diff --git a/application/config/database.php b/application/config/database.php index 76a4a1b..76c2428 100755 --- a/application/config/database.php +++ b/application/config/database.php @@ -75,7 +75,7 @@ $query_builder = TRUE; $db['default'] = array( 'dsn' => '', - 'hostname' => 'localhost', + 'hostname' => 'database-1.chgossuk454l.eu-north-1.rds.amazonaws.com', //'username' => 'root', 'username' => 'gzsgtetc_beve', //'password' => '', diff --git a/application/controllers/Admin.php b/application/controllers/Admin.php index 396d4d9..4c011d1 100755 --- a/application/controllers/Admin.php +++ b/application/controllers/Admin.php @@ -167,7 +167,7 @@ class Admin extends CI_Controller { $this->load->database(); $worker_id = $_GET['worker_id']; $data['selectedWorkerId'] = $worker_id; - $data['schedule'] = $this->db->query("SELECT * FROM worker_schedule WHERE worker_id = '$worker_id'")->result(); + $data['schedule'] = $this->db->query("SELECT * FROM worker_schedule WHERE worker_id = ?", array($worker_id))->result(); } $this->load->view('admin/worker_schedule', $data); @@ -580,17 +580,21 @@ class Admin extends CI_Controller { $target_dir = getcwd()."/assets/img/"; $target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']); $imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION)); - - if (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) { + $allowedTypes = array('jpg', 'jpeg', 'png', 'gif', 'webp'); + + if (!in_array($imageFileType, $allowedTypes)) { + $data['message'] = 'Csak képfájlok engedélyezettek (jpg, png, gif, webp)!'; + $data['message_class'] = 'errorMessage'; + } elseif (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) { $data['message'] = 'A profilkép sikeresen feltöltve!'; - $data['message_class'] = 'successMessage'; - $data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType; - + $data['message_class'] = 'successMessage'; + $data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType; + } else { $data['message'] = 'Hiba a feltöltés közben!'; - $data['message_class'] = 'errorMessage'; + $data['message_class'] = 'errorMessage'; } - + } $workerArray = array( @@ -628,18 +632,22 @@ class Admin extends CI_Controller { $target_dir = getcwd()."/assets/img/"; $target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']); $imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION)); - - if (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) { + $allowedTypes = array('jpg', 'jpeg', 'png', 'gif', 'webp'); + + if (!in_array($imageFileType, $allowedTypes)) { + $data['message'] = 'Csak képfájlok engedélyezettek (jpg, png, gif, webp)!'; + $data['message_class'] = 'errorMessage'; + } elseif (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) { $data['message'] = 'A profilkép sikeresen feltöltve!'; - $data['message_class'] = 'successMessage'; - $data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType; + $data['message_class'] = 'successMessage'; + $data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType; $workerArray = array( 'worker_profile_img' => $data['worker_img'] ); $this->Log_model->addLog('workers', $data['currentUser']->username.' profilképet állított be a(z) '.$_POST['worker_name'].' nevű dolgozóhoz', $data['currentUser']->username); $this->Service_model->updateWorker($_POST['worker_id'], $workerArray); - + } else { $data['message'] = 'Hiba a feltöltés közben!'; $data['message_class'] = 'errorMessage'; diff --git a/application/controllers/Login.php b/application/controllers/Login.php index 1aef59c..31753bc 100755 --- a/application/controllers/Login.php +++ b/application/controllers/Login.php @@ -72,7 +72,7 @@ class Login extends CI_Controller { } else{ - $this->Log_model->addLog('login', 'Sikertelen bejelentkezési kísérlet - '.$_POST['username'].' / '.$_POST['password'],$_POST['username']); + $this->Log_model->addLog('login', 'Sikertelen bejelentkezési kísérlet - '.$_POST['username'],$_POST['username']); $data['message'] = 'Sikertelen bejelentkezés!'; $data['message_class'] = 'error'; } diff --git a/application/controllers/Pages.php b/application/controllers/Pages.php index efcd721..86e8046 100755 --- a/application/controllers/Pages.php +++ b/application/controllers/Pages.php @@ -121,10 +121,10 @@ class Pages extends CI_Controller { $workerListShow .= ''; @@ -231,8 +231,8 @@ class Pages extends CI_Controller { if(is_object($result)){ ?> -
