First Commit

ajax/ajaxSearchStudents.php

@@ -0,0 +1,126 @@
+<?php
+  
+  $ValidAccess = 2010;
+  $sessionName = 'hotlunch';
+  session_name($sessionName);
+  session_start();
+  require_once("include/globals.php");
+
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   logExit("Session is not active",$moduleName);
+   exit;
+}
+
+// CSRF token validation
+include "include/ajax.csrfToken.php";
+
+
+  if (!in_array($_SESSION['UserInfo']['type'],array('SuperUser','System Administrator','Application Administrator','Schedule Team','Financial','Financial Team'))) {
+     logExit("Invalid user access\n");
+     exit;
+  }
+
+
+  $moduleName = "ajaxSearchStudents.php";
+  // startLog($moduleName);
+
+
+  $searchTerm  = db_escape_string(urldecode($_GET['s']));
+  $schoolId    = db_escape_string($_GET['sn']);
+  $baseSchool  = db_escape_string(urldecode($_GET['bn']));
+  $scheduleNum = db_escape_string($_GET['sch']);
+  $results = array();
+
+  // find all matching students
+  $rconds = "p.school_num='{$baseSchool}' AND p.user_num = u.record_num ";
+  $rconds = "p.school_num='{$baseSchool}' ";
+  if (strlen($searchTerm) == 1) {
+    $sText = "'" . db_escape_string($searchTerm) . "%'";
+    $sTextB = "'" . db_escape_string($searchTerm) . "%'";
+    $nconds = "";
+    if (is_numeric($searchTerm)) $nconds = " OR p.record_num = $searchTerm";
+    // $conds = "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR u.last_name LIKE $sText OR u.home_phone LIKE $sTextB OR student_number LIKE $sText $nconds) ";
+    $conds = "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR student_number LIKE $sText $nconds) ";
+  } else {
+    $words = explode(' ',$searchTerm);
+    $conds = "";
+    for ($i = 0; $i < count($words); $i++) {
+      $word = trim($words[$i]);
+      $sText = "'" . db_escape_string($word) . "%'";
+      $sTextB = "'%" . db_escape_string($word) . "%'";
+      $nconds = "";
+      if (is_numeric($word)) $nconds = " OR p.record_num = $word";
+      // $conds .= "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR u.last_name LIKE $sText OR u.home_phone LIKE $sTextB OR student_number LIKE $sText $nconds) ";
+      $conds .= "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR student_number LIKE $sText $nconds) ";
+    }
+  }
+
+  $conds = "$rconds $conds";
+  $order = "p.last_name ASC, p.first_name ASC";
+  $q = "SELECT p.* FROM people AS p LEFT JOIN users AS u ON p.user_num = u.record_num WHERE p.status != 'Inactive' AND {$conds} ORDER BY $order";
+  // writeLog("query: $q\n");
+  $r = db_query($q);
+
+  while ($d = db_fetch_array($r, MYSQL_ASSOC)) {
+    extract($d, EXTR_PREFIX_ALL, 's');
+
+    $ur = array();
+    if ($s_people_type == 'Student') {
+      $s_user_num = intval($s_user_num);
+      $u = db_query("SELECT * FROM users WHERE record_num = $s_user_num");
+      if (db_num_rows($u)) {
+        $ur = db_fetch_array($u, MYSQL_ASSOC);
+        extract($ur, EXTR_PREFIX_ALL, 'u');
+      }
+    }
+
+    // Check if this person has an order
+    if ($scheduleNum > 0) {
+      $query = "SELECT count(*) FROM hotlunch_order_header " .
+               "WHERE school_num = $schoolId " .
+               "AND ordered_by_num = $s_record_num " .
+               "AND schedule_num = $scheduleNum";
+      $num_orders = db_getVal($query);
+      $has_order = false;
+      if ($num_orders == 1) $has_order = true;
+    }
+
+    // Encode the name and user id for transmission
+    $s_first_name = preg_replace('/\+/',' ',urlencode($s_first_name));
+    $s_last_name = preg_replace('/\+/',' ',urlencode($s_last_name));
+    $u_userid = preg_replace('/\+/',' ',urlencode($u_userid));
+
+    // Encode the user array values
+    $parent = preg_replace('/\+/',' ',urlencode($ur['first_name'] . ' ' . $ur['last_name']));
+    $ur['first_name'] = preg_replace('/\+/',' ',urlencode($ur['first_name']));
+    $ur['last_name'] = preg_replace('/\+/',' ',urlencode($ur['last_name']));
+
+    if ($s_people_type == 'Staff') $parent = "Staff";
+
+    // Encode the people array values
+    $d['first_name'] = preg_replace('/\+/',' ',urlencode($d['first_name']));
+    $d['last_name'] = preg_replace('/\+/',' ',urlencode($d['last_name']));
+
+    // Ensure that a price category is returned
+    if (strlen($s_menu_price_category) == 0) $s_menu_price_category = 'Regular';
+
+    $results[] = array_merge($d, array(
+      'user' => $ur,
+      'id' => $s_record_num,
+      'name' => "{$s_first_name} {$s_last_name}",
+      'parent' => $parent,
+      'phone' => $u_home_phone,
+      'hasOrder' => $has_order,
+      'balance' => $u_balance,
+      'birthdate' => $s_birthdate,
+      'age' => $s_age,
+      'sex' => $s_sex,
+      'grade' => $s_school_grade,
+      'student_number' => $s_student_number,
+      'price_category' => $s_menu_price_category
+    ));
+  }
+
+  echo(json_encode($results));
+?>