diff --git a/admin/student_editor.php b/admin/student_editor.php index 894468c5..71a3ef84 100644 --- a/admin/student_editor.php +++ b/admin/student_editor.php @@ -41,13 +41,13 @@ if ($auth_type == 'fair') { if ($registrations_id == -1 && ($action == 'registration_load' || $action == 'registration_save')) { /* we can't check the project it hasn't been created. */ } else { - /* Make sure they have permission to laod this student, check + /* Make sure they have permission to load this student, check the master copy of the fairs_id in the project */ - $q = $pdo->prepare("SELECT * FROM projects WHERE + $q = $pdo->prepare('SELECT * FROM projects WHERE registrations_id=? AND year=? - AND fairs_id=?"); - $q->execute([$registrations_id,$config['FAIRYEAR'],$fairs_id]); + AND fairs_id=?'); + $q->execute([$registrations_id, $config['FAIRYEAR'], $fairs_id]); if ($q->rowCount() != 1) { echo 'permission denied.'; exit; @@ -75,8 +75,9 @@ switch ($action) { case 'student_remove': $remove_id = intval($_GET['students_id']); - $q = $pdo->prepare("SELECT id FROM students WHERE id=? AND registrations_id=?"); - $q->execute([$remove_id,$registrations_id]); + try { + $q = $pdo->prepare('SELECT id FROM students WHERE id=? AND registrations_id=?'); + $q->execute([$remove_id, $registrations_id]); if ($q->rowCount() != 1) { error_('Invalid student to remove'); exit; @@ -86,48 +87,52 @@ switch ($action) { exit; } - $stmt = $pdo->prepare("DELETE FROM students WHERE id=? AND registrations_id=?"); - $stmt->execute([$remove_id,$registrations_id]); + $stmt = $pdo->prepare('DELETE FROM students WHERE id=? AND registrations_id=?'); + $stmt->execute([$remove_id, $registrations_id]); // now see if they have an emergency contact that also needs to be removed - $q = $pdo->prepare("SELECT id FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?"); - $q->execute([$remove_id,$registrations_id,$config['FAIRYEAR']]); + $q = $pdo->prepare('SELECT id FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?'); + $q->execute([$remove_id, $registrations_id, $config['FAIRYEAR']]); // no need to error message if this doesnt exist if ($q->rowCount() == 1) { - $stmt = $do->prepare("DELETE FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?"); - $stmt->execute([$remove_id,$registrations_id,$config['FAIRYEAR']]); + $stmt = $do->prepare('DELETE FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?'); + $stmt->execute([$remove_id, $registrations_id, $config['FAIRYEAR']]); } - + if ($q->rowCount() != 1) { error_('Invalid student to remove'); exit; } - $stmt = $pdo->prepare("DELETE FROM students WHERE id=? AND registrations_id=?"); - $stmt->execute([$remove_id,$registrations_id]); + $stmt = $pdo->prepare('DELETE FROM students WHERE id=? AND registrations_id=?'); + $stmt->execute([$remove_id, $registrations_id]); // now see if they have an emergency contact that also needs to be removed - $q = $pdo->prepare("SELECT id FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?"); - $q->execute([$remove_id,$registrations_id,$config['FAIRYEAR']]); - + $q = $pdo->prepare('SELECT id FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?'); + $q->execute([$remove_id, $registrations_id, $config['FAIRYEAR']]); + // no need to error message if this doesnt exist if ($q->rowCount() == 1) { - $stmt = $do->prepare("DELETE FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?"); - $stmt->execute([$remove_id,$registrations_id,$config['FAIRYEAR']]); + $stmt = $do->prepare('DELETE FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?'); + $stmt->execute([$remove_id, $registrations_id, $config['FAIRYEAR']]); } - $stmt = $pdo->prepare("DELETE FROM students WHERE id=? AND registrations_id=?"); - $stmt->execute([$remove_id,$registrations_id]); + $stmt = $pdo->prepare('DELETE FROM students WHERE id=? AND registrations_id=?'); + $stmt->execute([$remove_id, $registrations_id]); // now see if they have an emergency contact that also needs to be removed - $q = $pdo->prepare("SELECT id FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?"); - $q->execute([$remove_id,$registrations_id,$config['FAIRYEAR']]); + $q = $pdo->prepare('SELECT id FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?'); + $q->execute([$remove_id, $registrations_id, $config['FAIRYEAR']]); // no