Security statements update against sql injection attacks.
[fa-stable.git] / gl / includes / db / gl_db_bank_accounts.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //---------------------------------------------------------------------------------------------
13
14 function add_bank_account($account_code, $account_type, $bank_account_name, $bank_name, $bank_account_number,
15         $bank_address, $bank_curr_code)
16 {
17         $sql = "INSERT INTO ".TB_PREF."bank_accounts (account_code, account_type, bank_account_name, bank_name, bank_account_number, bank_address, bank_curr_code)
18                 VALUES (".db_escape($account_code).", ".db_escape($account_type).", "
19                 .db_escape($bank_account_name).", ".db_escape($bank_name).", "
20                 .db_escape($bank_account_number).",".db_escape($bank_address).
21                 ", ".db_escape($bank_curr_code).")";
22
23         db_query($sql, "could not add a bank account for $account_code");
24 }
25
26 //---------------------------------------------------------------------------------------------
27
28 function update_bank_account($id, $account_code, $account_type, $bank_account_name, $bank_name, $bank_account_number,
29         $bank_address, $bank_curr_code)
30 {
31         $sql = "UPDATE ".TB_PREF."bank_accounts SET account_type = ".db_escape($account_type).",
32                 account_code=".db_escape($account_code).",
33                 bank_account_name=".db_escape($bank_account_name).", bank_name=".db_escape($bank_name).",
34                 bank_account_number=".db_escape($bank_account_number).", bank_curr_code=".db_escape($bank_curr_code).",
35                 bank_address=".db_escape($bank_address)." WHERE id = ".db_escape($id);
36
37         db_query($sql, "could not update bank account for $account_code");
38 }
39
40 //---------------------------------------------------------------------------------------------
41
42 function delete_bank_account($id)
43 {
44         $sql = "DELETE FROM ".TB_PREF."bank_accounts WHERE id=".db_escape($id);
45
46         db_query($sql,"could not delete bank account for $id");
47 }
48
49
50 //---------------------------------------------------------------------------------------------
51
52 function get_bank_account($id)
53 {
54         $sql = "SELECT * FROM ".TB_PREF."bank_accounts WHERE id=".db_escape($id);
55
56         $result = db_query($sql, "could not retreive bank account for $id");
57
58         return db_fetch($result);
59 }
60
61 //---------------------------------------------------------------------------------------------
62 function get_bank_gl_account($id)
63 {
64         $sql = "SELECT account_code FROM ".TB_PREF."bank_accounts WHERE id=".db_escape($id);
65
66         $result = db_query($sql, "could not retreive bank account for $id");
67
68         $bank_account = db_fetch($result);
69
70         return $bank_account['account_code'];
71 }
72
73 //---------------------------------------------------------------------------------------------
74
75 function add_quick_entry($description, $type, $base_amount, $base_desc)
76 {
77         $sql = "INSERT INTO ".TB_PREF."quick_entries (description, type, base_amount, base_desc) 
78         VALUES (".db_escape($description).", ".db_escape($type).", "
79                 .db_escape($base_amount).", ".db_escape($base_desc).")";
80
81         db_query($sql, "could not insert quick entry for $description");
82 }
83
84 //---------------------------------------------------------------------------------------------
85
86 function update_quick_entry($selected_id, $description, $type, $base_amount, $base_desc)
87 {
88         $sql = "UPDATE ".TB_PREF."quick_entries SET description = ".db_escape($description).",
89                 type=".db_escape($type).", base_amount=".db_escape($base_amount)
90                 .", base_desc=".db_escape($base_desc)."
