Security statements update against sql injection attacks.
[fa-stable.git] / admin / shipping_companies.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security = 14;
13 $path_to_root="..";
14 include($path_to_root . "/includes/session.inc");
15 page(_("Shipping Company"));
16 include($path_to_root . "/includes/ui.inc");
17
18 simple_page_mode(true);
19 //----------------------------------------------------------------------------------------------
20
21 function can_process() 
22 {
23         if (strlen($_POST['shipper_name']) == 0) 
24         {
25                 display_error(_("The shipping company name cannot be empty."));
26                 set_focus('shipper_name');
27                 return false;
28         }
29         return true;
30 }
31
32 //----------------------------------------------------------------------------------------------
33 if ($Mode=='ADD_ITEM' && can_process()) 
34 {
35
36         $sql = "INSERT INTO ".TB_PREF."shippers (shipper_name, contact, phone, address)
37                 VALUES (" . db_escape($_POST['shipper_name']) . ", " .
38                 db_escape($_POST['contact']). ", " .
39                 db_escape($_POST['phone']). ", " .
40                 db_escape($_POST['address']) . ")";
41
42         db_query($sql,"The Shipping Company could not be added");
43         display_notification(_('New shipping company has been added'));
44         $Mode = 'RESET';
45 }
46
47 //----------------------------------------------------------------------------------------------
48
49 if ($Mode=='UPDATE_ITEM' && can_process()) 
50 {
51
52         $sql = "UPDATE ".TB_PREF."shippers SET shipper_name=" . db_escape($_POST['shipper_name']). " ,
53                 contact =" . db_escape($_POST['contact']). " ,
54                 phone =" . db_escape($_POST['phone']). " ,
55                 address =" . db_escape($_POST['address']). "
56                 WHERE shipper_id = ".db_escape($selected_id);
57
58         db_query($sql,"The shipping company could not be updated");
59         display_notification(_('Selected shipping company has been updated'));
60         $Mode = 'RESET';
61 }
62
63 //----------------------------------------------------------------------------------------------
64
65 if ($Mode == 'Delete')
66 {
67 // PREVENT DELETES IF DEPENDENT RECORDS IN 'sales_orders'
68
69         $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE ship_via=".db_escape($selected_id);
70         $result = db_query($sql,"check failed");
71         $myrow = db_fetch_row($result);
72         if ($myrow[0] > 0) 
73         {
74                 $cancel_delete = 1;
75                 display_error(_("Cannot delete this shipping company because sales orders have been created using this shipper."));
76         } 
77         else 
78         {
79                 // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans'
80
81                 $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE ship_via=".db_escape($selected_id);
82                 $result = db_query($sql,"check failed");
83                 $myrow = db_fetch_row($result);
84                 if ($myrow[0] > 0) 
85                 {
86                         $cancel_delete = 1;
87                         display_error(_("Cannot delete this shipping company because invoices have been created using this shipping company."));
88                 } 
89                 else 
90                 {
91                         $sql="DELETE FROM ".TB_PREF."shippers WHERE shipper_id=".db_escape($selected_id);
92                         db_query($sql,"could not delete shipper");
93                         display_notification(_('Selected shipping company has been deleted'));
94                 }
95         }
96         $Mode = 'RESET';
97 }
98
99 if ($Mode == 'RESET')
100 {
101         $selected_id = -1;
102         unset($_POST);
103 }
104 //----------------------------------------------------------------------------------------------
105
106 $sql = "SELECT * FROM ".TB_PREF."shippers ORDER BY shipper_id";
107 $result = db_query($sql,"could not get shippers");
108
109 start_form();
110 start_table($table_style);
111 $th = array(_("Name"), _("Contact Person"), _("Phone Number"), _("Address"), "", "");
112 table_header($th);
113
114 $k = 0; //row colour counter
115
116 while ($myrow = db_fetch($result)) 
117 {
118         alt_table_row_color($k);
119         label_cell($myrow["shipper_name"]);
120         label_cell($myrow["contact"]);
121         label_cell($myrow["phone"]);
122         label_cell($myrow["address"]);
123         edit_button_cell("Edit".$myrow[0], _("Edit"));
124         delete_button_cell("Delete".$myrow[0], _("Delete"));
125         end_row();
126 }
127
128 end_table();
129 end_form();
130 echo '<br>';
131
132 //----------------------------------------------------------------------------------------------
133
134 start_form();
135
136 start_table($table_style2);
137
138 if ($selected_id != -1) 
139 {
140         if ($Mode == 'Edit') {
141                 //editing an existing Shipper
142
143                 $sql = "SELECT * FROM ".TB_PREF."shippers WHERE shipper_id=".db_escape($selected_id);
144
145                 $result = db_query($sql, "could not get shipper");
146                 $myrow = db_fetch($result);
147
148                 $_POST['shipper_name']  = $myrow["shipper_name"];
149                 $_POST['contact']       = $myrow["contact"];
150                 $_POST['phone'] = $myrow["phone"];
151                 $_POST['address'] = $myrow["address"];
152         }
153         hidden('selected_id', $selected_id);
154 }
155
156 text_row_ex(_("Name:"), 'shipper_name', 40);
157
158 text_row_ex(_("Contact Person:"), 'contact', 30);
159
160 text_row_ex(_("Phone Number:"), 'phone', 20);
161
162 text_row_ex(_("Address:"), 'address', 50);
163
164 end_table(1);
165
166 submit_add_or_update_center($selected_id == -1, '', true);
167
168 end_form();
169 end_page();
170 ?>