Complete initial pass of sql conversion

Ethics questions can now be asked as a required field for each project. 
To activate this feature navigate to Configuration >> Configuration Variables >> Participant Registration 
and change  “Ask if the project requires human and/or animal participants” to “Yes”. 

All projects with human and/or animal participants can be selected using the Report Editor.

Under “Input Received Signature Forms” a button called “Receive All” was created. 
Clicking this button will cause the program to assign project numbers and mark the 
signature page as received for all students who have completed the registration process. 
Confirmation emails are sent to each student that had their signature page marked as received.

"Remove Old Judge Data" and "Remove Old Emergency Contact/Parent Data" was added to
"Database Backup/Restore".  These permanently remove all information from the database 
about these two respective groups.  This means that all historical data will be lost but  
the most recent information about judges and emergency contacts remains. Cleaning the database 
this way dramatically improves the speed of the user editor.  Make sure the database has been
backed up before trying these.

The judge's name now appears on the cancellation popup window when deleting an individual judge.

.htaccess

@@ -6,5 +6,4 @@ RewriteCond %{SCRIPT_FILENAME} !-f
 RewriteCond %{SCRIPT_FILENAME} !-l
 RewriteCond %{SCRIPT_FILENAME} !-d
 RewriteRule ^web/(.*)$ cms.php?f=$1 [L]
-RewriteRule ^api/(.*)$ api.php?request=$1 [L]
 

