First Commit

ajax/ajaxGetNames.php

@@ -0,0 +1,59 @@
+<?php
+  
+  $ValidAccess = 2010;
+  $sessionName = 'hotlunch';
+  session_name($sessionName);
+  session_start();
+  require_once("include/globals.php");
+
+  if (SessionActive() != 1 || ! UserLoggedIn()) {
+     logExit("Session is not active\n");
+     exit;
+  }
+
+  // CSRF token validation
+  include "include/ajax.csrfToken.php";
+
+
+
+  $searchTerm  = db_escape_string(urldecode($_REQUEST['nameText']));
+  $schoolId    = db_escape_string($_REQUEST['sn']);
+  $scheduleNum = db_escape_string($_REQUEST['sch']);
+
+  // find all matching students
+  $rconds = "p.school_num='{$schoolId}' AND p.user_num = u.record_num AND";
+  if (strlen($searchTerm) == 1) {
+    $sText = "'{$searchTerm}%'";
+  } else {
+    $sText = "'%{$searchTerm}%'";
+    $sText = "'{$searchTerm}%'";
+  }
+  $conds = "$rconds (p.first_name LIKE $sText OR p.last_name LIKE $sText OR u.last_name LIKE $sText OR u.home_phone LIKE $sText)";
+  $order = "p.last_name ASC, p.first_name ASC";
+  $r = db_query("SELECT p.* FROM people AS p, users AS u WHERE {$conds} ORDER BY $order");
+
+  $results = "<ul>\n";
+  while ($d = db_fetch_array($r, MYSQL_ASSOC)) {
+    extract($d, EXTR_PREFIX_ALL, 's');
+
+    if ($s_people_type == 'Student') {
+      $u = db_query("SELECT * FROM users WHERE record_num = $s_user_num");
+      $ur = db_fetch_array($u, MYSQL_ASSOC);
+      extract($ur, EXTR_PREFIX_ALL, 'u');
+    }
+
+    // Check if this person has an order
+    $query = "SELECT count(*) FROM hotlunch_order_header " .
+             "WHERE school_num = $schoolId " .
+             "AND ordered_by_num = $s_record_num " .
+             "AND schedule_num = $scheduleNum";
+    $num_orders = db_getVal($query);
+    $has_order = "No";
+    if ($num_orders == 1) $has_order = "Yes";
+
+    $results .= "<li id='$s_record_num'>$s_first_name $s_last_name</li>\n";
+  }
+  $results .= "</ul>\n";
+  echo($results);
+
+?>