AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-24 01:10:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:10:45 -04:00
parent d62b6e2ae7
commit 7bc47a58fe
338 changed files with 3057 additions and 3057 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
agent/modals/ticket/ticket_add.php
View File

@@ -63,7 +63,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option value="<?php echo $client_id_select; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -103,9 +103,9 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
$ticket_template_id_select = intval($row['ticket_template_id']);
$ticket_template_name_select = nullable_htmlentities($row['ticket_template_name']);
$ticket_template_subject_select = nullable_htmlentities($row['ticket_template_subject']);
$ticket_template_details_select = nullable_htmlentities($row['ticket_template_details']);
$ticket_template_name_select = escapeHtml($row['ticket_template_name']);
$ticket_template_subject_select = escapeHtml($row['ticket_template_subject']);
$ticket_template_details_select = escapeHtml($row['ticket_template_details']);
$task_count = intval($row['task_count']);
?>
<option value="<?php echo $ticket_template_id_select; ?>"
@@ -163,7 +163,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -204,7 +204,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql)) {
$user_id = intval($row['user_id']);
$user_name = nullable_htmlentities($row['user_name']); ?>
$user_name = escapeHtml($row['user_name']); ?>
<option <?php if ($session_user_id == $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
<?php } ?>
</select>
@@ -253,7 +253,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_title, contact_primary, contact_technical FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL ORDER BY contact_primary DESC, contact_technical DESC, contact_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_name_select = escapeHtml($row['contact_name']);
$contact_primary_select = intval($row['contact_primary']);
if($contact_primary_select == 1) {
$contact_primary_display = " (Primary)";
@@ -266,7 +266,7 @@ ob_start();
} else {
$contact_technical_display = "";
}
$contact_title_select = nullable_htmlentities($row['contact_title']);
$contact_title_select = escapeHtml($row['contact_title']);
if($contact_title_select) {
$contact_title_display = " - $contact_title_select";
} else {
@@ -302,7 +302,7 @@ ob_start();
<?php
$sql = mysqli_query($mysqli, "SELECT contact_email FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL AND contact_email IS NOT NULL ORDER BY contact_email ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_email = escapeHtml($row['contact_email']);
?>
<option><?php echo $contact_email; ?></option>
@@ -328,8 +328,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, contact_name FROM assets LEFT JOIN contacts ON contact_id = asset_contact_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_contact_name_select = nullable_htmlentities($row['contact_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_contact_name_select = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $asset_id_select; ?>"
<?php if ($asset_id == $asset_id_select) { echo "selected"; }?>
@@ -353,8 +353,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, contact_name FROM assets LEFT JOIN contacts ON contact_id = asset_contact_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_contact_name_select = nullable_htmlentities($row['contact_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_contact_name_select = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $asset_id_select; ?>">
<?php echo "$asset_name_select - $asset_contact_name_select"; ?>
@@ -378,7 +378,7 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_name_select = escapeHtml($row['location_name']);
?>
<option value="<?php echo $location_id_select; ?>"><?php echo $location_name_select; ?></option>
@@ -404,7 +404,7 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = $client_id AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']); ?>
$vendor_name_select = escapeHtml($row['vendor_name']); ?>
<option value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>
<?php } ?>
@@ -443,7 +443,7 @@ ob_start();
$sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE project_client_id = $client_id AND project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id_select = intval($row['project_id']);
$project_name_select = nullable_htmlentities($row['project_name']); ?>
$project_name_select = escapeHtml($row['project_name']); ?>
<option <?php if ($project_id == $project_id_select) { echo "selected"; } ?> value="<?php echo $project_id_select; ?>"><?php echo $project_name_select; ?></option>
<?php } ?>

