navigation  interaction  search

 other resources

Changeset 413

Show
Ignore:
Timestamp:
06/18/08 16:32:34
Author:
nate
Message:
  • Fixed/Changed formatting on products_saleshistory.php
  • Changed sql statement in products_saleshistory.php to disallow injection.
  • Added backurl for sales order links.
Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • trunk/phpbms/modules/bms/products_saleshistory.php

    r412 r413  
    4646        if(!isset($_POST["status"])) $_POST["status"]="Orders/Invoices"; 
    4747        if(!isset($_POST["command"])) $_POST["command"]="show"; 
    48         if(!isset($_POST["date_order"])) $_POST["date_order"]="desc"; 
     48        if(!isset($_POST["date_order"])) $_POST["date_order"]="DESC"; 
    4949 
    5050        if($_POST["command"]=="print")  { 
     
    6969                break; 
    7070        } 
    71     $date_order_reverse = $_POST['date_order'] == 'desc' ? 'asc' : 'desc'; 
     71        $dateOrder = ($_POST['date_order'] == 'DESC') ? 'ASC' : 'DESC'; 
    7272 
    7373        $mysqlfromdate=sqlDateFromString($_POST["fromdate"]); 
    7474        $mysqltodate=sqlDateFromString($_POST["todate"]); 
    7575 
    76         $refquery="select partname from products where id=".$_GET["id"]
     76        $refquery="select partname from products where id=".((int)$_GET["id"])
    7777        $refquery=$db->query($refquery); 
    7878        $refrecord=$db->fetchArray($refquery); 
    7979         
    80         $querystatement="SELECT invoices.id as id,  
    81                 if(invoices.type=\"Invoice\",invoices.invoicedate,invoices.orderdate) as thedate,  
    82                 if(clients.lastname!=\"\",concat(clients.lastname,\", \",clients.firstname,if(clients.company!=\"\",concat(\" (\",clients.company,\")\"),\"\")),clients.company) as client, 
    83                 lineitems.quantity as qty,  
    84                 lineitems.unitprice*lineitems.quantity as extended, 
    85                 lineitems.unitprice as price, lineitems.unitcost as cost,  
    86                 lineitems.unitcost*lineitems.quantity as extendedcost 
    87                 FROM((products inner join lineitems on products.id=lineitems.productid)  
    88                                 inner join invoices on lineitems.invoiceid=invoices.id)  
    89                                         inner join clients on invoices.clientid=clients.id 
    90                 WHERE products.id=".$_GET["id"]."  
    91                 AND ".$thestatus." 
    92                 HAVING thedate >=\"".$mysqlfromdate."\" 
    93                 and thedate <=\"".$mysqltodate."\" ORDER BY thedate " .$_POST["date_order"]; 
     80        $querystatement=" 
     81                SELECT 
     82                                invoices.id AS id,  
     83                                IF(invoices.type=\"Invoice\",invoices.invoicedate,invoices.orderdate) AS thedate,  
     84                                CONCAT(\"<strong>\",IF(clients.lastname!=\"\",CONCAT(clients.lastname,\", \",clients.firstname,IF(clients.company!=\"\",CONCAT(\" (\",clients.company,\")\"),\"\")),clients.company),\"</strong>\") AS client, 
     85                                lineitems.quantity AS qty,  
     86                                lineitems.unitprice*lineitems.quantity AS extended, 
     87                                lineitems.unitprice AS price, 
     88                                lineitems.unitcost AS cost,  
     89                                lineitems.unitcost*lineitems.quantity AS extendedcost 
     90                FROM 
     91                                ((products INNER JOIN lineitems ON products.id=lineitems.productid)  
     92                                INNER JOIN invoices ON lineitems.invoiceid=invoices.id)  
     93                                        INNER JOIN clients ON invoices.clientid=clients.id 
     94                WHERE 
     95                                products.id=".((int)$_GET["id"])."  
     96                                AND ".$thestatus." 
     97                HAVING 
     98                                thedate >=\"".$mysqlfromdate."\" 
     99                                AND thedate <=\"".$mysqltodate."\" 
     100                ORDER BY 
     101                                thedate " .$dateOrder; 
    94102        $queryresult=$db->query($querystatement); 
    95103 
     
    143151         <th align="center" nowrap="nowrap" class="queryheader" colspan="2">ID</th> 
    144152         <th align="center" nowrap="nowrap" class="queryheader"> 
    145                 <a onclick="javascript:document.getElementById('date_order').value='<?php echo $date_order_reverse; ?>'; document.record.submit();">Order Date</a> 
     153                <a href="#" onclick="javascript:document.getElementById('date_order').value='<?php echo $dateOrder; ?>'; document.record.submit(); return false;">Date</a> 
    146154         </th> 
    147155         <th nowrap="nowrap" class="queryheader" width="100%" align="left">Client</th> 
     
    169177        <tr class="row<?php echo $row?>"> 
    170178         <td> 
    171                 <button type="button" class="invisibleButtons" onclick="location.href='<?php echo getAddEditFile($db,3) ?>?id=<?php echo $therecord["id"]?>'"><img src="<?php echo APP_PATH ?>common/stylesheet/<?php echo STYLESHEET ?>/image/button-edit.png" align="middle" alt="edit" width="16" height="16" border="0" /></button> 
     179                <button type="button" class="invisibleButtons" onclick="location.href='<?php echo getAddEditFile($db,3) ?>?id=<?php echo $therecord["id"]?>&amp;backurl=<?php echo urlencode($_SERVER["REQUEST_URI"]); ?>'"><img src="<?php echo APP_PATH ?>common/stylesheet/<?php echo STYLESHEET ?>/image/button-edit.png" align="middle" alt="edit" width="16" height="16" border="0" /></button> 
    172180         </td> 
    173181         <td align="center" nowrap="nowrap"><?php echo $therecord["id"]?></td> 
     
    181189        </tr> 
    182190    <?php } if(!$db->numRows($queryresult)) {?> 
    183         <tr><td colspan="9" align="center" style="padding:0px;"><div class="norecords">No Sales Data for Given Timeframe</div></td></tr> 
    184         <?php }?> 
     191        <tr class="norecords"><td colspan="9">No Sales Data for Given Timeframe</td></tr> 
     192        <?php }else{?> 
    185193        <tr> 
    186194         <td align="center" class="queryfooter">&nbsp;</td> 
    187195         <td align="center" class="queryfooter">&nbsp;</td> 
    188          <td class="queryfooter">&nbsp;</td> 
     196         <td align="center" class="queryfooter">&nbsp;</td> 
     197         <td align="center" class="queryfooter">&nbsp;</td> 
    189198         <td align="center" class="queryfooter"><?php echo number_format($totalquantity,2)?></td> 
    190199         <td align="right" nowrap="nowrap" class="queryfooter">avg. = <?php $numrows?$avgcost=$avgcost/$numrows:$avgcost=0; echo numberToCurrency($avgcost)?></td> 
     
    193202         <td align="right" class="queryfooter"><?php echo numberToCurrency($totalextended)?></td> 
    194203        </tr> 
     204        <?php }//end if --numrows-- ?> 
    195205   </table></div></form>         
    196206</div> 
Copyright © 2006-2007 Kreotek, LLC. All Rights reserved.