need to error message if this doesnt exist if ($q->rowCount() == 1) { - $stmt = $do->prepare("DELETE FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?"); - $stmt->execute([$remove_id,$registrations_id,$config['FAIRYEAR']]); + $stmt = $do->prepare('DELETE FROM emergencycontact WHERE students_id=? AND registrations_id=? AND year=?'); + $stmt->execute([$remove_id, $registrations_id, $config['FAIRYEAR']]); } happy_('Student successfully removed'); + } catch (PDOException $exception) { + error_('Failed to remove student'); + } + exit; default: @@ -146,17 +151,18 @@ function students_save() if ($_POST['id'][$x] == 0) { // if they use schoolpassword or singlepassword, then we need to set the school based on the school stored in the registration record. for anything else they can choose the school on their own. if ($config['participant_registration_type'] == 'schoolpassword' || $config['participant_registration_type'] == 'invite') { - $q = $pdo->prepare("SELECT schools_id FROM registrations WHERE id=? AND YEAR=?"); - $q->execute([$registrations_id,$config['FAIRYEAR']]); + $q = $pdo->prepare('SELECT schools_id FROM registrations WHERE id=? AND YEAR=?'); + $q->execute([$registrations_id, $config['FAIRYEAR']]); $r = $q->fetch(PDO::FETCH_OBJ); $schools_id = $r->schools_id; - $schoolvalue = "'$schools_id', "; + $schoolvalue = stripslashes($schools_id); } else { - $schoolvalue = "'" . stripslashes($_POST['schools_id'][$x]) . "', "; + $schoolvalue = stripslashes($_POST['schools_id'][$x]); } - // INSERT new record - $dob = $_POST['year'][$x] . '-' . $_POST['month'][$x] . '-' . $_POST['day'][$x]; - $stmt = $pdo->prepare('INSERT INTO students (registrations_id,firstname,lastname,sex,email,address,city,province,postalcode,phone,dateofbirth,grade,schools_id,tshirt,medicalalert,foodreq,teachername,teacheremail,year) VALUES ( + try { + // INSERT new record + $dob = $_POST['year'][$x] . '-' . $_POST['month'][$x] . '-' . $_POST['day'][$x]; + $stmt = $pdo->prepare('INSERT INTO students (registrations_id,firstname,lastname,email,address,city,province,postalcode,phone,dateofbirth,grade,schools_id,tshirt,medicalalert,foodreq,teachername,teacheremail,year) VALUES ( ?, ?, ?, @@ -174,18 +180,40 @@ function students_save() ?, ?, ?, - ?, ?)'); - $stmt->execute([$registrations_id,iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['firstname'][$x])), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['lastname'][$x])),stripslashes($_POST['sex'][$x]), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['email'][$x])),iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['address'][$x])), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['city'][$x])),iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['province'][$x])), - stripslashes($_POST['postalcode'][$x]),stripslashes($_POST['phone'][$x]),$dob,stripslashes($_POST['grade'][$x]), - $schoolvalue,stripslashes($_POST['tshirt'][$x]),stripslashes($_POST['medicalalert'][$x]),stripslashes($_POST['foodreq'][$x]), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['teachername'][$x])),iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['teacheremail'][$x])), - $config['FAIRYEAR']]); + $stmt->execute([ + $registrations_id, + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['firstname'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['lastname'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['email'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['address'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['city'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['province'][$x])), + stripslashes($_POST['postalcode'][$x]), + stripslashes($_POST['phone'][$x]), $dob, + stripslashes($_POST['grade'][$x]), + $schoolvalue, + stripslashes($_POST['tshirt'][$x]), + stripslashes($_POST['medicalalert'][$x]), + stripslashes($_POST['foodreq'][$x]), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['teachername'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', + stripslashes($_POST['teacheremail'][$x])), + $config['FAIRYEAR'] + ]); - happy_('%1 %2 successfully added', array($_POST['firstname'][$x], $_POST['lastname'][$x])); + happy_('%1 %2 successfully added', array($_POST['firstname'][$x], $_POST['lastname'][$x])); + } catch (PDOException $exception) { + error_('%1 %2 failed to update', array($_POST['firstname'][$x], $_POST['lastname'][$x])); + error_log($exception); + } } else { // if they use schoolpassword or singlepassword, then we dont need to save teh schools_id because its already set when they inserted the record, and we dont allow them to change their school. if (($config['participant_registration_type'] == 'schoolpassword' || $config['participant_registration_type'] == 'invite') && !