12
agent/modals/ticket/ticket_add_v2.php
View File

@@ -64,7 +64,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_lead = 0 AND client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option value="<?php echo $client_id_select; ?>" <?php if ($client_id == $client_id_select) {echo "selected"; } ?>><?php echo $client_name; ?></option>
@@ -115,9 +115,9 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
$ticket_template_id_select = intval($row['ticket_template_id']);
$ticket_template_name_select = nullable_htmlentities($row['ticket_template_name']);
$ticket_template_subject_select = nullable_htmlentities($row['ticket_template_subject']);
$ticket_template_details_select = nullable_htmlentities($row['ticket_template_details']);
$ticket_template_name_select = escapeHtml($row['ticket_template_name']);
$ticket_template_subject_select = escapeHtml($row['ticket_template_subject']);
$ticket_template_details_select = escapeHtml($row['ticket_template_details']);
$task_count = intval($row['task_count']);
?>
<option value="<?php echo $ticket_template_id_select; ?>"
@@ -175,7 +175,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
<?php } ?>
@@ -210,7 +210,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql)) {
$user_id = intval($row['user_id']);
$user_name = nullable_htmlentities($row['user_name']); ?>
$user_name = escapeHtml($row['user_name']); ?>
<option value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
<?php } ?>
</select>

4
agent/modals/ticket/ticket_add_watcher.php
View File

@@ -32,8 +32,8 @@ ob_start();
$sql_client_contacts_select = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_email FROM contacts WHERE contact_client_id = $client_id AND contact_email <> '' ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_contacts_select)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_email_select = nullable_htmlentities($row['contact_email']);
$contact_name_select = escapeHtml($row['contact_name']);
$contact_email_select = escapeHtml($row['contact_email']);
?>
<option value="<?php echo $contact_email_select; ?>"><?php echo "$contact_name_select - $contact_email_select"; ?></option>

8
agent/modals/ticket/ticket_assign.php
View File

@@ -11,12 +11,12 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets
);
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_assigned_to = intval($row['ticket_assigned_to']);
$ticket_status = intval($row['ticket_status']);
$ticket_closed_at = nullable_htmlentities($row['ticket_closed_at']);
$client_name = nullable_htmlentities($row['client_name']);
$ticket_closed_at = escapeHtml($row['ticket_closed_at']);
$client_name = escapeHtml($row['client_name']);
// Generate the HTML form content using output buffering.
ob_start();
@@ -52,7 +52,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql_users_select)) {
$user_id_select = intval($row['user_id']);
$user_name_select = nullable_htmlentities($row['user_name']);
$user_name_select = escapeHtml($row['user_name']);
?>
<option value="<?php echo $user_id_select; ?>" <?php if ($user_id_select == $ticket_assigned_to) { echo "selected"; } ?>><?php echo $user_name_select; ?></option>

2
agent/modals/ticket/ticket_billable.php
View File

@@ -7,7 +7,7 @@ $ticket_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_billable = intval($row['ticket_billable']);

4
agent/modals/ticket/ticket_bulk_add_project.php
View File

@@ -39,9 +39,9 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql_projects_select)) {
$project_id_select = intval($row['project_id']);
$project_prefix_select = nullable_htmlentities($row['project_prefix']);
$project_prefix_select = escapeHtml($row['project_prefix']);
$project_number_select = intval($row['project_number']);
$project_name_select = nullable_htmlentities($row['project_name']);
$project_name_select = escapeHtml($row['project_name']);
?>
<option value="<?php echo $project_id_select; ?>"><?php echo " $project_prefix_select$project_number_select - $project_name_select"; ?></option>

2
agent/modals/ticket/ticket_bulk_assign.php
View File

@@ -40,7 +40,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql_users_select)) {
$user_id_select = intval($row['user_id']);
$user_name_select = nullable_htmlentities($row['user_name']);
$user_name_select = escapeHtml($row['user_name']);
?>
<option value="<?php echo $user_id_select; ?>"><?php echo $user_name_select; ?></option>

