diff --git a/admin/modals/vendor_template/vendor_template_edit.php b/admin/modals/vendor_template/vendor_template_edit.php index c7a41a8d..a013eda3 100644 --- a/admin/modals/vendor_template/vendor_template_edit.php +++ b/admin/modals/vendor_template/vendor_template_edit.php @@ -6,19 +6,19 @@ $vendor_template_id = intval($_GET['id']); $sql = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); -$vendor_name = nullable_htmlentities($row['vendor_template_name']); -$vendor_description = nullable_htmlentities($row['vendor_template_description']); -$vendor_account_number = nullable_htmlentities($row['vendor_template_account_number']); -$vendor_contact_name = nullable_htmlentities($row['vendor_template_contact_name']); +$vendor_name = escapeHtml($row['vendor_template_name']); +$vendor_description = escapeHtml($row['vendor_template_description']); +$vendor_account_number = escapeHtml($row['vendor_template_account_number']); +$vendor_contact_name = escapeHtml($row['vendor_template_contact_name']); $vendor_phone_country_code = intval($row['vendor_template_phone_country_code']); $vendor_phone = formatPhoneNumber($row['vendor_template_phone'], $vendor_phone_country_code); -$vendor_extension = nullable_htmlentities($row['vendor_template_extension']); -$vendor_email = nullable_htmlentities($row['vendor_template_email']); -$vendor_website = nullable_htmlentities($row['vendor_template_website']); -$vendor_hours = nullable_htmlentities($row['vendor_template_hours']); -$vendor_sla = nullable_htmlentities($row['vendor_template_sla']); -$vendor_code = nullable_htmlentities($row['vendor_template_code']); -$vendor_notes = nullable_htmlentities($row['vendor_template_notes']); +$vendor_extension = escapeHtml($row['vendor_template_extension']); +$vendor_email = escapeHtml($row['vendor_template_email']); +$vendor_website = escapeHtml($row['vendor_template_website']); +$vendor_hours = escapeHtml($row['vendor_template_hours']); +$vendor_sla = escapeHtml($row['vendor_template_sla']); +$vendor_code = escapeHtml($row['vendor_template_code']); +$vendor_notes = escapeHtml($row['vendor_template_notes']); // Generate the HTML form content using output buffering. ob_start(); diff --git a/admin/post/vendor_template.php b/admin/post/vendor_template.php index 5b0c869e..93d7ef1f 100644 --- a/admin/post/vendor_template.php +++ b/admin/post/vendor_template.php @@ -11,27 +11,27 @@ if (isset($_POST['add_vendor_template'])) { validateCSRFToken($_POST['csrf_token']); - $name = sanitizeInput($_POST['name']); - $description = sanitizeInput($_POST['description']); - $account_number = sanitizeInput($_POST['account_number']); - $contact_name = sanitizeInput($_POST['contact_name']); + $name = escapeSql($_POST['name']); + $description = escapeSql($_POST['description']); + $account_number = escapeSql($_POST['account_number']); + $contact_name = escapeSql($_POST['contact_name']); $phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']); $phone = preg_replace("/[^0-9]/", '', $_POST['phone']); $extension = preg_replace("/[^0-9]/", '', $_POST['extension']); - $email = sanitizeInput($_POST['email']); - $website = preg_replace("(^https?://)", "", sanitizeInput($_POST['website'])); - $hours = sanitizeInput($_POST['hours']); - $sla = sanitizeInput($_POST['sla']); - $code = sanitizeInput($_POST['code']); - $notes = sanitizeInput($_POST['notes']); + $email = escapeSql($_POST['email']); + $website = preg_replace("(^https?://)", "", escapeSql($_POST['website'])); + $hours = escapeSql($_POST['hours']); + $sla = escapeSql($_POST['sla']); + $code = escapeSql($_POST['code']); + $notes = escapeSql($_POST['notes']); mysqli_query($mysqli,"INSERT INTO vendor_templates SET vendor_template_name = '$name', vendor_template_description = '$description', vendor_template_contact_name = '$contact_name', vendor_template_phone = '$phone', vendor_template_extension = '$extension', vendor_template_email = '$email', vendor_template_website = '$website', vendor_template_hours = '$hours', vendor_template_sla = '$sla', vendor_template_code = '$code', vendor_template_account_number = '$account_number', vendor_template_notes = '$notes'"); $vendor_template_id = mysqli_insert_id($mysqli); - logAction("Vendor Template", "Create", "$session_name created vendor template $name", 0, $vendor_template_id); + logAudit("Vendor Template", "Create", "$session_name created vendor template $name", 0, $vendor_template_id); - flash_alert("Vendor template $name created"); + flashAlert("Vendor template $name created"); redirect(); @@ -42,19 +42,19 @@ if (isset($_POST['edit_vendor_template'])) { validateCSRFToken($_POST['csrf_token']); $vendor_template_id = intval($_POST['vendor_template_id']); - $name = sanitizeInput($_POST['name']); - $description = sanitizeInput($_POST['description']); - $account_number = sanitizeInput($_POST['account_number']); - $contact_name = sanitizeInput($_POST['contact_name']); + $name = escapeSql($_POST['name']); + $description = escapeSql($_POST['description']); + $account_number = escapeSql($_POST['account_number']); + $contact_name = escapeSql($_POST['contact_name']); $phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']); $phone = preg_replace("/[^0-9]/", '', $_POST['phone']); $extension = preg_replace("/[^0-9]/", '', $_POST['extension']); - $email = sanitizeInput($_POST['email']); - $website = preg_replace("(^https?://)", "", sanitizeInput($_POST['website'])); - $hours = sanitizeInput($_POST['hours']); - $sla = sanitizeInput($_POST['sla']); - $code = sanitizeInput($_POST['code']); - $notes = sanitizeInput($_POST['notes']); + $email = escapeSql($_POST['email']); + $website = preg_replace("(^https?://)", "", escapeSql($_POST['website'])); + $hours = escapeSql($_POST['hours']); + $sla = escapeSql($_POST['sla']); + $code = escapeSql($_POST['code']); + $notes = escapeSql($_POST['notes']); if ($_POST['global_update_vendor_name'] == 1 ?? 0) { $sql_global_update_vendor_name = ", vendor_name = '$name'"; @@ -135,9 +135,9 @@ if (isset($_POST['edit_vendor_template'])) { mysqli_query($mysqli,"UPDATE vendors SET $sql WHERE vendor_template_id = $vendor_template_id"); } - logAction("Vendor Template", "Edit", "$session_name edited vendor template $name", 0, $vendor_template_id); + logAudit("Vendor Template", "Edit", "$session_name edited vendor template $name", 0, $vendor_template_id); - flash_alert("Vendor template $name edited"); + flashAlert("Vendor template $name edited"); redirect(); @@ -149,16 +149,16 @@ if (isset($_GET['delete_vendor_template'])) { $vendor_template_id = intval($_GET['delete_vendor_template']); - $vendor_template_name = sanitizeInput(getFieldById('vendor_templates', $vendor_template_id, 'vendor_template_name')); + $vendor_template_name = escapeSql(getFieldById('vendor_templates', $vendor_template_id, 'vendor_template_name')); // If its a template reset all vendors based off this template to no template base mysqli_query($mysqli,"UPDATE vendors SET vendor_template_id = 0 WHERE vendor_template_id = $vendor_template_id"); mysqli_query($mysqli,"DELETE FROM vendor_templates WHERE vendor_template_id = $vendor_template_id"); - logAction("Vendor Template", "Delete", "$session_name deleted vendor template $vendor_template_name"); + logAudit("Vendor Template", "Delete", "$session_name deleted vendor template $vendor_template_name"); - flash_alert("Vendor Template $vendor_template_name deleted", 'error'); + flashAlert("Vendor Template $vendor_template_name deleted", 'error'); redirect(); diff --git a/admin/vendor_template.php b/admin/vendor_template.php index 2b5cdb64..c16a9c06 