$_POST['schools_id'][$x]) { @@ -195,12 +223,12 @@ function students_save() } else $schoolquery = ''; - // UPDATE existing record - $dob = $_POST['year'][$x] . '-' . $_POST['month'][$x] . '-' . $_POST['day'][$x]; - $stmt = $pdo->prepare("UPDATE students SET + try { + // UPDATE existing record + $dob = $_POST['year'][$x] . '-' . $_POST['month'][$x] . '-' . $_POST['day'][$x]; + $stmt = $pdo->prepare("UPDATE students SET firstname=?, lastname=?, - sex=?, email=?, address=?, city=?, @@ -217,27 +245,29 @@ function students_save() tshirt=? WHERE id=?"); - $stmt->execute([ - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['firstname'][$x])), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['lastname'][$x])), - stripslashes($_POST['sex'][$x]), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['email'][$x])), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['address'][$x])), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['city'][$x])), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['province'][$x])), - stripslashes($_POST['postalcode'][$x]), - stripslashes($_POST['phone'][$x]), - $dob, - stripslashes($_POST['grade'][$x]), - stripslashes($_POST['medicalalert'][$x]), - stripslashes($_POST['foodreq'][$x]), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['teachername'][$x])), - iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['teacheremail'][$x])), - stripslashes($_POST['tshirt'][$x]), - $_POST['id'][$x] - ]); - - happy_('%1 %2 successfully updated', array(iconv('UTF-8', 'ISO-8859-1//TRANSLIT', $_POST['firstname'][$x]), iconv('UTF-8', 'ISO-8859-1//TRANSLIT', $_POST['lastname'][$x]))); + $stmt->execute([ + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['firstname'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['lastname'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['email'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['address'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['city'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['province'][$x])), + stripslashes($_POST['postalcode'][$x]), + stripslashes($_POST['phone'][$x]), + $dob, + stripslashes($_POST['grade'][$x]), + stripslashes($_POST['medicalalert'][$x]), + stripslashes($_POST['foodreq'][$x]), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['teachername'][$x])), + iconv('UTF-8', 'ISO-8859-1//TRANSLIT', stripslashes($_POST['teacheremail'][$x])), + stripslashes($_POST['tshirt'][$x]), + $_POST['id'][$x] + ]); + happy_('%1 %2 successfully updated', array(iconv('UTF-8', 'ISO-8859-1//TRANSLIT', $_POST['firstname'][$x]), iconv('UTF-8', 'ISO-8859-1//TRANSLIT', $_POST['lastname'][$x]))); + } catch (PDOException $exception) { + error_('%1 %2 failed to update', array(iconv('UTF-8', 'ISO-8859-1//TRANSLIT', $_POST['firstname'][$x]), iconv('UTF-8', 'ISO-8859-1//TRANSLIT', $_POST['lastname'][$x]))); + error_log($exception); + } } $x++; } @@ -248,10 +278,10 @@ function students_load() global $registrations_id, $config, $pdo; // now query and display - $q = $pdo->prepare("SELECT * FROM students WHERE + $q = $pdo->prepare('SELECT * FROM students WHERE registrations_id=? - AND year=?"); - $q->execute([$registrations_id,$config['FAIRYEAR']]); + AND year=?'); + $q->execute([$registrations_id, $config['FAIRYEAR']]); show_pdo_errors_if_any($pdo); $numfound = $q->rowCount(); @@ -298,24 +328,6 @@ function students_load() echo ' ' . i18n('First Name') . "' . REQUIREDFIELD . "\n"; echo ' ' . i18n('Last Name') . "' . REQUIREDFIELD . "\n"; echo "\n"; - - if ($config['participant_student_personal'] == 'yes') { - echo "\n"; - echo ' ' . i18n('Gender') . ''; - echo "' . REQUIREDFIELD; - } echo "\n"; echo " \n"; echo "\n"; @@ -438,7 +450,7 @@ function students_load() echo "\n"; echo ' ' . i18n('School') . ''; if ($config['participant_registration_type'] == 'open' || $config['participant_registration_type'] == 'singlepassword' || $config['participant_registration_type'] == 'openorinvite' || ($studentinfo && !