2
agent/modals/ticket/ticket_bulk_edit_category.php
View File

@@ -37,7 +37,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>

8
agent/modals/ticket/ticket_bulk_merge.php
View File

@@ -52,11 +52,11 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_merge)) {
$ticket_id_merge = intval($row['ticket_id']);
$ticket_prefix_merge = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix_merge = escapeHtml($row['ticket_prefix']);
$ticket_number_merge = intval($row['ticket_number']);
$ticket_status_name_merge = nullable_htmlentities($row['ticket_status_name']);
$client_name_merge = nullable_htmlentities($row['client_name']);
$ticket_subject_merge = nullable_htmlentities($row['ticket_subject']);
$ticket_status_name_merge = escapeHtml($row['ticket_status_name']);
$client_name_merge = escapeHtml($row['client_name']);
$ticket_subject_merge = escapeHtml($row['ticket_subject']);
?>
<option value="<?= $ticket_id_merge ?>">
<?= "$ticket_prefix_merge$ticket_number_merge ($ticket_status_name_merge) $client_name_merge - $ticket_subject_merge" ?>

2
agent/modals/ticket/ticket_bulk_reply.php
View File

@@ -34,7 +34,7 @@ ob_start();
<?php $sql_ticket_status = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id != 1 AND ticket_status_id != 5 AND ticket_status_active = 1");
while ($row = mysqli_fetch_assoc($sql_ticket_status)) {
$ticket_status_id_select = intval($row['ticket_status_id']);
$ticket_status_name_select = nullable_htmlentities($row['ticket_status_name']); ?>
$ticket_status_name_select = escapeHtml($row['ticket_status_name']); ?>
<option value="<?php echo $ticket_status_id_select ?>"> <?php echo $ticket_status_name_select ?> </option>

4
agent/modals/ticket/ticket_change_client.php
View File

@@ -6,7 +6,7 @@ $ticket_id = intval($_GET['ticket_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$client_id = intval($row['ticket_client_id']);
@@ -39,7 +39,7 @@ ob_start();
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_lead = 0 AND client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?= $client_id_select ?>" <?php if ($client_id == $client_id_select) echo 'selected'; ?>>
<?= $client_name ?>

8
agent/modals/ticket/ticket_contact.php
View File

@@ -11,11 +11,11 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets
);
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$contact_id = intval($row['ticket_contact_id']);
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Generate the HTML form content using output buffering.
ob_start();
@@ -45,7 +45,7 @@ ob_start();
$sql_client_contacts_select = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_title, contact_primary, contact_technical FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL ORDER BY contact_primary DESC, contact_technical DESC, contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_contacts_select)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_name_select = escapeHtml($row['contact_name']);
$contact_primary_select = intval($row['contact_primary']);
if($contact_primary_select == 1) {
$contact_primary_display_select = " (Primary)";
@@ -58,7 +58,7 @@ ob_start();
} else {
$contact_technical_display_select = "";
}
$contact_title_select = nullable_htmlentities($row['contact_title']);
$contact_title_select = escapeHtml($row['contact_title']);
if(!empty($contact_title_select)) {
$contact_title_display_select = " - $contact_title_select";
} else {

