# HG changeset patch # User Michiel Broek # Date 1548449893 -3600 # Node ID 08488ac3bbb1c9001e6d68bc6d15c60198a9a2da # Parent 5df88c6dc9033671a04e4fed9e0108fb1baa2d67 Inventory waters: use POST instead of GET. Redesigned web editor page. Total Alkalinity and Bicarbonate update eachother with calculated values. diff -r 5df88c6dc903 -r 08488ac3bbb1 www/includes/db_inventory_water.php --- a/www/includes/db_inventory_water.php Fri Jan 25 20:38:31 2019 +0100 +++ b/www/includes/db_inventory_water.php Fri Jan 25 21:58:13 2019 +0100 @@ -11,69 +11,62 @@ mysqli_set_charset($connect, "utf8" ); -// get data and store in a json array -$query = "SELECT * FROM inventory_waters ORDER BY name"; -if (isset($_GET['insert'])) { - // INSERT COMMAND - $sql = "INSERT INTO `inventory_waters` SET name='" . mysqli_real_escape_string($connect, $_GET['name']); - ($_GET['unlimited_stock'] == 'true') ? $sql .= "', unlimited_stock='1" : $sql .= "', unlimited_stock='0"; - $sql .= "', calcium='" . $_GET['calcium']; - $sql .= "', bicarbonate='" . $_GET['bicarbonate']; - $sql .= "', sulfate='" . $_GET['sulfate']; - $sql .= "', chloride='" . $_GET['chloride']; - $sql .= "', sodium='" . $_GET['sodium']; - $sql .= "', magnesium='" . $_GET['magnesium']; - $sql .= "', ph='" . $_GET['ph']; - $sql .= "', notes='" . mysqli_real_escape_string($connect, $_GET['notes']); - $sql .= "', total_alkalinity='" . $_GET['total_alkalinity']; - $sql .= "', inventory='" . $_GET['inventory']; - $sql .= "', cost='" . $_GET['cost']; - $sql .= "';"; +if (isset($_POST['insert']) || isset($_POST['update'])) { + if (isset($_POST['insert'])) { + $sql = "INSERT INTO `inventory_waters` SET "; + } + if (isset($_POST['update'])) { + $sql = "UPDATE `inventory_waters` SET "; + } + + $sql .= "name='" . mysqli_real_escape_string($connect, $_POST['name']); + ($_POST['unlimited_stock'] == 'true') ? $sql .= "', unlimited_stock='1" : $sql .= "', unlimited_stock='0"; + $sql .= "', calcium='" . $_POST['calcium']; + $sql .= "', bicarbonate='" . $_POST['bicarbonate']; + $sql .= "', sulfate='" . $_POST['sulfate']; + $sql .= "', chloride='" . $_POST['chloride']; + $sql .= "', sodium='" . $_POST['sodium']; + $sql .= "', magnesium='" . $_POST['magnesium']; + $sql .= "', ph='" . $_POST['ph']; + $sql .= "', notes='" . mysqli_real_escape_string($connect, $_POST['notes']); + $sql .= "', total_alkalinity='" . $_POST['total_alkalinity']; + $sql .= "', inventory='" . $_POST['inventory']; + $sql .= "', cost='" . $_POST['cost']; + if (isset($_POST['insert'])) { + $sql .= "';"; + } + if (isset($_POST['update'])) { + $sql .= "' WHERE record='" . $_POST['record'] . "';"; + } + syslog(LOG_NOTICE, $sql); + $result = mysqli_query($connect, $sql); if (! $result) { syslog(LOG_NOTICE, "db_inventory_waters: ".$sql." result: ".mysqli_error($connect)); } else { - syslog(LOG_NOTICE, "db_inventory_waters: inserted ".$_GET['name']); + if (isset($_POST['update'])) { + syslog(LOG_NOTICE, "db_inventory_waters: updated record ".$_POST['record']); + } else { + $lastid = mysqli_insert_id($connect); + syslog(LOG_NOTICE, "db_inventory_waters: inserted record ".$lastid); + } } echo $result; -} else if (isset($_GET['update'])) { - // UPDATE COMMAND - $sql = "UPDATE `inventory_waters` SET name='" . mysqli_real_escape_string($connect, $_GET['name']); - ($_GET['unlimited_stock'] == 'true') ? $sql .= "', unlimited_stock='1" : $sql .= "', unlimited_stock='0"; - $sql .= "', calcium='" . $_GET['calcium']; - $sql .= "', bicarbonate='" . $_GET['bicarbonate']; - $sql .= "', sulfate='" . $_GET['sulfate']; - $sql .= "', chloride='" . $_GET['chloride']; - $sql .= "', sodium='" . $_GET['sodium']; - $sql .= "', magnesium='" . $_GET['magnesium']; - $sql .= "', ph='" . $_GET['ph']; - $sql .= "', notes='" . mysqli_real_escape_string($connect, $_GET['notes']); - $sql .= "', total_alkalinity='" . $_GET['total_alkalinity']; - $sql .= "', inventory='" . $_GET['inventory']; - $sql .= "', cost='" . $_GET['cost']; - $sql .= "' WHERE record='" . $_GET['record'] . "';"; +} else if (isset($_POST['delete'])) { + // DELETE COMMAND + $sql = "DELETE FROM `inventory_waters` WHERE record='".$_POST['record']."';"; $result = mysqli_query($connect, $sql); if (! $result) { syslog(LOG_NOTICE, "db_inventory_waters: ".$sql." result: ".mysqli_error($connect)); } else { - syslog(LOG_NOTICE, "db_inventory_waters: updated record ".$_GET['record']); - } - echo $result; - -} else if (isset($_GET['delete'])) { - // DELETE COMMAND - $sql = "DELETE FROM `inventory_waters` WHERE record='".$_GET['record']."';"; - $result = mysqli_query($connect, $sql); - if (! $result) { - syslog(LOG_NOTICE, "db_inventory_waters: ".$sql." result: ".mysqli_error($connect)); - } else { - syslog(LOG_NOTICE, "db_inventory_waters: deleted record ".$_GET['record']); + syslog(LOG_NOTICE, "db_inventory_waters: deleted record ".$_POST['record']); } echo $result; } else { // SELECT COMMAND + $query = "SELECT * FROM inventory_waters ORDER BY name"; $result = mysqli_query($connect, $query) or die("SQL Error 1: " . mysqli_error($connect)); while ($row = mysqli_fetch_array($result, MYSQLI_ASSOC)) { $waters[] = array( diff -r 5df88c6dc903 -r 08488ac3bbb1 www/inv_waters.php --- a/www/inv_waters.php Fri Jan 25 20:38:31 2019 +0100 +++ b/www/inv_waters.php Fri Jan 25 21:58:13 2019 +0100 @@ -13,38 +13,44 @@