Security statements update against sql injection attacks.
[fa-stable.git] / purchasing / includes / db / po_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //----------------------------------------------------------------------------------------
13
14 function delete_po($po)
15 {
16         $sql = "DELETE FROM ".TB_PREF."purch_orders WHERE order_no=".db_escape($po);
17         db_query($sql, "The order header could not be deleted");
18
19         $sql = "DELETE FROM ".TB_PREF."purch_order_details WHERE order_no =".db_escape($po);
20         db_query($sql, "The order detail lines could not be deleted");
21 }
22
23 //----------------------------------------------------------------------------------------
24
25 function add_po(&$po_obj)
26 {
27         begin_transaction();
28
29      /*Insert to purchase order header record */
30      $sql = "INSERT INTO ".TB_PREF."purch_orders (supplier_id, Comments, ord_date, reference, requisition_no, into_stock_location, delivery_address) VALUES(";
31      $sql .= db_escape($po_obj->supplier_id) . "," .
32          db_escape($po_obj->Comments) . ",'" .
33          date2sql($po_obj->orig_order_date) . "', " .
34                  db_escape($po_obj->reference) . ", " .
35          db_escape($po_obj->requisition_no) . ", " .
36          db_escape($po_obj->Location) . ", " .
37          db_escape($po_obj->delivery_address) . ")";
38
39         db_query($sql, "The purchase order header record could not be inserted");
40
41      /*Get the auto increment value of the order number created from the sql above */
42      $po_obj->order_no = db_insert_id();
43
44      /*Insert the purchase order detail records */
45      foreach ($po_obj->line_items as $po_line)
46      {
47         if ($po_line->Deleted == false)
48         {
49                 $sql = "INSERT INTO ".TB_PREF."purch_order_details (order_no, item_code, description, delivery_date,    unit_price,     quantity_ordered) VALUES (";
50                 $sql .= $po_obj->order_no . ", " . db_escape($po_line->stock_id). "," .
51                         db_escape($po_line->item_description). ",'" .
52                         date2sql($po_line->req_del_date) . "'," .
53                         db_escape($po_line->price) . ", " .
54                         db_escape($po_line->quantity). ")";
55                         db_query($sql, "One of the purchase order detail records could not be inserted");
56         }
57      }
58
59         references::save_last($po_obj->reference, systypes::po());
60
61         //add_comments(systypes::po(), $po_obj->order_no, $po_obj->orig_order_date, $po_obj->Comments);
62
63         commit_transaction();
64
65         return $po_obj->order_no;
66 }
67
68 //----------------------------------------------------------------------------------------
69
70 function update_po(&$po_obj)
71 {
72         begin_transaction();
73
74     /*Update the purchase order header with any changes */
75     $sql = "UPDATE ".TB_PREF."purch_orders SET Comments=" . db_escape($po_obj->Comments) . ",
76                 requisition_no= ". db_escape( $po_obj->requisition_no). ",
77                 into_stock_location=" . db_escape($po_obj->Location). ",
78                 ord_date='" . date2sql($po_obj->orig_order_date) . "',
79                 delivery_address=" . db_escape($po_obj->delivery_address);
80     $sql .= " WHERE order_no = " . $po_obj->order_no;
81         db_query($sql, "The purchase order could not be updated");
82
83     /*Now Update the purchase order detail records */
84     foreach ($po_obj->line_items as $po_line)
85     {
86
87                 if ($po_line->Deleted==True)
88                 {
89                         // Sherifoz 21.06.03 Handle deleting existing lines
90                         if ($po_line->po_detail_rec!='')
91                         {
92                                 $sql = "DELETE FROM ".TB_PREF."purch_order_details WHERE po_detail_item=".db_escape($po_line->po_detail_rec);
93                                 db_query($sql, "could not query purch order details");
94                         }
95                 }
96                 else if ($po_line->po_detail_rec == '')
97                 {
98                         // Sherifoz 21.06.03 Handle adding new lines vs. updating. if no key(po_detail_rec) then it's a new line
99                         $sql = "INSERT INTO ".TB_PREF."purch_order_details (order_no, item_code, description, delivery_date, unit_price,        quantity_ordered) VALUES (";
100                         $sql .= $po_obj->order_no . "," .
101                                 db_escape($po_line->stock_id). "," .
102                                 db_escape($po_line->item_description). ",'" .
103                                 date2sql($po_line->req_del_date) . "'," .
