Revize 7227a179

Re #7580 administrace - obory

old/html/multidic/app/webroot/administration/add_field.php

@@ -1 +1 @@
 <?php
+
+$action = $_REQUEST['action'];
+
 if (!Empty($action) && $action == "insert_new_field") {
   require_once("./administration/field.php");
   
   $zobrazit_znovu = true;
-  
+  $name = $_REQUEST['name'];
+  $en_field = $_REQUEST['en_field'];
+
   if (Empty($name)) {
     print_hlasku("Český název musíte vyplnit");
   }

old/html/multidic/app/webroot/administration/edit_field.php

@@ -2 +2 @@
   require_once("./administration/field.php");
 
 $vypis_edit = true;
+$action = $_REQUEST['action'];
+$field_id = $_REQUEST['field_id'];
 
 if (!Empty($action) && $action == "edit_field") {
 
+  $name = $_REQUEST['name'];
+  $en_field = $_REQUEST['en_field'];
+
   if (Empty($name)) {
     print_hlasku("Název musíte vyplnit");
   }
@@ -18 +23 @@
 
   $Record      = get_field($field_id);
   $name        = $Record[1];
+  $en_field    = $Record[2];
 
 ?>
 <script language="JavaScript">

old/html/multidic/app/webroot/administration/field.php

@@ -89 +89 @@
   require_once("./classes/db.php");
   $spojeni = new DB_Sql();
   $dotaz = "INSERT INTO field (field, en_field) 
-                    VALUES ('$field', '$en_field')";
-  $spojeni->query($dotaz);
-  if ($spojeni->connection->errno != 0) {
+                    VALUES ('" . $spojeni->escape_string($field) . "', '" . $spojeni->escape_string($en_field) . "')";
+  $result = $spojeni->query($dotaz);
+  if (!$result) {
     print_hlasku("Bohužel, obor '$field' - '$en_field' se nepodařilo přidat.");
     return false;
   }
@@ -107 +107 @@
 function print_table_of_field($order = "IDfield", $od = 0, $limit = 30) {
   require_once("./classes/db.php");
   $spojeni = new DB_Sql();
-  $dotaz = "SELECT * FROM field ORDER BY \"$order\" OFFSET $od LIMIT $limit";
+  $dotaz = "SELECT * FROM field ORDER BY $order LIMIT $od, $limit";
   $radky = $spojeni->query($dotaz);
   $navrat = "<h3 class=\"nadpis2\">Výpis oborů</h3>";
   $navrat .= get_razeni($order, $od, $limit);
   $navrat .= "<table><form action=\"\" method=\"post\">";
   $navrat .= get_header_of_table();
-  while ($spojeni->next_record()) {
-    $navrat .= get_row_of_table($spojeni->Record, 1, 3);
+  while ($record = $spojeni->next_record()) {
+    $navrat .= get_row_of_table($record, 1, 3);
   }
   $navrat .= get_foot_of_table();
   $navrat .= '<input type="hidden" name="action" value="delete_field">';
@@ -125 +125 @@
 function possible_to_delete_field($field_id) {
   require_once("./classes/db.php");
   $spojeni = new DB_Sql();
-  $dotaz = "SELECT * FROM dict WHERE field LIKE '$field_id'";
-  $spojeni->query($dotaz);
-  if ($spojeni->connection->errno != 0) {
-    print_hlasku($spojeni->$Error);
+  $dotaz = "SELECT * FROM dict WHERE field LIKE '" . $spojeni->escape_string($field_id) ."'";
+  $result = $spojeni->query($dotaz);
+  if (!$result) {
+    print_hlasku('Nelze odstranit obor');
     return false;
   }
   //echo $spojeni->num_rows();
@@ -145 +145 @@
   }
   require_once("./classes/db.php");
   $spojeni = new DB_Sql();
-  $dotaz = "DELETE FROM field WHERE \"IDfield\" = $ID";
-  $spojeni->query($dotaz);
-  if ($spojeni->connection->errno != 0) {
+  $dotaz = "DELETE FROM field WHERE IDfield = " . $spojeni->escape_string($ID);
+  $result = $spojeni->query($dotaz);
+  if (!$result) {
     //print_hlasku("Bohužel, obor '$field' se nepodařilo smazat.");
     return false;
   }
@@ -159 +159 @@
 function update_field($name, $en_field, $field_id) {
   require_once("./classes/db.php");
   $spojeni = new DB_Sql();
-  $dotaz = "UPDATE field SET field = '$name',
-                            en_field = '$en_field'
-                            WHERE \"IDfield\" = $field_id";
-  $spojeni->query($dotaz);
-  if ($spojeni->connection->errno != 0) {
+  $dotaz = "UPDATE field SET field = '" . $spojeni->escape_string($name) ."',
+                            en_field = '" . $spojeni->escape_string($en_field) ."'
+                            WHERE IDfield = " . $spojeni->escape_string($field_id);
+  $result = $spojeni->query($dotaz);
+  if (!$result) {
     print_hlasku("Obor se nepodařilo upravit.");
     echo_zpet_do_oboru();
     return false;
@@ -177 +177 @@
 function get_field($field_id) {
   require_once("./classes/db.php");
   $spojeni = new DB_Sql();
-  $dotaz = "SELECT * FROM field WHERE \"IDfield\" LIKE '$field_id'";
+  $dotaz = "SELECT * FROM field WHERE IDfield LIKE '" . $spojeni->escape_string($field_id) . "'";
   $radky = $spojeni->query($dotaz);
 
-  $spojeni->next_record();
+  $record = $spojeni->next_record();
   
-  return $spojeni->Record;
+  return $record;
 }
 ?>

old/html/multidic/app/webroot/administration/list_field.php

@@ -1 +1 @@
 <?php
 require_once("./administration/field.php");
 
+$action = $_REQUEST['action'];
+
 if (!Empty($action) && $action == "delete_field") {
   $coun_true = 0;
   $coun_false = 0;
+  $smaz = $_REQUEST['smaz'];
   if (Is_Array($smaz)) {
     for (Reset($smaz); Current($smaz); Next($smaz)) {
       //echo "Index: ".Key($smaz)."/n<br>";
@@ -18 +21 @@
     print_hlasku("Bohužel,$coun_false oborů se nepodařilo smazat ($coun_true se podařilo smazat)");
 }
 
-if (!Empty($serad)) {
-  print_table_of_field($order, $od, $limit);
+if (!Empty($_REQUEST['serad'])) {
+  print_table_of_field($_REQUEST['order'], $_REQUEST['od'], $_REQUEST['limit']);
 }
 else {
   print_table_of_field();