$studentinfo->schools_id)) { - $schoolq = $pdo->prepare("SELECT id,school,city FROM schools WHERE year=? ORDER by city,school"); + $schoolq = $pdo->prepare('SELECT id,school,city FROM schools WHERE year=? ORDER by city,school'); $schoolq->execute([$config['FAIRYEAR']]); echo "' . REQUIREDFIELD; } else { - $schoolq = $pdo->prepare("SELECT id,school FROM schools WHERE year=? AND id=?"); - $schoolq->execute([$config['FAIRYEAR'],$studentinfo->schools_id]); + $schoolq = $pdo->prepare('SELECT id,school FROM schools WHERE year=? AND id=?'); + $schoolq->execute([$config['FAIRYEAR'], $studentinfo->schools_id]); $r = $schoolq->fetch(PDO::FETCH_OBJ); echo $r->school; } @@ -504,7 +516,7 @@ function registration_load() /* Find a reg num */ do { $regnum = rand(100000, 999999); - $q = $pdo->prepare("SELECT * FROM registrations WHERE num=? AND year=?"); + $q = $pdo->prepare('SELECT * FROM registrations WHERE num=? AND year=?'); $q->execute([$regnum, $config['FAIRYEAR']]); } while ($q->rowCount() > 0); @@ -513,14 +525,14 @@ function registration_load() echo notice(i18n('New registration number generated.')); echo notice(i18n('This new registration will added when the "Save Registration Information" button is pressed below. At that time the other tabs will become available.')); } else { - $q = $pdo->prepare("SELECT * FROM registrations WHERE id=?"); + $q = $pdo->prepare('SELECT * FROM registrations WHERE id=?'); $q->execute([$registrations_id]); if ($q->rowCount() != 1) $r = array(); else { $r = $q->fetch(PDO::FETCH_ASSOC); /* Get the fair from the project */ - $q = $pdo->prepare("SELECT fairs_id FROM projects WHERE registrations_id=?"); + $q = $pdo->prepare('SELECT fairs_id FROM projects WHERE registrations_id=?'); $q->execute([$registrations_id]); if ($q->rowCount() == 1) { $p = $q->fetch(PDO::FETCH_ASSOC); @@ -602,31 +614,31 @@ function registration_save() $fairs_id = intval($_POST['registration_fair']); if ($registrations_id == -1) { - $stmt = $pdo->prepare("INSERT INTO registrations (start,schools_id,year) VALUES ( - NOW(), NULL,?)"); + $stmt = $pdo->prepare('INSERT INTO registrations (start,schools_id,year) VALUES ( + NOW(), NULL,?)'); $stmt->execute([$config['FAIRYEAR']]); $registrations_id = $pdo->lastInsertId(); /* Create one student and a project */ - $stmt = $pdo->prepare("INSERT INTO students (registrations_id,email,year) VALUES ( + $stmt = $pdo->prepare('INSERT INTO students (registrations_id,email,year) VALUES ( - ?,?,?)"); - $stmt->execute([$registrations_id,$registration_email,$config['FAIRYEAR']]); - $stmt = $pdo->prepare("INSERT INTO projects (registrations_id,year) VALUES ( + ?,?,?)'); + $stmt->execute([$registrations_id, $registration_email, $config['FAIRYEAR']]); + $stmt = $pdo->prepare('INSERT INTO projects (registrations_id,year) VALUES ( - ?,?)"); - $stmt->execute([$registrations_id,$config['FAIRYEAR']]); + ?,?)'); + $stmt->execute([$registrations_id, $config['FAIRYEAR']]); happy_('Created student and project record'); } /* Update registration */ - $stmt = $pdo->prepare("UPDATE registrations SET + $stmt = $pdo->prepare('UPDATE registrations SET num=?, status=?, email=? WHERE - id=?"); - $stmt->execute([$registration_num,$registration_status,$registration_email,$registrations_id]); + id=?'); + $stmt->execute([$registration_num, $registration_status, $registration_email, $registrations_id]); show_pdo_errors_if_any($pdo); /* @@ -635,11 +647,11 @@ function registration_save() */ if ($auth_type == 'fair') $fairs_id = $_SESSION['fairs_id']; - $stmt = $pdo->prepare("UPDATE projects SET + $stmt = $pdo->prepare('UPDATE projects SET fairs_id=? WHERE - registrations_id=?"); - $stmt->execute([$fairs_id,$registrations_id]); + registrations_id=?'); + $stmt->execute([$fairs_id, $registrations_id]); show_pdo_errors_if_any($pdo); happy_('Information Saved'); echo ' - +
- data-email=""> + data-email= + data-values='' + style="display: block; max-height: 800px; overflow: auto;" + data-allow-to-resubmit="false" +
+ + + + + +