diff --git a/invoice.php b/invoice.php index 6c0ac9a7..219000cb 100644 --- a/invoice.php +++ b/invoice.php @@ -25,7 +25,7 @@ if (isset($_GET['invoice_id'])) { $row = mysqli_fetch_array($sql); $invoice_id = intval($row['invoice_id']); $invoice_prefix = htmlentities($row['invoice_prefix']); - $invoice_number = htmlentities($row['invoice_number']); + $invoice_number = intval($row['invoice_number']); $invoice_scope = htmlentities($row['invoice_scope']); $invoice_status = htmlentities($row['invoice_status']); $invoice_date = htmlentities($row['invoice_date']); @@ -73,7 +73,7 @@ if (isset($_GET['invoice_id'])) { //Add up all the payments for the invoice and get the total amount paid to the invoice $sql_amount_paid = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id"); $row = mysqli_fetch_array($sql_amount_paid); - $amount_paid = $row['amount_paid']; + $amount_paid = floatval($row['amount_paid']); $balance = $invoice_amount - $amount_paid; @@ -121,27 +121,33 @@ if (isset($_GET['invoice_id'])) {
-
- Send Email + + Send Email +
- Mark Sent + + Mark Sent +
- Add Payment + + Add Payment +
-
@@ -260,8 +266,8 @@ if (isset($_GET['invoice_id'])) {
- History + History
@@ -10,6 +10,17 @@
+ +
+ +
+
+ +
+ +
+
+ @@ -40,16 +51,6 @@ -
- -
-
- -
- " required> -
-
-
@@ -78,19 +79,19 @@
- +
- +
- + " required>
- - + +
diff --git a/invoices.php b/invoices.php index b535014a..bc87370c 100644 --- a/invoices.php +++ b/invoices.php @@ -53,7 +53,7 @@ $real_overdue_amount = $total_overdue - $total_overdue_partial; if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "invoice_number"; } @@ -85,8 +85,8 @@ if (isset($_GET['status']) && ($_GET['status']) == 'Draft') { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -196,9 +196,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Invoices

+

Invoices

- +
@@ -253,23 +253,23 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
"> - - - - - - - - - - - + + + + + + + + + + + - + - - + + diff --git a/item_edit_modal.php b/item_edit_modal.php index edeb03c4..7809cd54 100644 --- a/item_edit_modal.php +++ b/item_edit_modal.php @@ -2,7 +2,7 @@
-
Edit Line Item:
+
Editing Line Item:
@@ -29,15 +29,8 @@
-
- -
- -
-
-
-
+
@@ -51,7 +44,7 @@
-
+
@@ -67,6 +60,13 @@
+
+ +
+ +
+
+
@@ -74,7 +74,7 @@
- @@ -275,15 +312,15 @@ if (isset($_GET['quote_id'])) { - @@ -309,10 +346,10 @@ if (isset($_GET['quote_id'])) {
-
+
Notes
- +
@@ -354,8 +391,8 @@ if (isset($_GET['quote_id'])) {
-
- History +
+ History
@@ -11,6 +11,16 @@
+
+ +
+
+ +
+ +
+
+ @@ -39,16 +49,6 @@ -
- -
-
- -
- " required> -
-
-
@@ -76,19 +76,19 @@
- +
- +
- + " required>
- - + +
diff --git a/quote_copy_modal.php b/quote_copy_modal.php index 2234245e..cb439129 100644 --- a/quote_copy_modal.php +++ b/quote_copy_modal.php @@ -2,7 +2,7 @@
-
Copying quote: -
+
Copying quote: -
@@ -12,7 +12,7 @@
- +
@@ -23,8 +23,8 @@
- - + +
diff --git a/quote_edit_modal.php b/quote_edit_modal.php index d1975439..125b76d9 100644 --- a/quote_edit_modal.php +++ b/quote_edit_modal.php @@ -2,7 +2,7 @@
-
Editing quote: -
+
Editing quote: -
@@ -61,8 +61,8 @@
- - + +
diff --git a/quote_note_modal.php b/quote_note_modal.php index 82d8c03b..97c57356 100644 --- a/quote_note_modal.php +++ b/quote_note_modal.php @@ -15,8 +15,8 @@
- - + +
diff --git a/quote_to_invoice_modal.php b/quote_to_invoice_modal.php index f8567ebd..995f6297 100644 --- a/quote_to_invoice_modal.php +++ b/quote_to_invoice_modal.php @@ -2,7 +2,7 @@
-
Quote Invoice
+
Quote Invoice
@@ -25,8 +25,8 @@
- - + +
diff --git a/quotes.php b/quotes.php index e41e58ed..398249ed 100644 --- a/quotes.php +++ b/quotes.php @@ -2,7 +2,7 @@ require_once("inc_all.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "quote_number"; } @@ -21,8 +21,8 @@ if (empty($_GET['canned_date'])) { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -71,9 +71,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Quotes

