Security statements update against sql injection attacks.
[fa-stable.git] / gl / includes / db / gl_db_currencies.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //---------------------------------------------------------------------------------------------
13
14 function update_currency($curr_abrev, $symbol, $currency, $country, $hundreds_name)
15 {
16         $sql = "UPDATE ".TB_PREF."currencies SET currency="
17                 .db_escape($currency).", curr_symbol=".db_escape($symbol).",
18                 country=".db_escape($country).", hundreds_name=".db_escape($hundreds_name)
19                 ." WHERE curr_abrev = ".db_escape($curr_abrev);
20
21         db_query($sql, "could not update currency for $curr_abrev");
22 }
23
24 //---------------------------------------------------------------------------------------------
25
26 function add_currency($curr_abrev, $symbol, $currency, $country, $hundreds_name)
27 {
28         $sql = "INSERT INTO ".TB_PREF."currencies (curr_abrev, curr_symbol, currency, country, hundreds_name)
29                 VALUES (".db_escape($curr_abrev).", ".db_escape($symbol).", "
30                 .db_escape($currency).", ".db_escape($country).", ".db_escape($hundreds_name).")";
31
32         db_query($sql, "could not add currency for $curr_abrev");
33 }
34
35 //---------------------------------------------------------------------------------------------
36
37 function delete_currency($curr_code)
38 {
39         $sql="DELETE FROM ".TB_PREF."currencies WHERE curr_abrev=".db_escape($curr_code);
40         db_query($sql, "could not delete currency       $curr_code");
41
42         $sql="DELETE FROM ".TB_PREF."exchange_rates WHERE curr_code='$curr_code'";
43         db_query($sql, "could not delete exchange rates for currency $curr_code");
44 }
45
46 //---------------------------------------------------------------------------------------------
47
48 function get_currency($curr_code)
49 {
50         $sql = "SELECT * FROM ".TB_PREF."currencies WHERE curr_abrev=".db_escape($curr_code);
51         $result = db_query($sql, "could not get currency $curr_code");
52
53         $row = db_fetch($result);
54         return $row;
55 }
56
57 //---------------------------------------------------------------------------------------------
58
59 function get_currencies()
60 {
61         $sql = "SELECT * FROM ".TB_PREF."currencies";
62         return db_query($sql, "could not get currencies");
63 }
64
65 //---------------------------------------------------------------------------------------------
66
67 ?>