-
worker_name;?>
+
+
worker_name, ENT_QUOTES, 'UTF-8');?>
load->database(); - $query = $this->db->query("INSERT INTO system_log(event_type, event_content, username) VALUES('".$eventType."','".$eventContent."','".$username."');"); + $query = $this->db->query("INSERT INTO system_log(event_type, event_content, username) VALUES(?, ?, ?)", array($eventType, $eventContent, $username)); } public function getAllLoginfo(){ diff --git a/application/models/Module_model.php b/application/models/Module_model.php index 2db0283..7fc9077 100755 --- a/application/models/Module_model.php +++ b/application/models/Module_model.php @@ -13,13 +13,13 @@ class Module_model extends CI_Model { public function getModuleById($module_id){ $this->load->database(); - $query = $this->db->query('SELECT * FROM modules WHERE module_id = "'.$module_id.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM modules WHERE module_id = ? LIMIT 1', array($module_id)); return $query->result()[0]; } public function getModuleBySlug($module_slug){ $this->load->database(); - $query = $this->db->query('SELECT * FROM modules WHERE module_slug = "'.$module_slug.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM modules WHERE module_slug = ? LIMIT 1', array($module_slug)); return $query->result()[0]; } @@ -145,11 +145,16 @@ public function is_groupId_available_in_module($module_id, $groupId){ public function updateModule($fieldName, $module_id, $moduleUserArray){ $this->load->database(); + $allowedFields = array('permission_group_ids', 'permission_ids'); + if (!in_array($fieldName, $allowedFields)) return; + if(!empty($moduleUserArray)){ - $query = $this->db->query("UPDATE modules SET ".$fieldName." ='".serialize($moduleUserArray)."' WHERE module_id = '".$module_id."';"); + $this->db->where('module_id', $module_id); + $this->db->update('modules', array($fieldName => serialize($moduleUserArray))); } else{ - $query = $this->db->query("UPDATE modules SET ".$fieldName." ='' WHERE module_id = '".$module_id."';"); + $this->db->where('module_id', $module_id); + $this->db->update('modules', array($fieldName => '')); } } @@ -174,7 +179,7 @@ public function getModulesByPermissionSlug($permissionSlug){ public function getPermissionBySlug($permissionSlug){ $this->load->database(); - $query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = "'.$permissionSlug.'";'); + $query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ?', array($permissionSlug)); if($query->num_rows() == 1){ return $query->result()[0]; } @@ -188,7 +193,7 @@ public function user_can_access_this_module($moduleSlug, $userId){ $this->load->model('User_model'); $selectedUser = $this->User_model->getUserById($userId); - $query = $this->db->query('SELECT * FROM modules WHERE module_slug = "'.$moduleSlug.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM modules WHERE module_slug = ? LIMIT 1', array($moduleSlug)); if($query->num_rows() == 1){ $result = $query->result()[0]; diff --git a/application/models/Service_model.php b/application/models/Service_model.php index 8b91f2a..34dc00c 100755 --- a/application/models/Service_model.php +++ b/application/models/Service_model.php @@ -8,10 +8,10 @@ class Service_model extends CI_Model { public function createService($serviceArray){ $this->load->database(); $query = $this->db->query('INSERT INTO services ( - service_type, - service_category_no, - service_category_en, - service_category_hu, + service_type, + service_category_no, + service_category_en, + service_category_hu, service_name_no, service_name_en, service_name_hu, @@ -22,76 +22,70 @@ class Service_model extends CI_Model { service_time, service_category_id, is_enabled - ) VALUES( - "'.