account.inc.php

@@ -1,556 +0,0 @@
-<?
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2010 David Grant <dave@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?
-
-function account_valid_user($user)
-{
-	/* Find any character that doesn't match the valid username characters
-	 * (^ inverts the matching remember */
-	$x = preg_match('[^a-zA-Z0-9@.-_]',$user);
-
-	/* If x==1, a match was found, and the input is bad */
-	return ($x == 1) ? false : true;
-}
-
-function account_valid_password($pass)
-{
-	/* Same as user, but allow more characters */
-	$x = preg_match('[^a-zA-Z0-9 ~!@#$%^&*()-_=+|;:,<.>/?]',$pass);
-
-	/* If x==1, a match was found, and the input is bad */
-	if($x == 1) return false;
-
-	if(strlen($pass) < 6) return false;
-
-	return true;
-}
-
-/* Duplicate of common.inc.php:generatePassword, which will be deleted 
- * eventually when ALL users are handled through this file */
-function account_generate_password($pwlen=8)
-{
-        //these are good characters that are not easily confused with other characters :)
-        $available="ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789";
-        $len=strlen($available) - 1;
-
-        $key="";
-        for($x=0;$x<$pwlen;$x++)
-                $key.=$available{rand(0,$len)};
-        return $key;
-}
-
-function account_set_password($accounts_id, $password = NULL)
-{
-	$save_old = false;
-	if($password == NULL) {
-		$q = mysql_query("SELECT passwordset FROM accounts WHERE id='$accounts_id'");
-		$a = mysql_fetch_assoc($q);
-		/* Generate a new password */
-		$password = account_generate_password(12);
-		/* save the old password only if it's not an auto-generated one */
-		if($a['passwordset'] != '0000-00-00') $save_old = true;
-		/* Expire the password */
-		$save_set = "'0000-00-00'";
-	} else {
-		/* Set the password, no expiry, save the old */
-		$save_old = true;
-		$save_set = 'NOW()';
-	}
-
-	$p = mysql_escape_string($password);
-	$set = ($save_old == true) ? 'oldpassword=password, ' : '';
-	$set .= "password='$p', passwordset=$save_set ";
-
-	$query = "UPDATE accounts SET $set WHERE id='$accounts_id'";
-	mysql_query($query);
-	echo mysql_error();
-
-	return $password;
-}
-
-function account_load($id)
-{
-	$id = intval($id);
-	//we dont want password or the pending email code in here 
-	$q = mysql_query("SELECT id,
-	username,
-	link_username_to_email,
-	passwordset,
-	email,
-	pendingemail,
-	superuser,
-	deleted,
-	deleted_datetime,
-	created
-	 FROM accounts WHERE id='$id'");
-	if(mysql_num_rows($q) == 0) {
-		return false;
-	}
-	if(mysql_num_rows($q) > 1) {
-		return false;
-	}
-
-	$a = mysql_fetch_assoc($q);
-	return $a;
-}
-
-function account_get_password($id) {
-	$id=intval($id);
-	$q=mysql_query("SELECT password FROM accounts WHERE id='$id'");
-	$r=mysql_fetch_object($q);
-	return $r->password;
-}
-
-
-
-function account_load_by_username($username)
-{
-	$un = mysql_real_escape_string($username);
-	$q = mysql_query("SELECT * FROM accounts WHERE username='$un'");
-	if(mysql_num_rows($q) == 0) {
-		return false;
-	}
-	if(mysql_num_rows($q) > 1) {
-		return false;
-	}
-
-	$a = mysql_fetch_assoc($q);
-	return $a;
-}
-
-
-function account_create($username,$password=NULL)
-{
-	global $config;
-	$errMsg = '';
-
-	/* Sanity check username */
-	if(!account_valid_user($username)) {
-		$errMsg .= i18n('Invalid user name "%1"', array($username)) . "\n";
-	}else{
-		/* Make sure the account doesn't exist */
-		$us = mysql_real_escape_string($username);
-		$q = mysql_query("SELECT * FROM accounts WHERE username='$us'");
-		if(mysql_num_rows($q)) {
-			$errMsg .= i18n("The username %1 is already in use", array($username)) . "\n";
-		}
-	}
-
-	//if the password is set, make sure its valid, if its null, thats OK, it'll get generated and set by account_set_password
-	if($password && !account_valid_password($password)) {
-		$errMsg .= i18n("Invalid password") . "\n";
-	}
-
-	if($errMsg != '') return $errMsg;
-
-	/* Create the account */
-	mysql_query("INSERT INTO accounts (`username`,`created`,`deleted`,`superuser`) 
-			VALUES ('$us', NOW(),'no','no')");
-	echo mysql_error();
-
-	$accounts_id = mysql_insert_id();
-
-	account_set_password($accounts_id, $password);
-	$a = account_load($accounts_id);
-
-	return $a;
-}
-
-function account_set_email($accounts_id,$email) {
-	global $config;
-	//we dont actually set the email until its confirmed, we only set the pending email :p
-	if(isEmailAddress($email)) {
-		$code=generatePassword(24);
-		mysql_query("UPDATE accounts SET email=NULL, pendingemail='".mysql_real_escape_string($email)."', pendingemailcode='$code' WHERE id='$accounts_id'");
-		$link = account_build_email_confirmation_link($accounts_id);
-		email_send('account_email_confirmation',$email,array(),array("EMAIL"=>$email,"EMAILCONFIRMATIONLINK"=>$link));
-	}
-}
-
-// generate the email confirmation URL.  Separated from account_set_email for use elsewhere.
-// returns null if no confirmation code is set for this account
-function account_build_email_confirmation_link($accounts_id){
-	global $config;
-	$q = mysql_query("SELECT pendingemail, pendingemailcode FROM accounts WHERE id = $accounts_id");
-	$row = mysql_fetch_assoc($q);
-	$code = $row['pendingemailcode'];
-	$email = $row['pendingemail'];
-	if(trim($code) == ''){
-		return null;
-	}
-
-	$urlproto = $_SERVER['SERVER_PORT'] == 443 ? "https://" : "http://";
-	$urlmain = "$urlproto{$_SERVER['HTTP_HOST']}{$config['SFIABDIRECTORY']}";
-	$urlemailconfirm = "emailconfirmation.php?i=$accounts_id&e=".rawurlencode($email)."&c=".$code;
-	return $urlmain."/".$urlemailconfirm;
-}
-
-// add the specified role to the account's user record for the specified conference
-// return true on success, false on failure
-function account_add_role($accounts_id, $roles_id, $conferences_id, $password = null){
-	global $config;
-	global $conference;
-
-	//if we get role as a type string instead of an id (eg, 'teacher'), lets just look it up
-	if(!is_numeric($roles_id)) {
-		$tq=mysql_query("SELECT id FROM roles WHERE type='".mysql_real_escape_string($roles_id)."'");
-		$tr=mysql_fetch_object($tq);
-		$roles_id=$tr->id;
-	}
-	// avoid injections
-	$accounts_id=intval($accounts_id);