91                 WHERE id = ".db_escape($selected_id);
92
93         db_query($sql, "could not update quick entry for $selected_id");
94 }
95
96 //---------------------------------------------------------------------------------------------
97
98 function delete_quick_entry($selected_id)
99 {
100         $sql = "DELETE FROM ".TB_PREF."quick_entries WHERE id=".db_escape($selected_id);
101
102         db_query($sql,"could not delete quick entry $selected_id");
103 }
104
105 //---------------------------------------------------------------------------------------------
106
107 function add_quick_entry_line($qid, $action, $dest_id, $amount, $dim, $dim2)
108 {
109         $sql = "INSERT INTO ".TB_PREF."quick_entry_lines 
110                 (qid, action, dest_id, amount, dimension_id, dimension2_id) 
111         VALUES 
112                 ($qid, ".db_escape($action).",".db_escape($dest_id).",
113                         ".db_escape($amount).", ".db_escape($dim).", ".db_escape($dim2).")";
114
115         db_query($sql, "could not insert quick entry line for $qid");
116 }
117
118 //---------------------------------------------------------------------------------------------
119
120 function update_quick_entry_line($selected_id, $qid, $action, $dest_id, $amount, $dim, $dim2)
121 {
122         $sql = "UPDATE ".TB_PREF."quick_entry_lines SET qid = ".db_escape($qid)
123                 .", action=".db_escape($action).",
124                 dest_id=".db_escape($dest_id).", amount=".db_escape($amount)
125                 .", dimension_id=".db_escape($dim).", dimension2_id=".db_escape($dim2)." 
126                 WHERE id = ".db_escape($selected_id);
127
128         db_query($sql, "could not update quick entry line for $selected_id");
129 }
130
131 //---------------------------------------------------------------------------------------------
132
133 function delete_quick_entry_line($selected_id)
134 {
135         $sql = "DELETE FROM ".TB_PREF."quick_entry_lines WHERE id=".db_escape($selected_id);
136
137         db_query($sql,"could not delete quick entry line $selected_id");
138 }
139 //---------------------------------------------------------------------------------------------
140
141
142 function has_quick_entries($type=null)
143 {
144         $sql = "SELECT id FROM ".TB_PREF."quick_entries";
145         if ($type != null)
146                 $sql .= " WHERE type=".db_escape($type);
147
148         $result = db_query($sql, "could not retreive quick entries");
149         return db_num_rows($result) > 0;
150 }
151
152 function get_quick_entries($type = null)
153 {
154         $sql = "SELECT * FROM ".TB_PREF."quick_entries";
155         if ($type != null)
156                 $sql .= " WHERE type=".db_escape($type);
157         $sql .= " ORDER BY description";
158
159         return db_query($sql, "could not retreive quick entries");
160 }
161
162 function get_quick_entry($selected_id)
163 {
164         $sql = "SELECT * FROM ".TB_PREF."quick_entries WHERE id=".db_escape($selected_id);
165
166         $result = db_query($sql, "could not retreive quick entry $selected_id");
167
168         return db_fetch($result);
169 }       
170
171 function get_quick_entry_lines($qid)
172 {
173         $sql = "SELECT ".TB_PREF."quick_entry_lines.*, ".TB_PREF."chart_master.account_name,
174                         ".TB_PREF."tax_types.name as tax_name
175                 FROM ".TB_PREF."quick_entry_lines
176                 LEFT JOIN ".TB_PREF."chart_master ON
177                         ".TB_PREF."quick_entry_lines.dest_id = ".TB_PREF."chart_master.account_code
178                 LEFT JOIN ".TB_PREF."tax_types ON
179                         ".TB_PREF."quick_entry_lines.dest_id = ".TB_PREF."tax_types.id
180                 WHERE 
181                         qid=".db_escape($qid)." ORDER by id";
182
183         return db_query($sql, "could not retreive quick entries");
184 }
185
186 function has_quick_entry_lines($qid)
187 {
188         $sql = "SELECT id FROM ".TB_PREF."quick_entry_lines WHERE qid=".db_escape($qid);
189
190         $result = db_query($sql, "could not retreive quick entries");
191         return db_num_rows($result) > 0;
192 }
193
194 //---------------------------------------------------------------------------------------------
195
196 function get_quick_entry_line($selected_id)
197 {
198         $sql = "SELECT * FROM ".TB_PREF."quick_entry_lines WHERE id=".db_escape($selected_id);
199
200         $result = db_query($sql, "could not retreive quick entry for $selected_id");
201
202         return db_fetch($result);
203 }
204
205 //---------------------------------------------------------------------------------------------
206
207 ?>