First Commit

ajax.supplierSearch.php

@@ -0,0 +1,99 @@
+<?php
+$ValidAccess = 2010;
+require_once("include/globals.php");
+
+
+$moduleName = "ajax.supplierSearch.php";
+// startLog($moduleName);
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   logExit("Session is not active",$moduleName);
+   exit();
+}
+
+// Set userType
+$userType = "Parent";
+if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
+if ($userType != 'Admin') return;
+
+
+// Ensure that only valid user types have access to this module
+if ($userType != 'Admin') {
+   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
+   logExit($error_message);
+   exit;
+}
+
+
+// CSRF token validation
+include "include/ajax.csrfToken.php";
+
+
+writeLog(print_r($_GET, true));
+
+// Get search text
+$text = trim(strtolower($_GET['term']));
+$words = explode(' ',$text);
+writeLog("text: $text\n");
+
+// Other parameters
+$mode = 'all-schools';
+if (array_key_exists('mode', $_GET)) $mode = db_escape_string($_GET['mode']);
+
+$school_where = "";
+$copy_where = "AND copy_flag = 'Y' ";
+if ($mode == 'current-school') {
+   $school_where = "AND suppliers.school_num = $supplier_school_num ";
+   $copy_where = "";
+}
+writeLog("mode: $mode");
+writeLog("school_where: $school_where");
+
+$return_data = array();
+
+
+// Format where clause
+$swhere = "";
+for ($i = 0; $i < count($words); $i++) {
+   $word = db_escape_string($words[$i]);
+   $num = 0;
+   if (is_numeric($word)) $num = intval($word);
+   $swhere .= "AND (school_name LIKE '%$word%' " .
+                "OR suppliers.supplier_name LIKE '$word%' " .
+                "OR suppliers.city LIKE '$word%' " .
+                "OR suppliers.contact_name LIKE '$word%' " .
+                "OR suppliers.province LIKE '$word%') ";
+}
+
+// Get matching records
+$query = "SELECT DISTINCT supplier_name,suppliers.contact_name,suppliers.city,suppliers.province,school_name,suppliers.record_num " .
+         "FROM suppliers,schools " .
+         "WHERE suppliers.status = 'Active' " .
+         "AND suppliers.school_num = schools.record_num " .
+         $school_where .
+         $copy_where .
+         $swhere .
+         "ORDER BY supplier_name";
+writeLog("query: $query\n");
+$results = db_query($query);
+$num_records = db_num_rows($results);
+writeLog("Num Records: $num_records");
+
+// Format data for return
+if ($num_records > 0) {
+   writeLog("records: $num_records\n");
+   while ($row = db_fetch_assoc($results)) {
+      extract($row);
+      $name = "$supplier_name, $city, $province - $school_name";
+      $return_data[] = array("value" => $name,
+                             "supplier_name" => $supplier_name,
+                             "supplier_num" => $record_num);
+   }
+}
+
+
+writeLog("completed\n");
+echo(json_encode($return_data));
+return false;
+
+?>