38
agent/modals/ticket/ticket_edit.php
View File

@@ -14,17 +14,17 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$client_name = escapeHtml($row['client_name']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_category = intval($row['ticket_category']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_details = nullable_htmlentities($row['ticket_details']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_details = escapeHtml($row['ticket_details']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_billable = intval($row['ticket_billable']);
$ticket_vendor_ticket_number = nullable_htmlentities($row['ticket_vendor_ticket_number']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_due_at = nullable_htmlentities($row['ticket_due_at']);
$ticket_vendor_ticket_number = escapeHtml($row['ticket_vendor_ticket_number']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_due_at = escapeHtml($row['ticket_due_at']);
$ticket_assigned_to = intval($row['ticket_assigned_to']);
$contact_id = intval($row['ticket_contact_id']);
$asset_id = intval($row['ticket_asset_id']);
@@ -119,7 +119,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option <?php if ($ticket_category == $category_id) {echo "selected";} ?> value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -160,7 +160,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql)) {
$user_id = intval($row['user_id']);
$user_name = nullable_htmlentities($row['user_name']); ?>
$user_name = escapeHtml($row['user_name']); ?>
<option <?php if ($ticket_assigned_to === $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
<?php } ?>
</select>
@@ -207,7 +207,7 @@ ob_start();
$sql_client_contacts_select = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_title, contact_primary, contact_technical FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL ORDER BY contact_primary DESC, contact_technical DESC, contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_contacts_select)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_name_select = escapeHtml($row['contact_name']);
$contact_primary_select = intval($row['contact_primary']);
if($contact_primary_select == 1) {
$contact_primary_display_select = " (Primary)";
@@ -220,7 +220,7 @@ ob_start();
} else {
$contact_technical_display_select = "";
}
$contact_title_select = nullable_htmlentities($row['contact_title']);
$contact_title_select = escapeHtml($row['contact_title']);
if(!empty($contact_title_select)) {
$contact_title_display_select = " - $contact_title_select";
} else {
@@ -262,8 +262,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, contact_name FROM assets LEFT JOIN contacts ON contact_id = asset_contact_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_contact_name_select = nullable_htmlentities($row['contact_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_contact_name_select = escapeHtml($row['contact_name']);
?>
<option <?php if ($asset_id == $asset_id_select) { echo "selected"; } ?> value="<?php echo $asset_id_select; ?>"><?php echo "$asset_name_select - $asset_contact_name_select"; ?></option>
@@ -287,8 +287,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, contact_name FROM assets LEFT JOIN contacts ON contact_id = asset_contact_id WHERE asset_client_id = $client_id AND asset_id != $asset_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_contact_name_select = nullable_htmlentities($row['contact_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_contact_name_select = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $asset_id_select; ?>"
<?php if (in_array($asset_id_select, $additional_assets_array)) { echo "selected"; } ?>
@@ -312,7 +312,7 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_name_select = escapeHtml($row['location_name']);
?>
<option <?php if ($location_id == $location_id_select) { echo "selected"; } ?> value="<?php echo $location_id_select; ?>"><?php echo $location_name_select; ?></option>
@@ -340,7 +340,7 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = $client_id AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_name_select = escapeHtml($row['vendor_name']);
?>
<option <?php if ($vendor_id == $vendor_id_select) { echo "selected"; } ?> value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>
@@ -382,7 +382,7 @@ ob_start();
$sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE (project_client_id = $client_id OR project_client_id = 0) AND project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id_select = intval($row['project_id']);
$project_name_select = nullable_htmlentities($row['project_name']); ?>
$project_name_select = escapeHtml($row['project_name']); ?>
<option <?php if ($project_id == $project_id_select) { echo "selected"; } ?> value="<?= $project_id_select ?>"><?= $project_name_select ?></option>
<?php } ?>

12
agent/modals/ticket/ticket_edit_asset.php
View File

@@ -8,8 +8,8 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$client_name = escapeHtml($row['client_name']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$asset_id = intval($row['ticket_asset_id']);
@@ -49,8 +49,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, contact_name FROM assets LEFT JOIN contacts ON contact_id = asset_contact_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_contact_name_select = nullable_htmlentities($row['contact_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_contact_name_select = escapeHtml($row['contact_name']);
?>
<option <?php if ($asset_id == $asset_id_select) { echo "selected"; } ?> value="<?php echo $asset_id_select; ?>"><?php echo "$asset_name_select - $asset_contact_name_select"; ?></option>
@@ -74,8 +74,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, contact_name FROM assets LEFT JOIN contacts ON contact_id = asset_contact_id WHERE asset_client_id = $client_id AND asset_id != $asset_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_contact_name_select = nullable_htmlentities($row['contact_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_contact_name_select = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $asset_id_select; ?>"
<?php if (in_array($asset_id_select, $additional_assets_array)) { echo "selected"; } ?>