+

Quotes

- +
@@ -82,7 +82,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -142,7 +142,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- + - - + + diff --git a/recurring_invoice.php b/recurring_invoice.php index afd6df3d..1f93cf5b 100644 --- a/recurring_invoice.php +++ b/recurring_invoice.php @@ -16,23 +16,23 @@ if (isset($_GET['recurring_id'])) { ); $row = mysqli_fetch_array($sql); - $recurring_id = $row['recurring_id']; + $recurring_id = intval($row['recurring_id']); $recurring_prefix = htmlentities($row['recurring_prefix']); - $recurring_number = htmlentities($row['recurring_number']); + $recurring_number = intval($row['recurring_number']); $recurring_scope = htmlentities($row['recurring_scope']); $recurring_frequency = htmlentities($row['recurring_frequency']); $recurring_status = htmlentities($row['recurring_status']); $recurring_created_at = date('Y-m-d', strtotime($row['recurring_created_at'])); - $recurring_last_sent = $row['recurring_last_sent']; + $recurring_last_sent = htmlentities($row['recurring_last_sent']); if ($recurring_last_sent == 0) { $recurring_last_sent = '-'; } - $recurring_next_date = $row['recurring_next_date']; + $recurring_next_date = htmlentities($row['recurring_next_date']); $recurring_amount = floatval($row['recurring_amount']); $recurring_currency_code = htmlentities($row['recurring_currency_code']); $recurring_note = htmlentities($row['recurring_note']); - $category_id = $row['recurring_category_id']; - $client_id = $row['client_id']; + $category_id = intval($row['recurring_category_id']); + $client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); $location_address = htmlentities($row['location_address']); $location_city = htmlentities($row['location_city']); @@ -44,7 +44,7 @@ if (isset($_GET['recurring_id'])) { $contact_mobile = formatPhoneNumber($row['contact_mobile']); $client_website = htmlentities($row['client_website']); $client_currency_code = htmlentities($row['client_currency_code']); - $client_net_terms = htmlentities($row['client_net_terms']); + $client_net_terms = intval($row['client_net_terms']); if ($recurring_status == 1) { $status = "Active"; @@ -53,7 +53,7 @@ if (isset($_GET['recurring_id'])) { $status = "Inactive"; $status_badge_color = "secondary"; } - $company_id = $row['company_id']; + $company_id = intval($row['company_id']); $company_name = htmlentities($row['company_name']); $company_country = htmlentities($row['company_country']); $company_address = htmlentities($row['company_address']); @@ -87,26 +87,31 @@ if (isset($_GET['recurring_id'])) {
    • -
    -
    +
    -
    -
    -
    - Edit + + Edit +
    - Force Send + + Force Send +
    - Delete + + Delete +
    @@ -116,15 +121,20 @@ if (isset($_GET['recurring_id'])) {
    -
    +
    Company logo">
    -
    -