$serviceArray['service_type'].'", - "'.$serviceArray['service_category_no'].'", - "'.$serviceArray['service_category_en'].'", - "'.$serviceArray['service_category_hu'].'", - "'.$serviceArray['service_name_no'].'", - "'.$serviceArray['service_name_en'].'", - "'.$serviceArray['service_name_hu'].'", - "'.$serviceArray['service_description_no'].'", - "'.$serviceArray['service_description_en'].'", - "'.$serviceArray['service_description_hu'].'", - "'.$serviceArray['service_price'].'", - "'.$serviceArray['service_time'].'", - "'.$serviceArray['service_category_id'].'", - "'.$serviceArray['is_enabled'].'" - );'); + ) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', array( + $serviceArray['service_type'], + $serviceArray['service_category_no'], + $serviceArray['service_category_en'], + $serviceArray['service_category_hu'], + $serviceArray['service_name_no'], + $serviceArray['service_name_en'], + $serviceArray['service_name_hu'], + $serviceArray['service_description_no'], + $serviceArray['service_description_en'], + $serviceArray['service_description_hu'], + $serviceArray['service_price'], + $serviceArray['service_time'], + $serviceArray['service_category_id'], + $serviceArray['is_enabled'] + )); } public function createServiceCategory($serviceCategoryArray){ $this->load->database(); $query = $this->db->query('INSERT INTO service_categories ( - serv_cat_slug, + serv_cat_slug, serv_cat_name - ) VALUES( - "'.$serviceCategoryArray['serv_cat_slug'].'", - "'.$serviceCategoryArray['serv_cat_name'].'" - );'); + ) VALUES(?, ?)', array( + $serviceCategoryArray['serv_cat_slug'], + $serviceCategoryArray['serv_cat_name'] + )); } public function updateService($service_id, $serviceArray){ $this->load->database(); - - foreach($serviceArray as $propertyKey => $propertyValue){ - $query = $this->db->query('UPDATE services SET '.$propertyKey.' = "'.$propertyValue.'" WHERE service_id = "'.$service_id.'";'); - } + $this->db->where('service_id', $service_id); + $this->db->update('services', $serviceArray); } public function updateServiceCategory($service_category_id, $serviceCategoryArray){ $this->load->database(); - - foreach($serviceCategoryArray as $propertyKey => $propertyValue){ - $query = $this->db->query('UPDATE service_categories SET '.$propertyKey.' = "'.$propertyValue.'" WHERE service_category_id = "'.$service_category_id.'";'); - } + $this->db->where('service_category_id', $service_category_id); + $this->db->update('service_categories', $serviceCategoryArray); } public function createWorker($workerArray){ $this->load->database(); $query = $this->db->query('INSERT INTO workers ( - worker_name, - worker_profile_img, + worker_name, + worker_profile_img, worker_info, is_beauty, is_barber, service_category_id - ) VALUES( - "'.$workerArray['worker_name'].'", - "'.$workerArray['worker_profile_img'].'", - "'.$workerArray['worker_info'].'", - "'.$workerArray['is_beauty'].'", - "'.$workerArray['is_barber'].'", - "'.$workerArray['service_category_id'].'" - );'); + ) VALUES(?, ?, ?, ?, ?, ?)', array( + $workerArray['worker_name'], + $workerArray['worker_profile_img'], + $workerArray['worker_info'], + $workerArray['is_beauty'], + $workerArray['is_barber'], + $workerArray['service_category_id'] + )); } public function updateWorker($worker_id, $workerArray){ $this->load->database(); - - foreach($workerArray as $propertyKey => $propertyValue){ - $query = $this->db->query('UPDATE workers SET '.$propertyKey.' = "'.$propertyValue.'" WHERE worker_id = "'.