Admin and dimensions modules sealed against XSS atacks
[fa-stable.git] / admin / shipping_companies.php
1 <?php
2
3
4 $page_security = 14;
5 $path_to_root="..";
6 include($path_to_root . "/includes/session.inc");
7 page(_("Shipping Company"));
8 include($path_to_root . "/includes/ui.inc");
9
10
11 if (isset($_GET['selected_id']))
12 {
13         $selected_id = $_GET['selected_id'];
14
15 else if (isset($_POST['selected_id']))
16 {
17         $selected_id = $_POST['selected_id'];
18 }
19
20 //----------------------------------------------------------------------------------------------
21
22 function can_process() 
23 {
24         if (strlen($_POST['shipper_name']) == 0) 
25         {
26                 display_error(_("The shipping company name cannot be empty."));
27                 set_focus('shipper_name');
28                 return false;
29         }
30         return true;
31 }
32
33 //----------------------------------------------------------------------------------------------
34
35 if (isset($_POST['ADD_ITEM']) && can_process()) 
36 {
37
38         $sql = "INSERT INTO ".TB_PREF."shippers (shipper_name, contact, phone, address)
39                 VALUES (" . db_escape($_POST['shipper_name']) . ", " .
40                 db_escape($_POST['contact']). ", " .
41                 db_escape($_POST['phone']). ", " .
42                 db_escape($_POST['address']) . ")";
43
44         db_query($sql,"The Shipping Company could not be added");
45         meta_forward($_SERVER['PHP_SELF']);
46 }
47
48 //----------------------------------------------------------------------------------------------
49
50 if (isset($_POST['UPDATE_ITEM']) && can_process()) 
51 {
52
53         $sql = "UPDATE ".TB_PREF."shippers SET shipper_name=" . db_escape($_POST['shipper_name']). " ,
54                 contact =" . db_escape($_POST['contact']). " ,
55                 phone =" . db_escape($_POST['phone']). " ,
56                 address =" . db_escape($_POST['address']). "
57                 WHERE shipper_id = $selected_id";
58
59         db_query($sql,"The shipping company could not be updated");
60         meta_forward($_SERVER['PHP_SELF']);
61 }
62
63 //----------------------------------------------------------------------------------------------
64
65 if (isset($_GET['delete']))
66 {
67 // PREVENT DELETES IF DEPENDENT RECORDS IN 'sales_orders'
68
69         $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE ship_via='$selected_id'";
70         $result = db_query($sql,"check failed");
71         $myrow = db_fetch_row($result);
72         if ($myrow[0] > 0) 
73         {
74                 $cancel_delete = 1;
75                 display_error(_("Cannot delete this shipping company because sales orders have been created using this shipper."));
76         } 
77         else 
78         {
79                 // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans'
80
81                 $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE ship_via='$selected_id'";
82                 $result = db_query($sql,"check failed");
83                 $myrow = db_fetch_row($result);
84                 if ($myrow[0] > 0) 
85                 {
86                         $cancel_delete = 1;
87                         display_error(_("Cannot delete this shipping company because invoices have been created using this shipping company."));
88                 } 
89                 else 
90                 {
91                         $sql="DELETE FROM ".TB_PREF."shippers WHERE shipper_id=$selected_id";
92                         db_query($sql,"could not delete shipper");
93
94                         meta_forward($_SERVER['PHP_SELF']);
95                 }
96         }
97 }
98
99 //----------------------------------------------------------------------------------------------
100
101 $sql = "SELECT * FROM ".TB_PREF."shippers ORDER BY shipper_id";
102 $result = db_query($sql,"could not get shippers");
103
104 start_table($table_style);
105 $th = array(_("Name"), _("Contact Person"), _("Phone Number"), _("Address"), "", "");
106 table_header($th);
107
108 $k = 0; //row colour counter
109
110 while ($myrow = db_fetch($result)) 
111 {
112         alt_table_row_color($k);
113         label_cell($myrow["shipper_name"]);
114         label_cell($myrow["contact"]);
115         label_cell($myrow["phone"]);
116         label_cell($myrow["address"]);
117     edit_link_cell("selected_id=".$myrow[0]);
118     delete_link_cell("selected_id=".$myrow[0]."&delete=1");
119         end_row();
120 }
121
122 end_table();
123
124 //----------------------------------------------------------------------------------------------
125
126 hyperlink_no_params($_SERVER['PHP_SELF'], _("New Shipping Company"));
127
128 start_form();
129
130 start_table($table_style2);
131
132 if (isset($selected_id)) 
133 {
134         //editing an existing Shipper
135
136         $sql = "SELECT * FROM ".TB_PREF."shippers WHERE shipper_id=$selected_id";
137
138         $result = db_query($sql, "could not get shipper");
139         $myrow = db_fetch($result);
140
141         $_POST['shipper_name']  = $myrow["shipper_name"];
142         $_POST['contact']       = $myrow["contact"];
143         $_POST['phone'] = $myrow["phone"];
144         $_POST['address'] = $myrow["address"];
145
146         hidden('selected_id', $selected_id);
147 }
148
149 text_row_ex(_("Name:"), 'shipper_name', 40);
150
151 text_row_ex(_("Contact Person:"), 'contact', 30);
152
153 text_row_ex(_("Phone Number:"), 'phone', 20);
154
155 text_row_ex(_("Address:"), 'address', 50);
156
157 end_table(1);
158
159 submit_add_or_update_center(!isset($selected_id));
160
161 end_form();
162 end_page();
163 ?>