60 lines
1.8 KiB
PHP
60 lines
1.8 KiB
PHP
<?php
|
|
|
|
$ValidAccess = 2010;
|
|
$sessionName = 'hotlunch';
|
|
session_name($sessionName);
|
|
session_start();
|
|
require_once("include/globals.php");
|
|
|
|
if (SessionActive() != 1 || ! UserLoggedIn()) {
|
|
logExit("Session is not active\n");
|
|
exit;
|
|
}
|
|
|
|
// CSRF token validation
|
|
include "include/ajax.csrfToken.php";
|
|
|
|
|
|
|
|
$searchTerm = db_escape_string(urldecode($_REQUEST['nameText']));
|
|
$schoolId = db_escape_string($_REQUEST['sn']);
|
|
$scheduleNum = db_escape_string($_REQUEST['sch']);
|
|
|
|
// find all matching students
|
|
$rconds = "p.school_num='{$schoolId}' AND p.user_num = u.record_num AND";
|
|
if (strlen($searchTerm) == 1) {
|
|
$sText = "'{$searchTerm}%'";
|
|
} else {
|
|
$sText = "'%{$searchTerm}%'";
|
|
$sText = "'{$searchTerm}%'";
|
|
}
|
|
$conds = "$rconds (p.first_name LIKE $sText OR p.last_name LIKE $sText OR u.last_name LIKE $sText OR u.home_phone LIKE $sText)";
|
|
$order = "p.last_name ASC, p.first_name ASC";
|
|
$r = db_query("SELECT p.* FROM people AS p, users AS u WHERE {$conds} ORDER BY $order");
|
|
|
|
$results = "<ul>\n";
|
|
while ($d = db_fetch_array($r, MYSQL_ASSOC)) {
|
|
extract($d, EXTR_PREFIX_ALL, 's');
|
|
|
|
if ($s_people_type == 'Student') {
|
|
$u = db_query("SELECT * FROM users WHERE record_num = $s_user_num");
|
|
$ur = db_fetch_array($u, MYSQL_ASSOC);
|
|
extract($ur, EXTR_PREFIX_ALL, 'u');
|
|
}
|
|
|
|
// Check if this person has an order
|
|
$query = "SELECT count(*) FROM hotlunch_order_header " .
|
|
"WHERE school_num = $schoolId " .
|
|
"AND ordered_by_num = $s_record_num " .
|
|
"AND schedule_num = $scheduleNum";
|
|
$num_orders = db_getVal($query);
|
|
$has_order = "No";
|
|
if ($num_orders == 1) $has_order = "Yes";
|
|
|
|
$results .= "<li id='$s_record_num'>$s_first_name $s_last_name</li>\n";
|
|
}
|
|
$results .= "</ul>\n";
|
|
echo($results);
|
|
|
|
?>
|