$worker_id.'";'); - } + $this->db->where('worker_id', $worker_id); + $this->db->update('workers', $workerArray); } public function updateBooking($booking_id, $bookingArray){ @@ -102,7 +96,7 @@ class Service_model extends CI_Model { public function getAllServiceByServiceType($service_type, $lang){ $this->load->database(); - $query = $this->db->query('SELECT * FROM services JOIN service_categories ON services.service_category_id = service_categories.service_category_id WHERE service_type = "'.$service_type.'" AND services.is_enabled = "1" AND services.is_deleted != "1" ORDER BY service_id ASC;'); + $query = $this->db->query('SELECT * FROM services JOIN service_categories ON services.service_category_id = service_categories.service_category_id WHERE service_type = ? AND services.is_enabled = "1" AND services.is_deleted != "1" ORDER BY service_id ASC', array($service_type)); $serviceArray = array(); if($query->num_rows() > 0){ foreach($query->result() as $resultItem){ @@ -149,7 +143,7 @@ class Service_model extends CI_Model { public function getServiceById($service_id){ $this->load->database(); - $query = $this->db->query('SELECT * FROM services WHERE service_id = "'.$service_id.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM services WHERE service_id = ? LIMIT 1', array($service_id)); if($query->num_rows() > 0){ return $query->result()[0]; } @@ -160,7 +154,7 @@ class Service_model extends CI_Model { public function getServiceCategoryById($service_category_id){ $this->load->database(); - $query = $this->db->query('SELECT * FROM service_categories WHERE service_category_id = "'.$service_category_id.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM service_categories WHERE service_category_id = ? LIMIT 1', array($service_category_id)); if($query->num_rows() > 0){ return $query->result()[0]; } @@ -218,7 +212,7 @@ class Service_model extends CI_Model { public function getWorkersByCategorySlug($serv_cat_slug){ $this->load->database(); - $query = $this->db->query('SELECT * FROM workers JOIN service_categories ON workers.service_category_id = service_categories.service_category_id WHERE workers.is_deleted != "1" AND serv_cat_slug = "'.$serv_cat_slug.'" ORDER BY worker_name ASC;'); + $query = $this->db->query('SELECT * FROM workers JOIN service_categories ON workers.service_category_id = service_categories.service_category_id WHERE workers.is_deleted != "1" AND serv_cat_slug = ? ORDER BY worker_name ASC', array($serv_cat_slug)); return $query->result(); } @@ -242,7 +236,7 @@ class Service_model extends CI_Model { public function deleteBooking($booking_id){ $this->load->database(); - $query = $this->db->query('DELETE FROM bookings WHERE booking_id = "'.$booking_id.'";'); + $query = $this->db->query('DELETE FROM bookings WHERE booking_id = ?', array($booking_id)); } public function getAllBookings(){ @@ -337,7 +331,7 @@ class Service_model extends CI_Model { $this->load->database(); $this->load->model('Service_model'); - $query = $this->db->query('SELECT * FROM bookings JOIN workers ON bookings.worker_id = workers.worker_id WHERE booking_date >= CURDATE() AND bookings.worker_id = "'.$workerID.'" ORDER BY booking_date DESC, booking_start_time ASC;'); + $query = $this->db->query('SELECT * FROM bookings JOIN workers ON bookings.worker_id = workers.worker_id WHERE booking_date >= CURDATE() AND bookings.worker_id = ? ORDER BY booking_date DESC, booking_start_time ASC', array($workerID)); if($query->num_rows() > 0){ $resultsArray = array(); @@ -381,7 +375,7 @@ class Service_model extends CI_Model { $this->load->database(); $this->load->model('Service_model'); - $query = $this->db->query('SELECT * FROM bookings WHERE booking_id = "'.$booking_id.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM bookings WHERE booking_id = ? LIMIT 1', array($booking_id)); if($query->num_rows() > 0){ return $query->result()[0]; } @@ -392,7 +386,7 @@ class Service_model extends CI_Model { public function getWorkerById($worker_id){ $this->load->database(); - $query = $this->db->query('SELECT * FROM workers WHERE worker_id = "'.