Security statements update against sql injection attacks.
[fa-stable.git] / purchasing / includes / db / supp_trans_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //-------------------------------------------------------------------------------------------------------------
13
14 function add_supp_trans($type, $supplier_id, $date_, $due_date, $reference, $supp_reference,
15         $amount, $amount_tax, $discount, $err_msg="", $rate=0)
16 {
17         $date = date2sql($date_);
18         if ($due_date == "")
19                 $due_date = "0000-00-00";
20         else
21                 $due_date = date2sql($due_date);
22
23         $trans_no = get_next_trans_no($type);
24
25         $curr = get_supplier_currency($supplier_id);
26         
27         if ($rate == 0)
28                 $rate = get_exchange_rate_from_home_currency($curr, $date_);
29
30
31         $sql = "INSERT INTO ".TB_PREF."supp_trans (trans_no, type, supplier_id, tran_date, due_date,
32                 reference, supp_reference, ov_amount, ov_gst, rate, ov_discount) ";
33         $sql .= "VALUES (".db_escape($trans_no).", ".db_escape($type)
34         .", ".db_escape($supplier_id).", '$date', '$due_date',
35                 ".db_escape($reference).", ".db_escape($supp_reference).", ".db_escape($amount)
36                 .", ".db_escape($amount_tax).", ".db_escape($rate).", ".db_escape($discount).")";
37
38         if ($err_msg == "")
39                 $err_msg = "Cannot insert a supplier transaction record";
40
41         db_query($sql, $err_msg);
42
43         return $trans_no;
44 }
45
46 //-------------------------------------------------------------------------------------------------------------
47
48 function get_supp_trans($trans_no, $trans_type=-1)
49 {
50         $sql = "SELECT ".TB_PREF."supp_trans.*, (".TB_PREF."supp_trans.ov_amount+".TB_PREF."supp_trans.ov_gst+".TB_PREF."supp_trans.ov_discount) AS Total,
51                 ".TB_PREF."suppliers.supp_name AS supplier_name, ".TB_PREF."suppliers.curr_code AS SupplierCurrCode ";
52
53         if ($trans_type == 22)
54         {
55                 // it's a payment so also get the bank account
56                 $sql .= ", ".TB_PREF."bank_accounts.bank_name, ".TB_PREF."bank_accounts.bank_account_name, ".TB_PREF."bank_accounts.bank_curr_code,
57                         ".TB_PREF."bank_accounts.account_type AS BankTransType, ".TB_PREF."bank_trans.amount AS BankAmount,
58                         ".TB_PREF."bank_trans.ref ";
59         }
60
61         $sql .= " FROM ".TB_PREF."supp_trans, ".TB_PREF."suppliers ";
62
63         if ($trans_type == 22)
64         {
65                 // it's a payment so also get the bank account
66                 $sql .= ", ".TB_PREF."bank_trans, ".TB_PREF."bank_accounts";
67         }
68
69         $sql .= " WHERE ".TB_PREF."supp_trans.trans_no=".db_escape($trans_no)."
70                 AND ".TB_PREF."supp_trans.supplier_id=".TB_PREF."suppliers.supplier_id";
71
72         if ($trans_type > 0)
73                 $sql .= " AND ".TB_PREF."supp_trans.type=".db_escape($trans_type);
74
75         if ($trans_type == 22)
76         {
77                 // it's a payment so also get the bank account
78                 $sql .= " AND ".TB_PREF."bank_trans.trans_no =".db_escape($trans_no)."
79                         AND ".TB_PREF."bank_trans.type=".db_escape($trans_type)."
80                         AND ".TB_PREF."bank_accounts.id=".TB_PREF."bank_trans.bank_act ";
81         }
82
83         $result = db_query($sql, "Cannot retreive a supplier transaction");
84
85     if (db_num_rows($result) == 0)
86     {
87        // can't return nothing
88        display_db_error("no supplier trans found for given params", $sql, true);
89        exit;
90     }
91
92     if (db_num_rows($result) > 1)
93     {
94        // can't return multiple
95        display_db_error("duplicate supplier transactions found for given params", $sql, true);
96        exit;
97     }
98
99     return db_fetch($result);
100 }
101
102 //----------------------------------------------------------------------------------------
103
104 function exists_supp_trans($type, $type_no)
105 {
106         if ($type == 25)
107                 return exists_grn($type_no);
108
109         $sql = "SELECT trans_no FROM ".TB_PREF."supp_trans WHERE type=".db_escape($type)."
110                 AND trans_no=".db_escape($type_no);
111         $result = db_query($sql, "Cannot retreive a supplier transaction");
112
113     return (db_num_rows($result) > 0);
114 }
115
116 //----------------------------------------------------------------------------------------
117
118 function void_supp_trans($type, $type_no)
119 {
120         $sql = "UPDATE ".TB_PREF."supp_trans SET ov_amount=0, ov_discount=0, ov_gst=0,
121                 alloc=0 WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no);
122
123         db_query($sql, "could not void supp transactions for type=$type and trans_no=$type_no");
124 }
125
126 //----------------------------------------------------------------------------------------
127
128 function post_void_supp_trans($type, $type_no)
129 {
130         if ($type == 22)
131         {
132                 void_supp_payment($type, $type_no);
133                 return true;
134         }
135
136         if ($type == 20 || $type == 21)
137         {
138                 void_supp_invoice($type, $type_no);
139                 return true;
140         }
141
142         if ($type == 25)
143         {
144                 return void_grn($type_no);
145         }
146
147         return false;
148 }
149
150 //----------------------------------------------------------------------------------------
151
152 ?>