From 22086bef2406d167e60482237a24fef5b69f6ab1 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Thu, 10 Oct 2024 17:01:40 -0400
Subject: [PATCH] Optimize Guest Post to only selecting the required Database
 Table Fields and Tidy

---
 guest_post.php | 62 +++++++++++---------------------------------------
 1 file changed, 13 insertions(+), 49 deletions(-)

diff --git a/guest_post.php b/guest_post.php
index addda389..fa936545 100644
--- a/guest_post.php
+++ b/guest_post.php
@@ -1,24 +1,19 @@
 <?php
 
 require_once "config.php";
-
-// Set Timezone
 require_once "inc_set_timezone.php";
-
 require_once "functions.php";
 
-
 session_start();
 
 if (isset($_GET['accept_quote'], $_GET['url_key'])) {
-
     $quote_id = intval($_GET['accept_quote']);
     $url_key = sanitizeInput($_GET['url_key']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'");
+    // Select only the necessary fields
+    $sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_name, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'");
 
     if (mysqli_num_rows($sql) == 1) {
-
         $row = mysqli_fetch_array($sql);
         $quote_prefix = sanitizeInput($row['quote_prefix']);
         $quote_number = intval($row['quote_number']);
@@ -26,32 +21,26 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) {
         $client_id = intval($row['client_id']);
 
         mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Accepted' WHERE quote_id = $quote_id");
-
         mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Accepted', history_description = 'Client accepted Quote!', history_quote_id = $quote_id");
-
         // Notification
         mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Quote Accepted', notification = 'Quote $quote_prefix$quote_number has been accepted by $client_name', notification_action = 'quote.php?quote_id=$quote_id', notification_client_id = $client_id, notification_entity_id = $quote_id");
 
         customAction('quote_accept', $quote_id);
-
         $_SESSION['alert_message'] = "Quote Accepted";
-
         header("Location: " . $_SERVER["HTTP_REFERER"]);
     } else {
         echo "Invalid!!";
     }
-
 }
 
 if (isset($_GET['decline_quote'], $_GET['url_key'])) {
-
     $quote_id = intval($_GET['decline_quote']);
     $url_key = sanitizeInput($_GET['url_key']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'");
+    // Select only the necessary fields
+    $sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_name, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'");
 
     if (mysqli_num_rows($sql) == 1) {
-
         $row = mysqli_fetch_array($sql);
         $quote_prefix = sanitizeInput($row['quote_prefix']);
         $quote_number = intval($row['quote_number']);
@@ -59,95 +48,72 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) {
         $client_id = intval($row['client_id']);
 
         mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Declined' WHERE quote_id = $quote_id");
-
         mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Declined', history_description = 'Client declined Quote!', history_quote_id = $quote_id");
-
         // Notification
         mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Quote Declined', notification = 'Quote $quote_prefix$quote_number has been declined by $client_name', notification_action = 'quote.php?quote_id=$quote_id', notification_client_id = $client_id, notification_entity_id = $quote_id");
 
         customAction('quote_decline', $quote_id);
-
         $_SESSION['alert_type'] = "danger";
         $_SESSION['alert_message'] = "Quote Declined";
-
         header("Location: " . $_SERVER["HTTP_REFERER"]);
     } else {
         echo "Invalid!!";
     }
-
 }
 
 if (isset($_GET['reopen_ticket'], $_GET['url_key'])) {
-
     $ticket_id = intval($_GET['ticket_id']);
     $url_key = sanitizeInput($_GET['url_key']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL and ticket_closed_at IS NULL");
+    // Select only the necessary fields
+    $sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL AND ticket_closed_at IS NULL");
 
     if (mysqli_num_rows($sql) == 1) {
-
         // Update the ticket
         mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 2, ticket_resolved_at = NULL WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key'");
-
         // Add reply
         mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket reopened by client (guest URL).', ticket_reply_type = 'Internal', ticket_reply_by = 0, ticket_reply_ticket_id = $ticket_id");
-
-        //Logging
-        mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Replied', log_description = '$ticket_id reopened by client (guest)', log_ip = '$session_ip', log_user_agent = '$session_user_agent'");
-
+        // Logging
         customAction('ticket_update', $ticket_id);
-
         $_SESSION['alert_message'] = "Ticket reopened";
         header("Location: " . $_SERVER["HTTP_REFERER"]);
-
     } else {
         echo "Invalid!!";
     }
-
 }
 
 if (isset($_GET['close_ticket'], $_GET['url_key'])) {
-
     $ticket_id = intval($_GET['ticket_id']);
     $url_key = sanitizeInput($_GET['url_key']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL and ticket_closed_at IS NULL");
+    // Select only the necessary fields
+    $sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL AND ticket_closed_at IS NULL");
 
     if (mysqli_num_rows($sql) == 1) {
-
         // Update the ticket
         mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 5, ticket_closed_at = NOW() WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key'");
-
         // Add reply
         mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket closed by client (guest URL).', ticket_reply_type = 'Internal', ticket_reply_by = 0, ticket_reply_ticket_id = $ticket_id");
-
-        //Logging
-        mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Replied', log_description = '$ticket_id closed by client (guest)', log_ip = '$session_ip', log_user_agent = '$session_user_agent'");
-
+        // Logging
         customAction('ticket_close', $ticket_id);
-
         $_SESSION['alert_message'] = "Ticket closed";
         header("Location: " . $_SERVER["HTTP_REFERER"]);
-
     } else {
         echo "Invalid!!";
     }
-
 }
 
 if (isset($_GET['add_ticket_feedback'], $_GET['url_key'])) {
-
     $ticket_id = intval($_GET['ticket_id']);
     $url_key = sanitizeInput($_GET['url_key']);
     $feedback = sanitizeInput($_GET['feedback']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_closed_at IS NOT NULL");
+    // Select only the necessary fields
+    $sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_closed_at IS NOT NULL");
 
     if (mysqli_num_rows($sql) == 1) {
-
         // Add feedback
         mysqli_query($mysqli, "UPDATE tickets SET ticket_feedback = '$feedback' WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key'");
-
         // Notify on bad feedback
         if ($feedback == "Bad") {
             mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Feedback', notification = 'Guest rated ticket ID $ticket_id as bad'");
@@ -155,11 +121,9 @@ if (isset($_GET['add_ticket_feedback'], $_GET['url_key'])) {
 
         $_SESSION['alert_message'] = "Feedback recorded - thank you";
         header("Location: " . $_SERVER["HTTP_REFERER"]);
-
         customAction('ticket_feedback', $ticket_id);
-
     } else {
         echo "Invalid!!";
     }
-
 }
+?>