$worker_id.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM workers WHERE worker_id = ? LIMIT 1', array($worker_id)); if($query->num_rows() > 0){ return $query->result()[0]; } @@ -430,9 +424,9 @@ class Service_model extends CI_Model { // --- Override ellenőrzés --- $overrideQuery = $this->db->query(" SELECT * FROM worker_schedule_overrides - WHERE worker_id = '$worker_id' AND date = '$selectedDate' + WHERE worker_id = ? AND date = ? LIMIT 1 - "); + ", array($worker_id, $selectedDate)); if ($overrideQuery->num_rows() > 0) { $override = $overrideQuery->row(); @@ -448,13 +442,13 @@ class Service_model extends CI_Model { $scheduleQuery = $this->db->query(" SELECT * FROM worker_schedule - WHERE worker_id = '{$worker_id}' - AND weekday = '{$weekday}' + WHERE worker_id = ? + AND weekday = ? AND ( is_alternate_week = 0 OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ") ) - "); + ", array($worker_id, $weekday)); if ($scheduleQuery->num_rows() == 0) { return []; @@ -490,7 +484,7 @@ class Service_model extends CI_Model { // --- Lunch break setup --- // Pre-fetch all bookings for the day so we can do hypothetical checks per slot - $workerRow = $this->db->query("SELECT lunch_window_start, lunch_window_end, lunch_preferred_time FROM workers WHERE worker_id = '$worker_id' LIMIT 1")->row(); + $workerRow = $this->db->query("SELECT lunch_window_start, lunch_window_end, lunch_preferred_time FROM workers WHERE worker_id = ? LIMIT 1", array($worker_id))->row(); $shiftSeconds = $finishTime->getTimestamp() - $dayStartTime->getTimestamp(); $lunchRequired = $workerRow && $workerRow->lunch_window_start && $workerRow->lunch_window_end && $shiftSeconds >= 6 * 3600; @@ -498,8 +492,8 @@ class Service_model extends CI_Model { if ($lunchRequired) { $allBookings = $this->db->query(" SELECT booking_start_time, booking_finish_time FROM bookings - WHERE booking_date = '$selectedDate' AND worker_id = '$worker_id' - ")->result(); + WHERE booking_date = ? AND worker_id = ? + ", array($selectedDate, $worker_id))->result(); } $interval = new DateInterval('PT15M'); @@ -516,10 +510,10 @@ class Service_model extends CI_Model { $bookingQuery = $this->db->query(" SELECT * FROM bookings - WHERE booking_date = '{$selectedDate}' - AND worker_id = '{$worker_id}' - AND booking_start_time < '{$endTimeStr}' AND booking_finish_time > '{$startTimeStr}' - "); + WHERE booking_date = ? + AND worker_id = ? + AND booking_start_time < ? AND booking_finish_time > ? + ", array($selectedDate, $worker_id, $endTimeStr, $startTimeStr)); if ($bookingQuery->num_rows() > 0) continue; // already booked @@ -564,30 +558,30 @@ class Service_model extends CI_Model { guest_confirmed, guest_confirm_code, manage_token - ) VALUES( - '".$bookingArray['guest_name']."', - '".$bookingArray['guest_email']."', - '".$bookingArray['guest_phone']."', - '".$bookingArray['worker_id']."', - '".$bookingArray['booking_date']."', - '".$bookingArray['booking_start_time']."', - '".$bookingArray['booking_finish_time']."', - '".$bookingArray['service_ids']."', - '".$bookingArray['guest_confirmed']."', - '".$bookingArray['guest_confirm_code']."', - '".$bookingArray['manage_token']."' - );"); + ) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", array( + $bookingArray['guest_name'], + $bookingArray['guest_email'], + $bookingArray['guest_phone'], + $bookingArray['worker_id'], + $bookingArray['booking_date'], + $bookingArray['booking_start_time'], + $bookingArray['booking_finish_time'], + $bookingArray['service_ids'], + $bookingArray['guest_confirmed'], + $bookingArray['guest_confirm_code'], + $bookingArray['manage_token'] + )); } public function getBookingByToken($token){ $this->load->database(); - $query = $this->db->query('SELECT * FROM bookings WHERE manage_token = "'.$this->db->escape_str($token).'