Changed db_escape function to avoid XSS attacks via js db injection
[fa-stable.git] / inventory / includes / db / items_db.inc
1 <?php
2
3 function update_item($stock_id, $description, $long_description, $category_id, $tax_type_id,
4         $sales_account, $inventory_account, $cogs_account, $adjustment_account,
5         $assembly_account, $dimension_id, $dimension2_id)
6 {
7         $sql = "UPDATE ".TB_PREF."stock_master SET long_description=".db_quote($long_description).",
8                 description=".db_quote($description).",
9                 category_id='$category_id',
10                 sales_account='$sales_account',
11                 inventory_account='$inventory_account',
12                 cogs_account='$cogs_account',
13                 adjustment_account='$adjustment_account',
14                 assembly_account='$assembly_account',
15                 dimension_id=$dimension_id,
16                 dimension2_id=$dimension2_id,
17                 tax_type_id=$tax_type_id
18                 WHERE stock_id='$stock_id'";
19
20         db_query($sql, "The item could not be updated");
21 }
22
23 function add_item($stock_id, $description, $long_description, $category_id, $tax_type_id, $units, $mb_flag,
24         $sales_account, $inventory_account, $cogs_account, $adjustment_account,
25         $assembly_account, $dimension_id, $dimension2_id)
26 {
27         $sql = "INSERT INTO ".TB_PREF."stock_master (stock_id, description, long_description, category_id,
28                 tax_type_id, units, mb_flag, sales_account, inventory_account, cogs_account,
29                 adjustment_account, assembly_account, dimension_id, dimension2_id)
30                 VALUES (".db_quote($stock_id).", ".db_quote($description).", ".db_quote($long_description).",
31                 '$category_id', $tax_type_id, '$units', '$mb_flag',
32                 '$sales_account', '$inventory_account', '$cogs_account',
33                 '$adjustment_account', '$assembly_account', $dimension_id, $dimension2_id)";
34
35         db_query($sql, "The item could not be added");
36
37         $sql = "INSERT INTO ".TB_PREF."loc_stock (loc_code, stock_id)
38                 SELECT ".TB_PREF."locations.loc_code, '$stock_id' FROM ".TB_PREF."locations";
39
40         db_query($sql, "The item locstock could not be added");
41 }
42
43 function delete_item($stock_id)
44 {
45         $sql="DELETE FROM ".TB_PREF."stock_master WHERE stock_id='$stock_id'";
46         db_query($sql, "could not delete stock item");
47
48         /*and cascade deletes in loc_stock */
49         $sql ="DELETE FROM ".TB_PREF."loc_stock WHERE stock_id='$stock_id'";
50         db_query($sql, "could not delete stock item loc stock");
51
52         /*and cascade deletes in purch_data */
53         $sql ="DELETE FROM ".TB_PREF."purch_data WHERE stock_id='$stock_id'";
54         db_query($sql, "could not delete stock item purch data");
55
56         /*and cascade deletes in prices */
57         $sql ="DELETE FROM ".TB_PREF."prices WHERE stock_id='$stock_id'";
58         db_query($sql, "could not delete stock item prices");
59
60         /*and cascade delete the bill of material if any */
61         $sql = "DELETE FROM ".TB_PREF."bom WHERE parent='$stock_id'";
62         db_query($sql, "could not delete stock item bom");
63 }
64
65 function get_item($stock_id)
66 {
67         $sql = "SELECT ".TB_PREF."stock_master.*,".TB_PREF."item_tax_types.name AS tax_type_name
68                 FROM ".TB_PREF."stock_master,".TB_PREF."item_tax_types
69                 WHERE ".TB_PREF."item_tax_types.id=".TB_PREF."stock_master.tax_type_id
70                 AND stock_id='$stock_id'";
71         $result = db_query($sql,"an item could not be retreived");
72
73         return db_fetch($result);
74 }
75
76 function get_items()
77 {
78         $sql = "SELECT * FROM ".TB_PREF."stock_master";
79         return db_query($sql,"items could not be retreived");
80 }
81
82 ?>