    Recurring Invoice
    ly

    +
    +
    +
    + +
    +
    +

    Recurring Invoice
    ly

    -
    +

      • @@ -133,7 +143,7 @@ if (isset($_GET['recurring_id'])) {
    -
    +

      • @@ -149,18 +159,20 @@ if (isset($_GET['recurring_id'])) {
    NumberScopeClientAmountDateDueCategoryStatusAction
    NumberScopeClientAmountDateDueCategoryStatusAction
    + - - +
    + +
    + Edit +
    + Remove +
    +
    		- + @@ -292,9 +329,9 @@ if (isset($_GET['quote_id'])) { ?> - +
    - - - + + +
    @@ -200,14 +200,22 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
    - Edit - Copy + + Edit + + + Copy +
    - Send + + Email +
    - Delete + + Delete +
    - - - - - + + + + + + +
    Created
    Next Date
    Last Sent
    Created
    @@ -173,41 +185,49 @@ if (isset($_GET['recurring_id'])) {
    - - - - - - - - - + + + + + + + + + - @@ -221,43 +241,43 @@ if (isset($_GET['recurring_id'])) { require("item_edit_modal.php"); - } + } - ?> - - - - - - - - - - + + + + + + + + - - - + + $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE company_id = $session_company_id ORDER BY tax_name ASC"); + while ($row = mysqli_fetch_array($taxes_sql)) { + $tax_id = intval($row['tax_id']); + $tax_name = htmlentities($row['tax_name']); + $tax_percent = floatval($row['tax_percent']); + ?> + + + + + + + +
    ItemDescriptionQtyPriceTaxTotal
    ItemDescriptionQtyPriceTaxTotal
    - - + +
    + +
    + Edit +
    + Remove +
    +
    -
    + - - -
    + +
    @@ -268,10 +288,10 @@ if (isset($_GET['recurring_id'])) {
    -
    +
    Notes
    - +
    @@ -308,8 +328,8 @@ if (isset($_GET['recurring_id'])) {
    -
    - History +
    + History
    @@ -10,6 +10,17 @@
    + +
    + +
    +
    + +
    + +
    +
    + @@ -26,7 +37,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $session_company_id ORDER BY client_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $client_id = $row['client_id']; + $client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); ?> @@ -77,7 +88,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $category_id = $row['category_id']; + $category_id = intval($row['category_id']); $category_name = htmlentities($row['category_name']); ?> @@ -92,20 +103,10 @@
    -
    - -
    -
    - -
    - -
    -
    -
    - - + +
    diff --git a/recurring_invoice_edit_modal.php b/recurring_invoice_edit_modal.php index 37b51855..ed833f85 100644 --- a/recurring_invoice_edit_modal.php +++ b/recurring_invoice_edit_modal.php @@ -2,7 +2,7 @@
    -
    +
    Editing Recur Invoice:
    @@ -12,6 +12,16 @@
    +
    + +
    +
    + +
    + +
    +
    +
    @@ -49,7 +59,7 @@ $sql_income_category = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$recurring_created_at' OR category_archived_at IS NULL) AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql_income_category)) { - $category_id_select= $row['category_id']; + $category_id_select= intval($row['category_id']); $category_name_select = htmlentities($row['category_name']); ?> @@ -64,16 +74,6 @@
    -
    - -
    -
    - -
    - -
    -
    -
    @@ -89,8 +89,8 @@
    - - + +
    diff --git a/recurring_invoice_note_modal.php b/recurring_invoice_note_modal.php index b04900dc..50c611bb 100644 --- a/recurring_invoice_note_modal.php +++ b/recurring_invoice_note_modal.php @@ -2,7 +2,7 @@
    -
    Quote Notes
    +
    Editing: Recurring Invoice Notes
    @@ -15,8 +15,8 @@
    - - + +
    diff --git a/recurring_invoices.php b/recurring_invoices.php index 89aeda71..354306c7 100644 --- a/recurring_invoices.php +++ b/recurring_invoices.php @@ -2,7 +2,7 @@ require_once("inc_all.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "recurring_next_date"; } @@ -15,8 +15,8 @@ if (empty($_GET['canned_date'])) { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -71,9 +71,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
    -

    Recurring Invoices

    +

    Recurring Invoices

    - +
    @@ -145,9 +145,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - + + + + - ly - - + ly + + - - - + + + @@ -195,9 +197,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
    - Edit + + Edit +
    - Delete + + Delete +
    @@ -206,8 +212,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + } + ?> diff --git a/revenue_add_modal.php b/revenue_add_modal.php index b06bb8c2..2eed4b84 100644 --- a/revenue_add_modal.php +++ b/revenue_add_modal.php @@ -2,7 +2,7 @@
    -
    New Revenue
    +
    New Revenue
    @@ -63,26 +63,27 @@ $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); + $account_currency_code = htmlentities($row['account_currency_code']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; ?> - + @@ -141,7 +142,7 @@ while ($row = mysqli_fetch_array($sql)) { $category_name = htmlentities($row['category_name']); ?> - +
    - - + +
    diff --git a/revenue_edit_modal.php b/revenue_edit_modal.php index 4cc0bb09..47611e1a 100644 --- a/revenue_edit_modal.php +++ b/revenue_edit_modal.php @@ -64,26 +64,27 @@ $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE (account_archived_at > '$revenue_created_at' OR account_archived_at IS NULL) AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql_accounts)) { - $account_id_select = $row['account_id']; + $account_id_select = intval($row['account_id']); $account_name_select = htmlentities($row['account_name']); + $account_currency_code_select = htmlentities($row['account_currency_code']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; ?> - + '$revenue_created_at' OR category_archived_at IS NULL) AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql_category)) { - $category_id_select = $row['category_id']; + $category_id_select = intval($row['category_id']); $category_name = htmlentities($row['category_name']); ?> @@ -165,8 +166,8 @@
    - - + +
    diff --git a/revenues.php b/revenues.php index 9bbd787b..8c72321d 100644 --- a/revenues.php +++ b/revenues.php @@ -3,7 +3,7 @@ require_once("inc_all.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "revenue_date"; } @@ -22,8 +22,8 @@ if (empty($_GET['canned_date'])) { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -72,9 +72,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
    -

    Revenues

    +

    Revenues

    - +
    @@ -83,7 +83,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
    - +
    @@ -142,7 +142,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); @@ -165,7 +165,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - + @@ -175,9 +175,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
    - Edit + + Edit +
    - Delete + + Delete +