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM bookings WHERE manage_token = ? LIMIT 1', array($token)); return $query->num_rows() > 0 ? $query->result()[0] : false; } public function updateBookingCalEvents($booking_id, $worker_event_id, $owner_event_id){ $this->load->database(); - $this->db->query("UPDATE bookings SET gcal_event_id_worker = '".$this->db->escape_str($worker_event_id)."', gcal_event_id_owner = '".$this->db->escape_str($owner_event_id)."' WHERE booking_id = '".$this->db->escape_str($booking_id)."';"); + $this->db->query("UPDATE bookings SET gcal_event_id_worker = ?, gcal_event_id_owner = ? WHERE booking_id = ?", array($worker_event_id, $owner_event_id, $booking_id)); } public function getWorkerSchedule($worker_id) { @@ -789,14 +783,14 @@ class Service_model extends CI_Model { $isOddWeek = $weekNumber % 2 !== 0; $query = $this->db->query(" - SELECT * FROM worker_schedule - WHERE worker_id = '{$worker_id}' - AND weekday = '{$weekday}' + SELECT * FROM worker_schedule + WHERE worker_id = ? + AND weekday = ? AND ( is_alternate_week = 0 OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ") ) - "); + ", array($worker_id, $weekday)); return $query->num_rows() > 0; } diff --git a/application/models/User_model.php b/application/models/User_model.php index a7b5f96..a6c56b6 100755 --- a/application/models/User_model.php +++ b/application/models/User_model.php @@ -14,7 +14,7 @@ class User_model extends CI_Model { public function userCanLogin($username, $password){ $this->load->database(); - $query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'" AND password = "'.hash('sha256', $password).'" AND is_enabled = 1 LIMIT 1'); + $query = $this->db->query('SELECT * FROM users WHERE username = ? AND password = ? AND is_enabled = 1 LIMIT 1', array($username, hash('sha256', $password))); if($query->num_rows() == 1){ return 1; @@ -39,9 +39,9 @@ class User_model extends CI_Model { public function getUserByUsername($username){ $this->load->database(); - $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1'); + $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username)); if($query->num_rows() == 1){ - + if($query->result()[0]->profile_img_url == ''){ $query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg'; } @@ -64,7 +64,7 @@ class User_model extends CI_Model { } public function getUserById($userId){ $this->load->database(); - $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = "'.$userId.'" LIMIT 1'); + $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = ? LIMIT 1', array($userId)); if($query->num_rows() == 1){ if($query->result()[0]->profile_img_url == ''){ $query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg'; @@ -78,12 +78,12 @@ class User_model extends CI_Model { public function deleteUser($userId){ $this->load->database(); - $query = $this->db->query('DELETE FROM users WHERE user_id = "'.$userId.'";'); + $query = $this->db->query('DELETE FROM users WHERE user_id = ?', array($userId)); } public function isUsernameAvailable($username){ $this->load->database(); - $query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'";'); + $query = $this->db->query('SELECT * FROM users WHERE username = ?', array($username)); if($query->num_rows() == 1){ return 0; } @@ -94,17 +94,15 @@ class User_model extends CI_Model { public function updateUser($userId, $userArray){ $this->load->database(); - - foreach($userArray as $propertyKey => $propertyValue){ - $query = $this->db->query('UPDATE users SET '.$propertyKey.' = "'.$propertyValue.'" WHERE user_id = "'.$userId.'";'); - } + $this->db->where('user_id', $userId); + $this->db->update('users', $userArray); } public function addNewUser($userArray){ $this->load->database(); if(!is_object($this->getUserByUsername($userArray['username']))){ - $query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES("'.$userArray['username'].'", "'.hash('sha256', $userArray['password']).'", "'.