=".db_escape($default_inventory_act).",
43                 default_cogs_act=".db_escape($default_cogs_act).",
44                 default_adj_act=".db_escape($default_adj_act).",
45                 default_inv_sales_act=".db_escape($default_inv_sales_act).",
46                 default_assembly_act=".db_escape($default_assembly_act).",
47                 allow_negative_stock=$allow_negative_stock,
48                 po_over_receive=$po_over_receive,
49                 po_over_charge=$po_over_charge,
50                 accumulate_shipping=$accumulate_shipping,
51                 legal_text=".db_escape($legal_text).",
52                 past_due_days=$past_due_days,
53                 default_credit_limit=$default_credit_limit,
54                 default_workorder_required=$default_workorder_required,
55                 default_dim_required=$default_dim_required
56                 WHERE coy_code=1";
57
58         db_query($sql, "The company gl setup could not be updated ");
59 }
60
61 function update_company_setup($coy_name, $coy_no, $gst_no, $tax_prd, $tax_last, $postal_address, $phone, $fax, $email,
62                 $coy_logo, $domicile, $Dimension, $custom1_name, $custom2_name, $custom3_name,
63                 $custom1_value, $custom2_value, $custom3_value, $curr_default, $f_year, $no_item_list, $no_customer_list,
64                 $no_supplier_list, $base_sales)
65 {
66         if ($f_year == null)
67                 $f_year = 0;
68         $sql = "UPDATE ".TB_PREF."company SET coy_name=".db_escape($coy_name).",
69                 coy_no = ".db_escape($coy_no).",
70                 gst_no=".db_escape($gst_no).",
71                 tax_prd=$tax_prd,
72                 tax_last=$tax_last,
73                 postal_address =".db_escape($postal_address).",
74                 phone=".db_escape($phone).", fax=".db_escape($fax).",
75                 email=".db_escape($email).",
76                 coy_logo=".db_escape($coy_logo).",
77                 domicile=".db_escape($domicile).",
78                 use_dimension=$Dimension,
79                 no_item_list=$no_item_list,
80                 no_customer_list=$no_customer_list,
81                 no_supplier_list=$no_supplier_list,
82         custom1_name=".db_escape($custom1_name).",
83         custom2_name=".db_escape($custom2_name).",
84         custom3_name=".db_escape($custom3_name).",
85         custom1_value=".db_escape($custom1_value).",
86         custom2_value=".db_escape($custom2_value).",
87         custom3_value=".db_escape($custom3_value).",
88                 curr_default=".db_escape($curr_default).",
89                 f_year=$f_year,
90                 base_sales=$base_sales
91                 WHERE coy_code=1";
92
93         db_query($sql, "The company setup could not be updated ");
94 }
95
96 function get_company_prefs($tbpref = TB_PREF)
97 {
98         $sql = "SELECT * FROM ".$tbpref."company WHERE coy_code=1";
99         
100         $result = db_query($sql, "The company preferences could not be retrieved");
101
102         if (db_num_rows($result) == 0)
103                 display_db_error("FATAL : Could not find company prefs", $sql);
104
105         return db_fetch($result);
106 }
107
108 function get_company_pref($pref_name, $tbpref = TB_PREF)
109 {
110         $prefs = get_company_prefs($tbpref);
111         return $prefs[$pref_name];
112 }
113
114 // fiscal year routines
115 function add_fiscalyear($from_date, $to_date, $closed)
116 {
117         $from = date2sql($from_date);
118         $to = date2sql($to_date);
119
120         $sql = "INSERT INTO ".TB_PREF."fiscal_year (begin, end, closed)
121                 VALUES (".db_escape($from).",".db_escape($to).", ".db_escape($closed).")";
122
123         db_query($sql, "could not add fiscal year");
124 }
125
126 function update_fiscalyear($id, $closed)
127 {
128         $sql = "UPDATE ".TB_PREF."fiscal_year SET closed=".db_escape($closed)."
129                 WHERE id=".db_escape($id);
130
131         db_query($sql, "could not update fiscal year");
132 }
133
134 function get_all_fiscalyears()
135 {
136         $sql = "SELECT * FROM ".TB_PREF."fiscal_year ORDER BY begin";
137
138         return db_query($sql, "could not get all fiscal years");
139 }
140
141 function get_fiscalyear($id)
142 {
143         $sql = "SELECT * FROM ".TB_PREF."fiscal_year WHERE id=".db_escape($id);
144
145         $result = db_query($sql, "could not get fiscal year");
146
147         return db_fetch($result);
148 }
149
150 function get_current_fiscalyear()
151 {
152         $year = get_company_pref('f_year');
153
154         $sql = "SELECT * FROM ".TB_PREF."fiscal_year WHERE id=".db_escape($year);
155
156         $result = db_query($sql, "could not get current fiscal year");
157
158         return db_fetch($result);
159 }
160
161 function delete_fiscalyear($id)
162 {
163         begin_transaction();
164
165         $sql="DELETE FROM ".TB_PREF."fiscal_year WHERE id=".db_escape($id);
166
167         db_query($sql, "could not delete fiscal year");
168
169         commit_transaction();
170 }
171
172 function get_base_sales_type()
173 {
174         $sql = "SELECT base_sales FROM ".TB_PREF."company WHERE coy_code=1";
175
176         $result = db_query($sql, "could not get base sales type");
177         $myrow = db_fetch($result);
178         return $myrow[0];
179 }
180
181
182 ?>