100644 --- a/admin/vendor_template.php +++ b/admin/vendor_template.php @@ -33,7 +33,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -66,28 +66,28 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_assoc($sql)) { $vendor_template_id = intval($row['vendor_template_id']); - $vendor_template_name = nullable_htmlentities($row['vendor_template_name']); - $vendor_template_description = nullable_htmlentities($row['vendor_template_description']); + $vendor_template_name = escapeHtml($row['vendor_template_name']); + $vendor_template_description = escapeHtml($row['vendor_template_description']); if (empty($vendor_template_description)) { $vendor_template_description_display = "-"; } else { $vendor_template_description_display = $vendor_template_description; } - $vendor_template_account_number = nullable_htmlentities($row['vendor_template_account_number']); - $vendor_template_contact_name = nullable_htmlentities($row['vendor_template_contact_name']); + $vendor_template_account_number = escapeHtml($row['vendor_template_account_number']); + $vendor_template_contact_name = escapeHtml($row['vendor_template_contact_name']); if (empty($vendor_template_contact_name)) { $vendor_template_contact_name_display = "-"; } else { $vendor_template_contact_name_display = $vendor_template_contact_name; } $vendor_template_phone = formatPhoneNumber($row['vendor_template_phone']); - $vendor_template_extension = nullable_htmlentities($row['vendor_template_extension']); - $vendor_template_email = nullable_htmlentities($row['vendor_template_email']); - $vendor_template_website = nullable_htmlentities($row['vendor_template_website']); - $vendor_template_hours = nullable_htmlentities($row['vendor_template_hours']); - $vendor_template_sla = nullable_htmlentities($row['vendor_template_sla']); - $vendor_template_code = nullable_htmlentities($row['vendor_template_code']); - $vendor_template_notes = nullable_htmlentities($row['vendor_template_notes']); + $vendor_template_extension = escapeHtml($row['vendor_template_extension']); + $vendor_template_email = escapeHtml($row['vendor_template_email']); + $vendor_template_website = escapeHtml($row['vendor_template_website']); + $vendor_template_hours = escapeHtml($row['vendor_template_hours']); + $vendor_template_sla = escapeHtml($row['vendor_template_sla']); + $vendor_template_code = escapeHtml($row['vendor_template_code']); + $vendor_template_notes = escapeHtml($row['vendor_template_notes']); ?> diff --git a/agent/modals/vendor/vendor_add_from_template.php b/agent/modals/vendor/vendor_add_from_template.php index b18f6e0a..bfc2421a 100644 --- a/agent/modals/vendor/vendor_add_from_template.php +++ b/agent/modals/vendor/vendor_add_from_template.php @@ -32,7 +32,7 @@ ob_start(); $sql_vendor_templates = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC"); while ($row = mysqli_fetch_assoc($sql_vendor_templates)) { $vendor_template_id = intval($row['vendor_template_id']); - $vendor_template_name = nullable_htmlentities($row['vendor_template_name']); + $vendor_template_name = escapeHtml($row['vendor_template_name']); ?> diff --git a/agent/modals/vendor/vendor_details.php b/agent/modals/vendor/vendor_details.php index 25e18b3f..93d4f128 100644 --- a/agent/modals/vendor/vendor_details.php +++ b/agent/modals/vendor/vendor_details.php @@ -7,21 +7,21 @@ $vendor_id = intval($_GET['id']); $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); -$name = sanitizeInput($row['vendor_name']); -$description = sanitizeInput($row['vendor_description']); -$account_number = sanitizeInput($row['vendor_account_number']); -$contact_name = sanitizeInput($row['vendor_contact_name']); +$name = escapeSql($row['vendor_name']); +$description = escapeSql($row['vendor_description']); +$account_number = escapeSql($row['vendor_account_number']); +$contact_name = escapeSql($row['vendor_contact_name']); $phone = preg_replace("/[^0-9]/", '',$row['vendor_phone']); $extension = preg_replace("/[^0-9]/", '',$row['vendor_extension']); -$email = sanitizeInput($row['vendor_email']); -$website = sanitizeInput($row['vendor_website']); -$hours = sanitizeInput($row['vendor_hours']); -$sla = sanitizeInput($row['vendor_sla']); -$code = sanitizeInput($row['vendor_code']); -$notes = sanitizeInput($row['vendor_notes']); +$email = escapeSql($row['vendor_email']); +$website = escapeSql($row['vendor_website']); +$hours = escapeSql($row['vendor_hours']); +$sla = escapeSql($row['vendor_sla']); +$code = escapeSql($row['vendor_code']); +$notes = escapeSql($row['vendor_notes']); -// Generate the HTML form content using output buffering. ob_start(); + ?>
@@ -29,7 +29,7 @@ ob_start();
-
+
@@ -151,43 +151,43 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_assoc($sql)) { $vendor_id = intval($row['vendor_id']); - $vendor_name = nullable_htmlentities($row['vendor_name']); - $vendor_description = nullable_htmlentities($row['vendor_description']); + $vendor_name = escapeHtml($row['vendor_name']); + $vendor_description = escapeHtml($row['vendor_description']); if ($vendor_description) { $vendor_description_display = $vendor_description; } else { $vendor_description_display = "-"; } - $vendor_account_number = nullable_htmlentities($row['vendor_account_number']); + $vendor_account_number = escapeHtml($row['vendor_account_number']); if ($vendor_account_number) { $vendor_account_number_display = "
Account #: $vendor_account_number
"; } else { $vendor_account_number_display = ''; } - $vendor_contact_name = nullable_htmlentities($row['vendor_contact_name']); + $vendor_contact_name = escapeHtml($row['vendor_contact_name']); if ($vendor_contact_name) { $vendor_contact_name_display = $vendor_contact_name; } else { $vendor_contact_name_display = "-"; } - $vendor_phone_country_code = nullable_htmlentities($row['vendor_phone_country_code']); - $vendor_phone = nullable_htmlentities(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code)); - $vendor_extension = nullable_htmlentities($row['vendor_extension']); - $vendor_email = nullable_htmlentities($row['vendor_email']); - $vendor_website = nullable_htmlentities($row['vendor_website']); + $vendor_phone_country_code = escapeHtml($row['vendor_phone_country_code']); + $vendor_phone = escapeHtml(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code)); + $vendor_extension = escapeHtml($row['vendor_extension']); + $vendor_email = escapeHtml($row['vendor_email']); + $vendor_website = escapeHtml($row['vendor_website']); if ($vendor_website) { $vendor_website_display = "$vendor_website "; } else { $vendor_website_display = "-"; } - $vendor_hours = nullable_htmlentities($row['vendor_hours']); - $vendor_sla = nullable_htmlentities($row['vendor_sla']); - $vendor_code = nullable_htmlentities($row['vendor_code']); - $vendor_notes = nullable_htmlentities($row['vendor_notes']); - $vendor_created_at = nullable_htmlentities($row['vendor_created_at']); - $vendor_archived_at = nullable_htmlentities($row['vendor_archived_at']); + $vendor_hours = escapeHtml($row['vendor_hours']); + $vendor_sla = escapeHtml($row['vendor_sla']); + $vendor_code = escapeHtml($row['vendor_code']); + $vendor_notes = escapeHtml($row['vendor_notes']); + $vendor_created_at = escapeHtml($row['vendor_created_at']); + $vendor_archived_at = escapeHtml($row['vendor_archived_at']); $vendor_template_id = intval($row['vendor_template_id']); - $vendor_template_name = nullable_htmlentities($row['vendor_template_name']); + $vendor_template_name = escapeHtml($row['vendor_template_name']); if ($vendor_template_id) { $vendor_template_display = "
$vendor_template_name
"; } else {