First Commit

ajaxSearchUsers.php

@@ -0,0 +1,82 @@
+<?php
+  
+  $ValidAccess = 2010;
+  include "include/globals.php";
+
+  // session_start();
+
+  // startLog("ajaxSearchUsers.php");
+
+  if (SessionActive() != 1 || ! UserLoggedIn()) {
+    logExit("Session is not active\n");
+    exit();
+  }
+
+  // CSRF token validation
+  include "include/ajax.csrfToken.php";
+  writeLog("passed csrf token check");
+
+
+  if (!in_array($_SESSION['UserInfo']['type'],array('SuperUser','System Administrator','Application Administrator','Schedule Team','Financial','Financial Team'))) {
+     logExit("Invalid user access\n");
+     exit();
+  }
+
+
+
+  $searchTerm  = db_escape_string(urldecode($_GET['s']));
+  $schoolId    = db_escape_string($_GET['sn']);
+  $baseSchool  = db_escape_string(urldecode($_GET['bn']));
+  $results = array();
+
+  writeLog("searchTerm: $searchTerm");
+  writeLog("schoolId: $schoolId");
+
+  // find all matching students
+  $rconds = "u.school_num='{$baseSchool}' AND";
+  if (strlen($searchTerm) == 1) {
+    $sText = "'" . db_escape_string($searchTerm) . "%'";
+    $sTextB = $sText;
+    $sTextB = "'%" . db_escape_string($searchTerm) . "%'";
+  } else {
+    $sTextB = "'%" . db_escape_string($searchTerm) . "%'";
+    $sText = "'" . db_escape_string($searchTerm) . "%'";
+  }
+  $nConds = "";
+  if (is_numeric($searchTerm)) $nConds = "OR u.record_num = $searchTerm";
+  $conds = "$rconds (u.first_name LIKE $sText OR u.last_name LIKE $sText OR u.userid LIKE $sTextB OR u.email LIKE $sTextB OR u.email2 LIKE $sTextB OR u.email3 LIKE $sTextB OR u.home_phone LIKE $sTextB $nConds)";
+  $order = "u.last_name ASC, u.first_name ASC";
+  $r = db_query("SELECT u.* FROM users AS u WHERE {$conds} ORDER BY $order");
+
+  while ($d = db_fetch_assoc($r)) {
+    extract($d, EXTR_PREFIX_ALL, 'u');
+
+    $num_students = db_getVal("SELECT count(*) FROM people WHERE school_num = $baseSchool AND user_num = $u_record_num");
+
+    // Encode the name and user id for transmission
+    $u_name = preg_replace('/\+/',' ',urlencode($u_first_name.' '.$u_last_name));
+    $u_userid = preg_replace('/\+/',' ',urlencode($u_userid));
+
+    // Encode the user array values
+    $parent = preg_replace('/\+/',' ',urlencode($d['first_name'] . ' ' . $d['last_name']));
+    $d['first_name'] = preg_replace('/\+/',' ',urlencode($d['first_name']));
+    $d['last_name'] = preg_replace('/\+/',' ',urlencode($d['last_name']));
+
+    if (isset($u_people_type) && $u_people_type == 'Staff') $parent = "Staff";
+
+    // Encode the people array values
+    $d['first_name'] = preg_replace('/\+/',' ',urlencode($d['first_name']));
+    $d['last_name'] = preg_replace('/\+/',' ',urlencode($d['last_name']));
+
+    $results[] = array(
+      'record_num' => $u_record_num,
+      'name' => $u_name,
+      'userid' => $u_userid,
+      'phone' => $u_home_phone,
+      'type' => $u_type,
+      'students' => $num_students
+    );
+  }
+
+  echo(json_encode($results));
+?>