<?php
# This is a form to add companies to the database, or edit existing ones.

# Our boilerplate include file
include ('standardinclude.inc');


# Here we send our POST variables off to be processed
# Since register_globals is off, this is the perfect opportunity to validate our data.
#
# Here we're defining our variables for all user-supplied data
# and sending these defintions to getpostvars(),
# which will retrieve the POST variables and check for tainting, etc.
$company_id       = getpostvars('company_id', 11);
$company_name     = getpostvars('company_name', 90);
$address1         = getpostvars('address1', 40);
$address2         = getpostvars('address2', 40);
$city             = getpostvars('city', 30);
$state_id         = getpostvars('state_id', 2);
$zip              = getpostvars('zip', 5);
$contact_name     = getpostvars('contact_name', 30);
$contact_title    = getpostvars('contact_title', 30);
$contact_email    = getpostvars('contact_email', 30);
$url              = getpostvars('url', 50);
$phone_area       = getpostvars('phone_area', 3);
$phone_exchange   = getpostvars('phone_exchange', 3);
$phone_digits     = getpostvars('phone_digits', 4);
$phone_extension  = getpostvars('phone_extension', 4);
$fax_area         = getpostvars('fax_area', 3);
$fax_exchange     = getpostvars('fax_exchange', 3);
$fax_digits       = getpostvars('fax_digits', 4);
$fax_extension    = getpostvars('fax_extension', 4);
$validated        = getpostvars('validated', 5);
$password         = getpostvars('password', 16);
$verified         = getpostvars('verified', 16);
$companytask      = getpostvars('companytask', 8);



# Let's set up our DB variables.
$fields      = 'company_name, address1, address2, city, state_id, zip';
$fields      .= ', contact_name, contact_title, contact_email, url';
$fields      .= ', phone_area, phone_exchange, phone_digits, phone_extension';
$fields      .= ', fax_area, fax_exchange, fax_digits, fax_extension';

$values      = "'$company_name', '$address1', '$address2', '$city', '$state_id', '$zip'";
$values      .= ", '$contact_name', '$contact_title', '$contact_email', '$url'";
$values      .= ", '$phone_area', '$phone_exchange', '$phone_digits', '$phone_extension'";
$values      .= ", '$fax_area', '$fax_exchange', '$fax_digits', '$fax_extension'";

$updates    = "company_name = '$company_name', address1 = '$address1', address2 ='$address2'";
$updates    .= ", city = '$city', state_id = '$state_id', zip = '$zip'";
$updates    .= ", contact_name = '$contact_name', contact_title = '$contact_title'";
$updates    .= ", contact_email = '$contact_email', url = '$url'";
$updates    .= ", phone_area = '$phone_area', phone_exchange = '$phone_exchange'";
$updates    .= ", phone_digits = '$phone_digits', phone_extension = '$phone_extension'";
$updates    .= ", fax_area = '$fax_area', fax_exchange = '$fax_exchange'";
$updates    .= ", fax_digits = '$fax_digits', fax_extension = '$fax_extension'";



# Are we adding a new company or updating an existing one?
if ( $companytask == 'edit') {
  $title  = 'Edit Company';

  # retrieve the data from the database
  $result = mysql_query("SELECT $fields FROM company where company_id = $company_id");

  # We only want to pull from the DB once.
  if ( !(preg_match("/\w/", $company_name)) ) {      # does $company_name contain valid data?
    while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) {

      # Next we convert to scalar variables
      $company_name    = $row["company_name"];
      $address1        = $row["address1"];
      $address2        = $row["address2"];
      $city            = $row["city"];
      $state_id        = $row["state_id"];
      $zip             = $row["zip"];
      $contact_name    = $row["contact_name"];
      $contact_title   = $row["contact_title"];
      $contact_email   = $row["contact_email"];
      $url             = $row["url"];
      $phone_area      = $row["phone_area"];
      $phone_exchange  = $row["phone_exchange"];
      $phone_digits    = $row["phone_digits"];
      $phone_extension = $row["phone_extension"];
      $fax_area        = $row["fax_area"];
      $fax_exchange    = $row["fax_exchange"];
      $fax_digits      = $row["fax_digits"];
      $fax_extension   = $row["fax_extension"];

    }  # end while
  }  # end if
} else {
  $title  = 'Add Company';
  #$queryaction  = 'insert';
  $companytask   = "add";
}

###############################################################################################
#                                       print header                                          #
###############################################################################################

include ("$settingspath/header.inc");


###############################################################################################
#                             print the form, or insert the data?                             #
###############################################################################################

if ( ( !($verified == 'true') ) ) {
  # we're still trying to input data, so let's print the form to the user
  include ('companyform.inc');

} else {
  # we're done with the form, so let's do the DB insert
  if ( $companytask == 'add') {
    @mysql_query ("INSERT INTO company ($fields) VALUES ($values)", $link);
    print "<big><b>Thanks. Company \"$company_name\" was added to the database.</b></big><br>\n";
    mysql_error($link);

  } else if ( $companytask == 'edit') {
    @mysql_query ("UPDATE company SET $updates WHERE company_id = '$company_id'", $link);
    print "<big><b>Thanks. The record for \"$company_name\" was updated.</b></big><br>\n";
    mysql_error($link);
  }

}


###############################################################################################
#                                      print footer                                           #
###############################################################################################

include("$settingspath/plainfooter.inc");

?>
