1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
<?php
$formid = "Usr";
require_once "inc/configure.php";
$refid = (int) filter_var($_REQUEST['refid'], FILTER_SANITIZE_STRING);
$userid = filter_var($_REQUEST['userid'], FILTER_SANITIZE_STRING);
//vdump($_REQUEST); //exit;
if( $_REQUEST['action']=="master_user_modifyform" && !empty($refid) ){
$pwd = $_REQUEST['userpwd'];
$username = filter_var($_REQUEST['username'], FILTER_SANITIZE_STRING);
$companyid = filter_var($_REQUEST['companyid'], FILTER_SANITIZE_STRING);
$department = filter_var($_REQUEST['department'], FILTER_SANITIZE_STRING);
$lang = strtolower(filter_var($_REQUEST['lang'], FILTER_SANITIZE_STRING));
$status = filter_var($_REQUEST['status'], FILTER_SANITIZE_STRING);
$createby = filter_var($_SESSION['user'], FILTER_SANITIZE_STRING);
$lastupby = filter_var($_SESSION['user'], FILTER_SANITIZE_STRING);
if($_REQUEST['userpwd'] != $_REQUEST['userpwd_confirm']){
$msg = "Passwords do not match";
header("Location: master_user_modifyform.php?refid=$refid&error=$msg");
exit;
}
//exit;
$sql_param = array(':refid' => $refid,
':userid' => $userid,
':username' => $username,
':companyid' => $companyid,
':department' => $department,
':lang' => $lang,
':status' => $status,
':lastupby' => $lastupby);
if(!empty($pwd)){
$sql_PPu_field="userpwd = :userpwd,";
$sql_param[':userpwd'] = md5salt($pwd);
}
unset($pwd);
$dbh->beginTransaction();
$sql = "UPDATE master_user SET
username = :username,
companyid = :companyid,
department = :department,
lang = :lang,
status = :status,
lastupby = :lastupby,
$sql_PPu_field
lastupdate = getdate()
WHERE refid=:refid and userid=:userid";
$sth = $dbh->prepare($sql);
$q= $sth->execute( $sql_param );
pdo_showerror($sth, $q);
/*echo $sth->getSQL( $sql_param ) . HTML_EOL; */
//exit;
$sql = "DELETE FROM sec_user_profile
WHERE userid=:userid";
$sth = $dbh->prepare($sql);
$q= $sth->execute( array(':userid' => $userid) );
// echo $sth->getSQL( array(':userid' => $userid) ).HTML_EOL;
pdo_showerror($sth, $q);
if(is_array($_REQUEST['p'])){
foreach($_REQUEST['p'] as $profile => $val){
if( !empty($val) ){
//vdump($profile);
$sql = "INSERT INTO sec_user_profile (
userid, profile_name,
createby, createdate, lastupby, lastupdate
) VALUES (
:userid, :profile_name,
:createby, GETDATE(), :lastupby, GETDATE()
)";
$sth = $dbh->prepare($sql);
$q= $sth->execute( array(':userid' => $userid,
':profile_name' => $profile,
':createby' => $createby,
':lastupby' => $lastupby) );
/*
echo $sth->getSQL( array(':userid' => $userid,
':profile_name' => $profile,
':createby' => $createby,
':lastupby' => $lastupby) ).HTML_EOL;
*/
pdo_showerror($sth, $q);
}
}
}
//exit;
$dbh->commit();
header("Location: master_user_modifyform.php?refid=$refid&msg=Saved.");
print "Saved.";
exit;
}
myerror("Invalid Request");
|