$userArray['fullname'].'", "'.$userArray['permission_slug'].'", "'.$userArray['is_enabled'].'", "'.$userArray['user_notes'].'");'); + $query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES(?, ?, ?, ?, ?, ?)', array($userArray['username'], hash('sha256', $userArray['password']), $userArray['fullname'], $userArray['permission_slug'], $userArray['is_enabled'], $userArray['user_notes'])); return 1; } else{ @@ -121,13 +119,13 @@ class User_model extends CI_Model { public function getPermissionById($groupId){ $this->load->database(); - $query = $this->db->query('SELECT * FROM permissions WHERE permission_id = "'.$groupId.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM permissions WHERE permission_id = ? LIMIT 1', array($groupId)); return $query->result()[0]; } public function getPermissionBySlug($permission_slug){ $this->load->database(); - $query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = "'.$permission_slug.'" LIMIT 1;'); + $query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ? LIMIT 1', array($permission_slug)); return $query->result()[0]; } @@ -202,7 +200,7 @@ class User_model extends CI_Model { public function is_user_admin($username){ $this->load->database(); - $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1'); + $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username)); if($query->num_rows() == 1){ if($query->result()[0]->permission_slug == 'admin'){ return 1; diff --git a/application/views/admin/includes/bookings-form.php b/application/views/admin/includes/bookings-form.php index 40791cb..53dd10c 100755 --- a/application/views/admin/includes/bookings-form.php +++ b/application/views/admin/includes/bookings-form.php @@ -36,14 +36,14 @@ | - #booking_id;?> - guest_name;?> - guest_email;?> - guest_phone;?> - worker_name;?> - booking_date;?> - booking_start_time;?> - booking_finish_time;?> + #booking_id, ENT_QUOTES, 'UTF-8');?> + guest_name, ENT_QUOTES, 'UTF-8');?> + guest_email, ENT_QUOTES, 'UTF-8');?> + guest_phone, ENT_QUOTES, 'UTF-8');?> + worker_name, ENT_QUOTES, 'UTF-8');?> + booking_date, ENT_QUOTES, 'UTF-8');?> + booking_start_time, ENT_QUOTES, 'UTF-8');?> + booking_finish_time, ENT_QUOTES, 'UTF-8');?> services)){ echo ''; @@ -55,10 +55,10 @@ echo ''; foreach($resultItem->services as $serviceItem){ echo ''; - echo ''; - echo ''; - echo ''; - echo ''; + echo ''; + echo ''; + echo ''; + echo ''; echo ''; } echo '
'.$serviceItem->service_type.''.$serviceItem->service_name.''.$serviceItem->service_price.''.$serviceItem->service_time.''.htmlspecialchars($serviceItem->service_type, ENT_QUOTES, 'UTF-8').''.htmlspecialchars($serviceItem->service_name, ENT_QUOTES, 'UTF-8').''.htmlspecialchars($serviceItem->service_price, ENT_QUOTES, 'UTF-8').''.htmlspecialchars($serviceItem->service_time, ENT_QUOTES, 'UTF-8').'
'; diff --git a/application/views/admin/includes/service-categories-form.php b/application/views/admin/includes/service-categories-form.php index 8e6e3fd..53e5167 100755 --- a/application/views/admin/includes/service-categories-form.php +++ b/application/views/admin/includes/service-categories-form.php @@ -21,8 +21,8 @@ | #service_category_id;?> - serv_cat_slug;?> - serv_cat_name;?> + serv_cat_slug, ENT_QUOTES, 'UTF-8');?> + serv_cat_name, ENT_QUOTES, 'UTF-8');?> - + | - #service_id;?> - service_type;?> - service_category_no;?> - service_category_en;?> - service_category_hu;?> - service_name_no;?> - service_name_en;?> - service_name_hu;?> - service_description_no;?> - service_description_en;?> - service_description_hu;?> - service_price;?> - service_time;?> - serv_cat_name;?> + #service_id, ENT_QUOTES, 'UTF-8');?> + service_type, ENT_QUOTES, 'UTF-8');?> + service_category_no, ENT_QUOTES, 'UTF-8');?> + service_category_en, ENT_QUOTES, 'UTF-8');?> + service_category_hu, ENT_QUOTES, 'UTF-8');?> + service_name_no, ENT_QUOTES, 'UTF-8');?> + service_name_en, ENT_QUOTES, 'UTF-8');?> + service_name_hu, ENT_QUOTES, 'UTF-8');?> + service_description_no, ENT_QUOTES, 'UTF-8');?> + service_description_en, ENT_QUOTES, 'UTF-8');?> + service_description_hu, ENT_QUOTES, 'UTF-8');?> + service_price, ENT_QUOTES, 'UTF-8');?> + service_time, ENT_QUOTES, 'UTF-8');?> + serv_cat_name, ENT_QUOTES, 'UTF-8');?> is_enabled?'igen':'nem';?> booking_id;?>">