6
agent/modals/ticket/ticket_edit_project.php
View File

@@ -8,8 +8,8 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$client_name = escapeHtml($row['client_name']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_project_id = intval($row['ticket_project_id']);
@@ -43,7 +43,7 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id = intval($row['project_id']);
$project_name = nullable_htmlentities($row['project_name']); ?>
$project_name = escapeHtml($row['project_name']); ?>
<option <?php if ($ticket_project_id == $project_id) { echo "selected"; } ?>
value="<?= $project_id ?>"><?= $project_name ?>
</option>

6
agent/modals/ticket/ticket_edit_schedule.php
View File

@@ -11,12 +11,12 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets
);
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_scheduled_for = nullable_htmlentities($row['ticket_schedule']);
$ticket_scheduled_for = escapeHtml($row['ticket_schedule']);
$ticket_onsite = intval($row['ticket_onsite']);
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Generate the HTML form content using output buffering.
ob_start();

48
agent/modals/ticket/ticket_invoice_add.php
View File

@@ -22,25 +22,25 @@ $ticket_sql = mysqli_query(
$row = mysqli_fetch_assoc($ticket_sql);
$client_id = intval($row['client_id']);
$client_rate = floatval($row['client_rate']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_category = intval($row['ticket_category']);
$ticket_category_display = nullable_htmlentities($row['category_name']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_category_display = escapeHtml($row['category_name']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_billable = intval($row['ticket_billable']);
$ticket_onsite = intval($row['ticket_onsite']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_created_by = intval($row['ticket_created_by']);
$ticket_date = date('Y-m-d g:i A', strtotime($ticket_created_at));
$ticket_first_response_at = nullable_htmlentities($row['ticket_first_response_at']);
$ticket_first_response_at = escapeHtml($row['ticket_first_response_at']);
if ($ticket_first_response_at) {
$ticket_first_response_date_time = date('Y-m-d g:i A', strtotime($ticket_first_response_at));
} else {
$ticket_first_response_date_time = '';
}
$ticket_resolved_at = nullable_htmlentities($row['ticket_resolved_at']);
$ticket_resolved_at = escapeHtml($row['ticket_resolved_at']);
if ($ticket_resolved_at) {
$ticket_resolved_date = date('Y-m-d g:i A', strtotime($ticket_resolved_at));
} else {
@@ -49,7 +49,7 @@ if ($ticket_resolved_at) {
$ticket_assigned_to = intval($row['ticket_assigned_to']);
if ($ticket_assigned_to) {
$ticket_assigned_agent = nullable_htmlentities($row['user_name']);
$ticket_assigned_agent = escapeHtml($row['user_name']);
} else {
$ticket_assigned_agent = '';
}
@@ -57,24 +57,24 @@ if ($ticket_assigned_to) {
$ticket_quote_id = intval($row['ticket_quote_id']);
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_type = escapeHtml($row['asset_type']);
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_name = escapeHtml($row['location_name']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
$location_phone = formatPhoneNumber($row['location_phone']);
//Get Total Ticket Time
$ticket_total_reply_time = mysqli_query($mysqli, "SELECT SEC_TO_TIME(SUM(TIME_TO_SEC(ticket_reply_time_worked))) AS ticket_total_reply_time FROM ticket_replies WHERE ticket_reply_archived_at IS NULL AND ticket_reply_ticket_id = $ticket_id");
$row = mysqli_fetch_assoc($ticket_total_reply_time);
$ticket_total_reply_time = nullable_htmlentities($row['ticket_total_reply_time']);
$ticket_total_reply_time = escapeHtml($row['ticket_total_reply_time']);
$ticket_total_reply_time_display = formatDuration($ticket_total_reply_time);
$sql_invoices = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_status LIKE 'Draft' AND invoice_client_id = $client_id ORDER BY invoice_number ASC");
@@ -134,12 +134,12 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_invoices)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
$invoice_status = nullable_htmlentities($row['invoice_status']);
$invoice_date = nullable_htmlentities($row['invoice_date']);
$invoice_due = nullable_htmlentities($row['invoice_due']);
$invoice_scope = escapeHtml($row['invoice_scope']);
$invoice_status = escapeHtml($row['invoice_status']);
$invoice_date = escapeHtml($row['invoice_date']);
$invoice_due = escapeHtml($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']);
?>
<option value="<?php echo $invoice_id; ?>"><?php echo "$invoice_prefix$invoice_number | $invoice_scope"; ?></option>
@@ -182,7 +182,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -313,7 +313,7 @@ ob_start();
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
while ($row = mysqli_fetch_assoc($taxes_sql)) {
$tax_id_select = intval($row['tax_id']);
$tax_name = nullable_htmlentities($row['tax_name']);
$tax_name = escapeHtml($row['tax_name']);
$tax_percent = floatval($row['tax_percent']);
?>
<option value="<?php echo $tax_id_select; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>

