<?php
# This is a form to add companies to the database

# this defines getpostvars()
include('getpostvars.inc');

# let's print our header
$title	= 'Add Company';
include ("header.inc");

# here we send our POST variables off to be processed
# Since register_globals is off, this is the perfect opportunity to validate out data.
#
# Here we're defining our variables for all user-supplied data
# and sending these defintions to getpostvars(),
# which will retrieve the POST variables and check for tainting, etc.
$company_name		= getpostvars('company_name', 90);
$address1			= getpostvars('address1', 40);
$address2			= getpostvars('address2', 40);
$city				= getpostvars('city', 30);
$state_id			= getpostvars('state_id', 2);
$zip				= getpostvars('zip', 5);
$contact_name		= getpostvars('contact_name', 30);
$contact_title		= getpostvars('contact_title', 30);
$contact_email		= getpostvars('contact_email', 30);
$url				= getpostvars('url', 50);
$phone_area			= getpostvars('phone_area', 3);
$phone_exchange		= getpostvars('phone_exchange', 3);
$phone_digits		= getpostvars('phone_digits', 4);
$phone_extension	= getpostvars('phone_extension', 4);
$fax_area			= getpostvars('fax_area', 3);
$fax_exchange		= getpostvars('fax_exchange', 3);
$fax_digits			= getpostvars('fax_digits', 4);
$fax_extension		= getpostvars('fax_extension', 4);
$validated			= getpostvars('validated', 5);
$password			= getpostvars('password', 16);
$verified			= getpostvars('verified', 16);


#echo "password = $password<br>";

#
# let's set up our database connection
include ('database.inc');

# here we find out if the user is a permitted user
# first we set up the shadow password
$shadowpass = 'ricksha3w';
$authenticated = 'false';
#
# NOTE: This should be refactored to include a username (techician_id)
# also the passwords for each user should be stored in the database
#
# NOTE: At some point, a login screen and some sort of sessions should be set up

# patience, grasshopper... at some point we'll verify the data for sanity's sake
$validated = 'true';

if ($password == $shadowpass) {
  $authenticated = 'true';
}


?>


<form action="<?= $PHP_SELF ?>" method="POST" enctype="text">
<p><big><b>Please fill in the company information:</b></big></p>
<table>
  <tr>
    <td><b>Company Name:</b> </td>
    <td><input type="text" name="company_name" size=90 value="<?= $company_name ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
  <tr>
    <td><b>Address 1:</b>  </td>
    <td><input type="text" name="address1" size=40 value="<?= $address1 ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
    <tr>
    <td><b>Address 2:</b>  </td>
    <td><input type="text" name="address2" size=40 value="<?= $address2 ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
  <tr>
    <td><b>City:</b>  </td>
    <td><input type="text" name="city" size=30 value="<?= $city ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
  <tr>
    <td><b>State:</b>  </td>
    <td><input type="text" name="state_id" size=2 value="<?= $state_id ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
  <tr>
    <td><b>Zip Code:</b>  </td>
    <td><input type="text" name="zip" size=7 value="<?= $zip ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
  <tr>
    <td><b>Contact's Name:</b>  </td>
    <td><input type="text" name="contact_name" size=30 value="<?= $contact_name ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
    <tr>
    <td><b>Contact's Title:</b>  </td>
    <td><input type="text" name="contact_title" size=30 value="<?= $contact_title ?>">  </td>
    <td>  </td>
    <td>  </td>
  <tr>
    <td><b>Contact's Email Address:</b>  </td>
    <td><input type="text" name="contact_email" size=30 value="<?= $contact_email ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
    <tr>
    <td><b>Website:</b>  </td>
    <td><input type="text" name="url" size=30 value="<?= $url ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
  <tr>
    <td><b>Phone Number:</b>  </td>
    <td>(&nbsp;<input type="text" name="phone_area" size=3 value="<?= $phone_area ?>">&nbsp;)&nbsp;
    <input type="text" name="phone_exchange" size=3 value="<?= $phone_exchange ?>">&nbsp;&nbsp;-&nbsp;
	<input type="text" name="phone_digits" size=4 value="<?= $phone_digits ?>">&nbsp;&nbsp;Ext.&nbsp;
    <input type="text" name="phone_extension" size=4 value="<?= $phone_extension ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
  <tr>
    <td><b>Fax:</b>  </td>
    <td>(&nbsp;<input type="text" name="fax_area" size=3 value="<?= $fax_area ?>">&nbsp;)&nbsp;
    <input type="text" name="fax_exchange" size=3 value="<?= $fax_exchange ?>">&nbsp;&nbsp;-&nbsp;
	<input type="text" name="fax_digits" size=4 value="<?= $fax_digits ?>">&nbsp;&nbsp;Ext.&nbsp;
    <input type="text" name="fax_extension" size=4 value="<?= $fax_extension ?>">  </td>
    <td>  </td>
    <td>  </td>
  </tr>
</table>
</p>

<?php
#Please enter your password in order to write to the database:
#<input type="password" name="password" size=16">
?>

<p><input type=checkbox name="verified" value="true"> All data has been verified.
<p><input type=submit value="Submit"></p>
</form>


<?php
# Now we can do our insert

if ( ($verified == 'true') ) {
  $fields		= 'company_name, address1, address2, city, state_id, zip';
  $fields		.= ', contact_name, contact_title, contact_email, url';
  $fields		.= ', phone_area, phone_exchange, phone_digits, phone_extension';
  $fields		.= ', fax_area, fax_exchange, fax_digits, fax_extension';

  $values		= "'$company_name', '$address1', '$address2', '$city', '$state_id', '$zip'";
  $values		.= ", '$contact_name', '$contact_title', '$contact_email', '$url'";
  $values		.= ", '$phone_area', '$phone_exchange', '$phone_digits', '$phone_extension'";
  $values		.= ", '$fax_area', '$fax_exchange', '$fax_digits', '$fax_extension'";

  $table		= 'company';
  @mysql_query ("INSERT INTO $table ($fields) VALUES ($values)", $link);

  echo "<big><b>Thanks. Company \"$company_name\" was added to the database.</b></big><br>\n";

  include('dberrors_insert.inc');
}

# print_r($_POST);
?>