104                                 db_escape($po_line->price) . ", ".db_escape($po_line->quantity) . ")";
105                 }
106                 else
107                 {
108                         $sql = "UPDATE ".TB_PREF."purch_order_details SET item_code=".db_escape($po_line->stock_id).",
109                                 description =" . db_escape($po_line->item_description). ",
110                                 delivery_date ='" . date2sql($po_line->req_del_date) . "',
111                                 unit_price=".db_escape($po_line->price).",
112                                 quantity_ordered=".db_escape($po_line->quantity) . "
113                                 WHERE po_detail_item=".db_escape($po_line->po_detail_rec);
114                 }
115                 db_query($sql, "One of the purchase order detail records could not be updated");
116     }
117
118         //add_comments(systypes::po(), $po_obj->order_no, $po_obj->orig_order_date, $po_obj->Comments);
119
120         commit_transaction();
121
122         return $po_obj->order_no;
123 }
124
125 //----------------------------------------------------------------------------------------
126
127 function read_po_header($order_no, &$order)
128 {
129         $sql = "SELECT ".TB_PREF."purch_orders.*, ".TB_PREF."suppliers.supp_name,
130                 ".TB_PREF."suppliers.curr_code, ".TB_PREF."locations.location_name
131                 FROM ".TB_PREF."purch_orders, ".TB_PREF."suppliers, ".TB_PREF."locations
132                 WHERE ".TB_PREF."purch_orders.supplier_id = ".TB_PREF."suppliers.supplier_id
133                 AND ".TB_PREF."locations.loc_code = into_stock_location
134                 AND ".TB_PREF."purch_orders.order_no = ".db_escape($order_no);
135
136         $result = db_query($sql, "The order cannot be retrieved");
137
138         if (db_num_rows($result) == 1)
139         {
140
141         $myrow = db_fetch($result);
142
143         $order->order_no = $order_no;
144         $order->supplier_id = $myrow["supplier_id"];
145         $order->supplier_name = $myrow["supp_name"];
146         $order->curr_code = $myrow["curr_code"];
147
148         $order->orig_order_date = sql2date($myrow["ord_date"]);
149         $order->Comments = $myrow["comments"];
150         $order->Location = $myrow["into_stock_location"];
151         $order->requisition_no = $myrow["requisition_no"];
152         $order->reference = $myrow["reference"];
153         $order->delivery_address = $myrow["delivery_address"];
154
155         return true;
156         }
157
158         display_db_error("FATAL : duplicate purchase order found", "", true);
159         return false;
160 }
161
162 //----------------------------------------------------------------------------------------
163
164 function read_po_items($order_no, &$order, $open_items_only=false)
165 {
166         /*now populate the line po array with the purchase order details records */
167
168         $sql = "SELECT ".TB_PREF."purch_order_details.*, units
169                 FROM ".TB_PREF."purch_order_details
170                 LEFT JOIN ".TB_PREF."stock_master
171                 ON ".TB_PREF."purch_order_details.item_code=".TB_PREF."stock_master.stock_id
172                 WHERE order_no =".db_escape($order_no);
173
174     if ($open_items_only)
175                 $sql .= " AND (".TB_PREF."purch_order_details.quantity_ordered > ".TB_PREF."purch_order_details.quantity_received) ";
176
177         $sql .= " ORDER BY po_detail_item";
178
179         $result = db_query($sql, "The lines on the purchase order cannot be retrieved");
180
181     if (db_num_rows($result) > 0)
182     {
183
184                 while ($myrow = db_fetch($result))
185         {
186
187                 $data = get_purchase_data($order->supplier_id, $myrow['item_code']);
188                 if ($data !== false)
189                 {
190                         if ($data['supplier_description'] != "")
191                                 $myrow['description'] = $data['supplier_description'];
192                         //if ($data['suppliers_uom'] != "")
193                         //      $myrow['units'] = $data['suppliers_uom'];
194                 }               
195             if (is_null($myrow["units"]))
196             {
197                         $units = "";
198             }
199             else
200             {
201                 $units = $myrow["units"];
202             }
203
204             if ($order->add_to_order($order->lines_on_order+1, $myrow["item_code"],
205                 $myrow["quantity_ordered"],$myrow["description"],
206                 $myrow["unit_price"],$units, sql2date($myrow["delivery_date"]),
207                 $myrow["qty_invoiced"], $myrow["quantity_received"])) {
208                                         $order->line_items[$order->lines_on_order]->po_detail_rec = $myrow["po_detail_item"];
209                                         $order->line_items[$order->lines_on_order]->standard_cost = $myrow["std_cost_unit"];  /*Needed for receiving goods and GL interface */
210                         }
211         } /* line po from purchase order details */
212     } //end of checks on returned data set
213 }
214
215 //----------------------------------------------------------------------------------------
216
217 function read_po($order_no, &$order, $open_items_only=false)
218 {
219         $result = read_po_header($order_no, $order);
220
221         if ($result)
222                 read_po_items($order_no, $order, $open_items_only);
223 }
224
225 //----------------------------------------------------------------------------------------
226
227
228 ?>