12
agent/modals/ticket/ticket_merge.php
View File

@@ -11,10 +11,10 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets
);
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$sql_merge = mysqli_query($mysqli, "SELECT * FROM tickets
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
@@ -53,11 +53,11 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_merge)) {
$ticket_id_merge = intval($row['ticket_id']);
$ticket_prefix_merge = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix_merge = escapeHtml($row['ticket_prefix']);
$ticket_number_merge = intval($row['ticket_number']);
$ticket_status_name_merge = nullable_htmlentities($row['ticket_status_name']);
$client_name_merge = nullable_htmlentities($row['client_name']);
$ticket_subject_merge = nullable_htmlentities($row['ticket_subject']);
$ticket_status_name_merge = escapeHtml($row['ticket_status_name']);
$client_name_merge = escapeHtml($row['client_name']);
$ticket_subject_merge = escapeHtml($row['ticket_subject']);
?>
<option value="<?= $ticket_id_merge ?>">
<?= "$ticket_prefix_merge$ticket_number_merge ($ticket_status_name_merge) $client_name_merge - $ticket_subject_merge" ?>

6
agent/modals/ticket/ticket_priority.php
View File

@@ -11,11 +11,11 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tickets
);
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Generate the HTML form content using output buffering.
ob_start();

26
agent/modals/ticket/ticket_quote_add.php
View File

@@ -22,25 +22,25 @@ $ticket_sql = mysqli_query(
$row = mysqli_fetch_assoc($ticket_sql);
$client_id = intval($row['client_id']);
$client_rate = floatval($row['client_rate']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_category = intval($row['ticket_category']);
$ticket_category_display = nullable_htmlentities($row['category_name']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_category_display = escapeHtml($row['category_name']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_billable = intval($row['ticket_billable']);
$ticket_onsite = intval($row['ticket_onsite']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_created_by = intval($row['ticket_created_by']);
$ticket_date = date('Y-m-d g:i A', strtotime($ticket_created_at));
$ticket_first_response_at = nullable_htmlentities($row['ticket_first_response_at']);
$ticket_first_response_at = escapeHtml($row['ticket_first_response_at']);
if ($ticket_first_response_at) {
$ticket_first_response_date_time = date('Y-m-d g:i A', strtotime($ticket_first_response_at));
} else {
$ticket_first_response_date_time = '';
}
$ticket_resolved_at = nullable_htmlentities($row['ticket_resolved_at']);
$ticket_resolved_at = escapeHtml($row['ticket_resolved_at']);
if ($ticket_resolved_at) {
$ticket_resolved_date = date('Y-m-d g:i A', strtotime($ticket_resolved_at));
} else {
@@ -49,17 +49,17 @@ if ($ticket_resolved_at) {
$ticket_assigned_to = intval($row['ticket_assigned_to']);
if ($ticket_assigned_to) {
$ticket_assigned_agent = nullable_htmlentities($row['user_name']);
$ticket_assigned_agent = escapeHtml($row['user_name']);
} else {
$ticket_assigned_agent = '';
}
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_type = escapeHtml($row['asset_type']);
@@ -108,7 +108,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
<?php } ?>
@@ -214,7 +214,7 @@ ob_start();
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
while ($row = mysqli_fetch_assoc($taxes_sql)) {
$tax_id_select = intval($row['tax_id']);
$tax_name = nullable_htmlentities($row['tax_name']);
$tax_name = escapeHtml($row['tax_name']);
$tax_percent = floatval($row['tax_percent']);
?>
<option value="<?php echo $tax_id_select; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>

