First Commit

ajax.UserSearch.php

@@ -0,0 +1,136 @@
+<?php
+$ValidAccess = 2010;
+
+$sessionName    = 'hotlunch';
+session_name($sessionName);
+session_start();
+
+require_once("include/globals.php");
+
+$moduleName = "ajax.UserSearch.php";
+// if ($_SESSION['UserInfo']['type'] == 'SuperUser') startLog($moduleName);
+// $db_mode = $_SESSION['user_mode'];
+// writeLog("db_mode: $db_mode");
+// writeLog("_SESSION['db_mode']: ".$_SESSION['db_mode']);
+// writeLog("currentDB: $currentDB");
+// writeLog("_SESSION[db_dbname]: ".$_SESSION['db_dbname']);
+
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   logExit("Session is not active",$moduleName);
+   exit();
+}
+
+// Set userType
+$userType = "Parent";
+if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
+if ($userType != 'Admin') return;
+
+
+// Ensure that only valid user types have access to this module
+if ($userType != 'Admin') {
+   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
+   logExit($error_message);
+   exit;
+}
+
+
+
+// CSRF token validation
+include "include/ajax.csrfToken.php";
+
+
+
+// Get search text
+$text = trim(strtolower($_GET['term']));
+$words = explode(' ',$text);
+writeLog("text: $text\n");
+
+
+// Format where clause
+$uwhere = "";
+$pwhere = "";
+for ($i = 0; $i < count($words); $i++) {
+   $word = db_escape_string($words[$i]);
+   if (is_numeric($word)) {
+      $uwhere .= "AND record_num = $word ";
+      $pwhere .= "AND user_num = $word ";
+   }
+   else {
+      $uwhere .= "AND (userid LIKE '%$word%' " .
+                   "OR first_name LIKE '$word%' " .
+                   "OR last_name LIKE '$word%' " .
+                   "OR email LIKE '%$word%' " .
+                   "OR home_phone LIKE '%$word%' " .
+                   "OR cell_phone LIKE '%$word%' " .
+                   "OR daytime_phone LIKE '%$word%') ";
+      $pwhere .= "AND (p.first_name  LIKE '$word%' " .
+                   "OR p.last_name LIKE '$word%') ";
+   }
+}
+
+// Get matching user records
+$query = "SELECT DISTINCT school_num,userid,first_name,last_name,email,type,record_num FROM users " .
+         "WHERE school_num = $base_school_num " .
+         $uwhere .
+         "ORDER BY last_name,first_name";
+writeLog("query: $query\n");
+$results = db_query($query);
+
+// Format data for return
+$return_data = array();
+$num_records = db_num_rows($results);
+if ($num_records > 0) {
+   writeLog("records: $num_records\n");
+   $return_data[] = array("value" => "-- ".getLanguageText('TEXT-USERS')." --------------------",
+                          "user_num" => 0);
+   while ($row = db_fetch_assoc($results)) {
+      extract($row);
+      $num = db_getVal("SELECT count(*) FROM people WHERE school_num = $base_school_num AND user_num = $record_num");
+      if ($userid != $email) $email .= " ($userid)";
+      writeLog("$record_num - $first_name $last_name - $type");
+      $return_data[] = array("value" => "$first_name $last_name - $type ($num) $email",
+                             "user_num" => $record_num);
+   }
+}
+
+
+// Get matching student records
+$query = "SELECT DISTINCT school_num,user_num,first_name,last_name,people_type,record_num FROM people " .
+         "WHERE school_num = $base_school_num " .
+         "AND user_num > 0 " .
+         "AND people_type = 'Student' " .
+         $pwhere .
+         "ORDER BY last_name,first_name";
+$query = "SELECT DISTINCT p.school_num,p.user_num,p.first_name,p.last_name,p.people_type,p.record_num,u.userid " .
+         "FROM people AS p, users AS u " .
+         "WHERE p.school_num = $base_school_num " .
+         "AND u.school_num = $base_school_num " .
+         "AND p.user_num > 0 " .
+         "AND p.user_num = u.record_num " .
+         $pwhere .
+         "ORDER BY last_name,first_name";
+writeLog("query: $query\n");
+$results = db_query($query);
+
+// Format data for return
+$num_records = db_num_rows($results);
+if ($num_records > 0) {
+   writeLog("records: $num_records\n");
+   $return_data[] = array("value" => "-- ".$GlobalText['Students']." --------------------",
+                          "user_num" => 0);
+   while ($row = db_fetch_assoc($results)) {
+      extract($row);
+      writeLog("$user_num - $first_name $last_name - $people_type");
+      $return_data[] = array("value" => "$first_name $last_name - $people_type ($userid)",
+                             "user_num" => $user_num);
+   }
+}
+
+
+
+writeLog("completed\n");
+echo(json_encode($return_data));
+return false;
+
+?>