- +
- +
- +
diff --git a/application/views/admin/includes/update-service-category-form.php b/application/views/admin/includes/update-service-category-form.php index 87bb7f9..8628706 100755 --- a/application/views/admin/includes/update-service-category-form.php +++ b/application/views/admin/includes/update-service-category-form.php @@ -4,11 +4,11 @@
- +
- +
diff --git a/application/views/admin/includes/update-service-form.php b/application/views/admin/includes/update-service-form.php index 9df60e7..4f468f8 100755 --- a/application/views/admin/includes/update-service-form.php +++ b/application/views/admin/includes/update-service-form.php @@ -1,7 +1,7 @@
- + service_id, ENT_QUOTES, 'UTF-8');?>\">
+ service_category_no, ENT_QUOTES, 'UTF-8');?>\">
- + service_category_en, ENT_QUOTES, 'UTF-8');?>\">
- + service_category_hu, ENT_QUOTES, 'UTF-8');?>\">
- + service_name_no, ENT_QUOTES, 'UTF-8');?>\">
- + service_name_en, ENT_QUOTES, 'UTF-8');?>\">
- + service_name_hu, ENT_QUOTES, 'UTF-8');?>\">
- + service_description_no, ENT_QUOTES, 'UTF-8');?>\">
- + service_description_en, ENT_QUOTES, 'UTF-8');?>\">
- + service_description_hu, ENT_QUOTES, 'UTF-8');?>\">
- + service_price, ENT_QUOTES, 'UTF-8');?>\">
- + service_time, ENT_QUOTES, 'UTF-8');?>\">
@@ -59,7 +59,7 @@ service_category_id.'" '.($selectedItem->service_category_id == $serviceCategoryItem->service_category_id?' selected':'').'>'.$serviceCategoryItem->serv_cat_name.''; + echo ''; } } ?> diff --git a/application/views/admin/includes/update-worker-form.php b/application/views/admin/includes/update-worker-form.php index a2cf42b..53c93dc 100755 --- a/application/views/admin/includes/update-worker-form.php +++ b/application/views/admin/includes/update-worker-form.php @@ -1,10 +1,10 @@
- + worker_id, ENT_QUOTES, 'UTF-8');?>\">
- + worker_name, ENT_QUOTES, 'UTF-8');?>\">
@@ -15,7 +15,7 @@
- + worker_info, ENT_QUOTES, 'UTF-8');?>\">
@@ -66,11 +66,11 @@
- + google_calendar_id) ? $selectedItem->google_calendar_id : '', ENT_QUOTES, 'UTF-8');?>\">
- + ntfy_topic) ? $selectedItem->ntfy_topic : '', ENT_QUOTES, 'UTF-8');?>\">
diff --git a/application/views/admin/includes/worker-calendar-form.php b/application/views/admin/includes/worker-calendar-form.php old mode 100644 new mode 100755 index 5183cd2..2dda445 --- a/application/views/admin/includes/worker-calendar-form.php +++ b/application/views/admin/includes/worker-calendar-form.php @@ -34,6 +34,9 @@ width: 100%; background: #2a2a2a; color: #fff; border: 1px solid #555; padding: 6px 8px; border-radius: 3px; font-size: 13px; box-sizing: border-box; } +.cal-wrap select option, #calModalBox select option { + background: #2a2a2a; color: #fff; +} #calModalBox textarea { height: 60px; resize: vertical; } .cal-modal-btns { display: flex; gap: 10px; margin-top: 16px; } .cal-btn-save { background: #5cb85c; color: #fff; border: none; padding: 8px 18px; border-radius: 3px; cursor: pointer; font-size: 14px; } diff --git a/application/views/admin/includes/workers-form.php b/application/views/admin/includes/workers-form.php index 3f79b2f..4a76ccd 100755 --- a/application/views/admin/includes/workers-form.php +++ b/application/views/admin/includes/workers-form.php @@ -22,17 +22,17 @@ ?> - - | + + | | - #worker_id;?> + #worker_id, ENT_QUOTES, 'UTF-8');?> - worker_name;?> - worker_info;?> + worker_name, ENT_QUOTES, 'UTF-8');?> + worker_info, ENT_QUOTES, 'UTF-8');?> is_beauty?'igen':'nem';?> is_barber?'igen':'nem';?> - serv_cat_name;?> + serv_cat_name, ENT_QUOTES, 'UTF-8');?> is_active?'igen':'nem';?>