4
agent/modals/ticket/ticket_reply_edit.php
View File

@@ -11,10 +11,10 @@ $sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies
);
$row = mysqli_fetch_assoc($sql);
$ticket_reply_type = nullable_htmlentities($row['ticket_reply_type']);
$ticket_reply_type = escapeHtml($row['ticket_reply_type']);
$ticket_reply_time_worked = date_create($row['ticket_reply_time_worked']);
$ticket_reply_time_worked_formatted = date_format($ticket_reply_time_worked, 'H:i:s');
$ticket_reply = nullable_htmlentities($row['ticket_reply']);
$ticket_reply = escapeHtml($row['ticket_reply']);
$client_id = intval($row['ticket_client_id']);
if ($client_id) {

2
agent/modals/ticket/ticket_reply_redact.php
View File

@@ -11,7 +11,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies
);
$row = mysqli_fetch_assoc($sql);
$ticket_reply = nullable_htmlentities($row['ticket_reply']);
$ticket_reply = escapeHtml($row['ticket_reply']);
$client_id = intval($row['ticket_client_id']);
// Generate the HTML form content using output buffering.

2
agent/modals/ticket/ticket_task_approver_add.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tasks
);
$row = mysqli_fetch_assoc($sql);
$task_name = nullable_htmlentities($row['task_name']);
$task_name = escapeHtml($row['task_name']);
// Generate the HTML form content using output buffering.
ob_start();

14
agent/modals/ticket/ticket_task_edit.php
View File

@@ -10,9 +10,9 @@ $sql = mysqli_query($mysqli, "SELECT * FROM tasks
);
$row = mysqli_fetch_assoc($sql);
$task_name = nullable_htmlentities($row['task_name']);
$task_name = escapeHtml($row['task_name']);
$task_completion_estimate = intval($row['task_completion_estimate']);
$task_completed_at = nullable_htmlentities($row['task_completed_at']);
$task_completed_at = escapeHtml($row['task_completed_at']);
// Approvals
$sql_task_approvals = mysqli_query($mysqli, "
@@ -76,12 +76,12 @@ ob_start();
<tbody>
<?php while ($row = mysqli_fetch_assoc($sql_task_approvals)) {
$approval_id = intval($row['approval_id']);
$approval_scope = nullable_htmlentities($row['approval_scope']);
$approval_type = nullable_htmlentities($row['approval_type']);
$approval_user_name = nullable_htmlentities($row['user_name']);
$approval_status = nullable_htmlentities($row['approval_status']);
$approval_scope = escapeHtml($row['approval_scope']);
$approval_type = escapeHtml($row['approval_type']);
$approval_user_name = escapeHtml($row['user_name']);
$approval_status = escapeHtml($row['approval_status']);
$approval_created_by = intval($row['approval_created_by']);
$approval_approved_by = nullable_htmlentities($row['approval_approved_by']);
$approval_approved_by = escapeHtml($row['approval_approved_by']);
?>
<tr>
<td><?= ucfirst($approval_scope) ?></td>