Security statements update against sql injection attacks.
[fa-stable.git] / inventory / includes / db / items_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 function update_item($stock_id, $description, $long_description, $category_id, $tax_type_id,
13         $sales_account, $inventory_account, $cogs_account, $adjustment_account,
14         $assembly_account, $dimension_id, $dimension2_id)
15 {
16         $sql = "UPDATE ".TB_PREF."stock_master SET long_description=".db_escape($long_description).",
17                 description=".db_escape($description).",
18                 category_id=".db_escape($category_id).",
19                 sales_account=".db_escape($sales_account).",
20                 inventory_account=".db_escape($inventory_account).",
21                 cogs_account=".db_escape($cogs_account).",
22                 adjustment_account=".db_escape($adjustment_account).",
23                 assembly_account=".db_escape($assembly_account).",
24                 dimension_id=".db_escape($dimension_id).",
25                 dimension2_id=".db_escape($dimension2_id).",
26                 tax_type_id=".db_escape($tax_type_id)."
27                 WHERE stock_id=".db_escape($stock_id);
28
29         db_query($sql, "The item could not be updated");
30
31         update_item_code(-1, $stock_id, $stock_id, $description, $category_id, 1, 0);
32 }
33
34 function add_item($stock_id, $description, $long_description, $category_id, $tax_type_id, $units, $mb_flag,
35         $sales_account, $inventory_account, $cogs_account, $adjustment_account,
36         $assembly_account, $dimension_id, $dimension2_id)
37 {
38         $sql = "INSERT INTO ".TB_PREF."stock_master (stock_id, description, long_description, category_id,
39                 tax_type_id, units, mb_flag, sales_account, inventory_account, cogs_account,
40                 adjustment_account, assembly_account, dimension_id, dimension2_id)
41                 VALUES (".db_escape($stock_id).", ".db_escape($description).", ".db_escape($long_description).",
42                 ".db_escape($category_id).", ".db_escape($tax_type_id).", "
43                 .db_escape($units).", ".db_escape($mb_flag).",
44                 ".db_escape($sales_account).", ".db_escape($inventory_account)
45                 .", ".db_escape($cogs_account).",".db_escape($adjustment_account)
46                 .", ".db_escape($assembly_account).", "
47                 .db_escape($dimension_id).", ".db_escape($dimension2_id).")";
48
49         db_query($sql, "The item could not be added");
50
51         $sql = "INSERT INTO ".TB_PREF."loc_stock (loc_code, stock_id)
52                 SELECT ".TB_PREF."locations.loc_code, ".db_escape($stock_id)
53                 ." FROM ".TB_PREF."locations";
54
55         db_query($sql, "The item locstock could not be added");
56
57         add_item_code($stock_id, $stock_id, $description, $category_id, 1, 0);
58 }
59
60 function delete_item($stock_id)
61 {
62         $sql="DELETE FROM ".TB_PREF."stock_master WHERE stock_id=".db_escape($stock_id);
63         db_query($sql, "could not delete stock item");
64
65         /*and cascade deletes in loc_stock */
66         $sql ="DELETE FROM ".TB_PREF."loc_stock WHERE stock_id=".db_escape($stock_id);
67         db_query($sql, "could not delete stock item loc stock");
68
69         /*and cascade deletes in purch_data */
70         $sql ="DELETE FROM ".TB_PREF."purch_data WHERE stock_id=".db_escape($stock_id);
71         db_query($sql, "could not delete stock item purch data");
72
73         /*and cascade deletes in prices */
74         $sql ="DELETE FROM ".TB_PREF."prices WHERE stock_id=".db_escape($stock_id);
75         db_query($sql, "could not delete stock item prices");
76
77         /*and cascade delete the bill of material if any */
78         $sql = "DELETE FROM ".TB_PREF."bom WHERE parent=".db_escape($stock_id);
79         db_query($sql, "could not delete stock item bom");
80
81         delete_item_kit($stock_id);
82 }
83
84 function get_item($stock_id)
85 {
86         $sql = "SELECT ".TB_PREF."stock_master.*,".TB_PREF."item_tax_types.name AS tax_type_name
87                 FROM ".TB_PREF."stock_master,".TB_PREF."item_tax_types
88                 WHERE ".TB_PREF."item_tax_types.id=".TB_PREF."stock_master.tax_type_id
89                 AND stock_id=".db_escape($stock_id);
90         $result = db_query($sql,"an item could not be retreived");
91
92         return db_fetch($result);
93 }
94
95 function get_items()
96 {
97         $sql = "SELECT * FROM ".TB_PREF."stock_master";
98         return db_query($sql,"items could not be retreived");
99 }
100
101 ?>