From f2a45ce518a1f6141faca79411c56b8d95ca9466 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Sun, 19 Feb 2023 21:37:24 -0500 Subject: [PATCH] UI/sanitizeInput work on Trips --- client_trips.php | 40 ++++++++++++++++++++++++---------------- trip_add_modal.php | 10 +++++----- trip_copy_modal.php | 10 +++++----- trip_edit_modal.php | 10 +++++----- trips.php | 38 +++++++++++++++++++++++--------------- 5 files changed, 62 insertions(+), 46 deletions(-) diff --git a/client_trips.php b/client_trips.php index 51456060..d6010fa2 100644 --- a/client_trips.php +++ b/client_trips.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "trip_date"; } @@ -16,8 +16,8 @@ if (!isset($_GET['o'])) { //Date From and Date To Filter if (isset($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } else { $dtf = "0000-00-00"; $dtt = "9999-00-00"; @@ -42,9 +42,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Trips

+

Trips

- +
@@ -54,7 +54,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -63,8 +63,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export - Import + Export + Import
@@ -88,15 +88,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); "; @@ -124,12 +124,20 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Map it + + Map it +
- Edit - Copy + + Edit + + + Copy +
- Delete + + Delete +
diff --git a/trip_add_modal.php b/trip_add_modal.php index 983977b1..b2edb92b 100644 --- a/trip_add_modal.php +++ b/trip_add_modal.php @@ -2,7 +2,7 @@
-
New Trip
+
New Trip
@@ -75,7 +75,7 @@ // WIP Need to only show users within the session company $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id IN('$session_user_company_access') ORDER BY user_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $user_id = $row['user_id']; + $user_id = intval($row['user_id']); $user_name = htmlentities($row['user_name']); ?> @@ -103,7 +103,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $session_company_id ORDER BY client_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $client_id = $row['client_id']; + $client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); ?> @@ -120,8 +120,8 @@
- - + +
diff --git a/trip_copy_modal.php b/trip_copy_modal.php index 460c2b37..4b8a66d5 100644 --- a/trip_copy_modal.php +++ b/trip_copy_modal.php @@ -2,7 +2,7 @@
-
Copying Trip
+
Copying Trip
@@ -76,7 +76,7 @@ // WIP Need to only show users within the session company $sql_trips = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC"); while ($row = mysqli_fetch_array($sql_trips)) { - $user_id_select = $row['user_id']; + $user_id_select = intval($row['user_id']); $user_name_select = htmlentities($row['user_name']); ?> @@ -102,7 +102,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $session_company_id ORDER BY client_name ASC"); while ($row = mysqli_fetch_array($sql_clients)) { - $client_id_select = $row['client_id']; + $client_id_select = intval($row['client_id']); $client_name_select = htmlentities($row['client_name']); ?> @@ -116,8 +116,8 @@
- - + +
diff --git a/trip_edit_modal.php b/trip_edit_modal.php index a4b33fd6..07bb1d3f 100644 --- a/trip_edit_modal.php +++ b/trip_edit_modal.php @@ -2,7 +2,7 @@
-
Edit Trip
+
Edit Trip
@@ -78,7 +78,7 @@ // WIP Need to only show users within the session company $sql_trips = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC"); while ($row = mysqli_fetch_array($sql_trips)) { - $user_id_select = $row['user_id']; + $user_id_select = intval($row['user_id']); $user_name_select = htmlentities($row['user_name']); ?> @@ -105,7 +105,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $session_company_id ORDER BY client_name ASC"); while ($row = mysqli_fetch_array($sql_clients)) { - $client_id_select = $row['client_id']; + $client_id_select = intval($row['client_id']); $client_name_select = htmlentities($row['client_name']); ?> @@ -122,8 +122,8 @@
- - + +
diff --git a/trips.php b/trips.php index 66b87dd3..3a747219 100644 --- a/trips.php +++ b/trips.php @@ -2,7 +2,7 @@ require_once("inc_all.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "trip_date"; } @@ -21,8 +21,8 @@ if (empty($_GET['canned_date'])) { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -76,9 +76,9 @@ $total_pages = ceil($total_found_rows / 10);
-

Trips

+

Trips

- +
@@ -87,7 +87,7 @@ $total_pages = ceil($total_found_rows / 10);
- +
@@ -96,7 +96,7 @@ $total_pages = ceil($total_found_rows / 10);
- +
@@ -152,15 +152,15 @@ $total_pages = ceil($total_found_rows / 10);
- Map it + + Map it +
- Edit - Copy + + Edit + + + Copy +
- Delete + + Delete +