-	$roles_id=intval($roles_id);
-	$conferences_id=intval($conferences_id);
-	$password=mysql_real_escape_string($password);
-
-	// make sure the specified id's actually exist
-	if(mysql_result(mysql_query("SELECT COUNT(*) FROM accounts WHERE id = $accounts_id"), 0) != 1){
-		return "invalidaccount";
-	}
-	if(mysql_result(mysql_query("SELECT COUNT(*) FROM roles WHERE id = $roles_id"), 0) != 1){
-		return "invalidrole";
-	}
-	if(mysql_result(mysql_query("SELECT COUNT(*) FROM conferences WHERE id = $conferences_id"), 0) != 1){
-		return "invalidconference";
-	}
-
-	// find out if this account has a user record for this conference
-	$data = mysql_fetch_array(mysql_query("
-		SELECT * FROM users
-		WHERE conferences_id = $conferences_id
-		AND accounts_id = $accounts_id
-	"));
-	if(is_array($data)){
-		// they do indeed have a user record for this conference.  Let's load it
-		$u = user_load($data['id']);
-		$users_id = $data['id'];
-	}else{
-		// They're not actually connected to this conference, let's hook 'em up
-		$u = user_create($accounts_id, $conferences_id);
-		$users_id = $u['id'];
-
-		// if this applies to their current session, update their session user id
-		if($_SESSION['accounts_id'] == $accounts_id && $_SESSION['conferences_id'] == $conferences_id){
-			$_SESSION['users_id'] = $users_id;
-		}
-	}
-
-	// we now have the user id that we need, let's check to see whether or not they
-	// already have the specified role.
-	if(mysql_result(mysql_query("SELECT COUNT(*) FROM user_roles WHERE users_id = $users_id AND roles_id = $roles_id"), 0) != 0){
-		// they already have this role.  shell_exec("man true");
-		return 'ok';
-	}
-
-	// see if this role conflicts with existing ones
-	if(!account_add_role_allowed($accounts_id, $conferences_id, $roles_id)){
-		return 'invalidrole(account_add_role_allowed)';
-	}
-
-	// get the type of the role (eg. "judge", "participant", etc.)
-	$role = mysql_result(mysql_query("SELECT type FROM roles WHERE id = $roles_id"), 0);
-
-	if($_SESSION['superuser']!='yes') {
-		// and see if it's a valid one for this conference
-		if(!array_key_exists($role . '_registration_type', $config)){
-			return 'invalidrole(_registration_type)';
-		}
-	}
-
-
-	if( in_array("admin",$_SESSION['roles']) ||
-		in_array("config",$_SESSION['roles']) ||
-		$_SESSION['superuser']=="yes")
-	{
-		//do nothing, we're logged in a a superuser, admin or config, so we
-		//dont want/need to check the types, just go ahead and invite them
-		//its easie than reversing the logic of the if above.
-	}
-	else {
-
-	// and let's see if we meet the conditions for the registration type
-	$error = "";
-	switch($config[$role . '_registration_type']){
-		case 'open':
-		case 'openorinvite':
-			// this is allowed.
-			break;
-		case 'singlepassword':
-			if($password != $config[$role . '_registration_singlepassword']){
-				$error = "invalidpassword";
-			}
-			break;
-		case 'schoolpassword':
-			if($password != null){
-				$schoolId = $u['schools_id'];
-				$schoolDat = mysql_fetch_assoc(mysql_query("SELECT registration_password FROM schools WHERE id=$schoolId"));
-				if(is_array($schoolDat)){
-					if($password == $schoolDat['registration_password']) $valid = true;
-					$error = "invalidpassword";
-				}
-			}
-			break;
-		case 'invite':
-			if( in_array("teacher",$_SESSION['roles']) && $role=='participant') {
-				//if they are a teacher, they can add a participant role a-ok
-				$error = '';
-			}
-			else {
-				$error = 'invalidrole(invite_only)';
-			}
-			break;
-	}
-	}
-
-	if($error != ""){
-		return $error;
-	}
-
-	// *whew* all conditions have been met.  Let's go ahead and create the record
-	if(!mysql_query("INSERT INTO user_roles (accounts_id, users_id, roles_id, active, complete) VALUES($accounts_id, $users_id, $roles_id, 'yes', 'no')")){
-		return "mysqlerror:" . mysql_error();
-	}
-
-	$a=account_load($accounts_id);
-	$password=account_get_password($accounts_id);
-
-	//in this case, we want to send to pendingemail if thats all we have, because
-	//its possible that this is a new user that was just added and we just sent
-	//the email confirmation email as well, so on new user invitation, they will get
-	//the invite email as well as the email confirmation email.
-	if($a['email']) $e=$a['email'];
-	else if($a['pendingemail']) $e=$a['pendingemail'];
-
-	email_send("{$role}_new_invite",
-			$e,
-			array("FAIRNAME"=>$conference['name']),
-			array("FAIRNAME"=>$conference['name'],
-				"EMAIL"=>$e,
-				"USERNAME"=>$a['username'],
-				"PASSWORD"=>$password,
-				"ROLE"=>$role)
-			);
-
-	// if we made it this far, the role was successfully added
-	return 'ok';
-}
-
-// find out if the specifed role can be added to this account at the specified conference
-function account_add_role_allowed($accounts_id, $roles_id, $conferences_id){
-	$returnval = true;
-
-	// avoid injections
-	$accounts_id *= 1;
-	$roles_id *= 1;
-	$conferences_id *= 1;
-
-	// get the user id for this account/conference
-	$userdat = mysql_fetch_assoc(mysql_query("SELECT id FROM users WHERE accounts_id = $accounts_id AND conferences_id = $conferences_id"));
-
-	// If this condition isn't met, then the account is not connected to the conference.
-	// In that case, the role can be allowed as there is no conflict.
-	if(is_array($userdat)){
-		$users_id = $userdat['id'];
-
-		// get the roles for the specified account at the specified conference
-		$query = mysql_query("
-			SELECT * FROM user_roles
-			WHERE users_id = $users_id
-		");
-
-		while($returnval && $row = mysql_fetch_assoc($query)){
-			switch($row['type']){
-				case 'participant':
-					// Student cant' add any other role
-					$returnval = false;
-					break;
-				default:
-					if($role == 'participant') {
-						// No role can add the participant role
-						$returnval = false;
-					}
-
-					// All other roles can coexist (even the fair role)
-					break;
-			}
-		}
-
-	}
-
-	return $returnval;
-}
-
-// remove the specified role from the account's user record for the specified conference
-// return true on success, false on failure
-function account_remove_role($accounts_id, $roles_id, $conferences_id){
-	// avoid injections
-	$accounts_id *= 1;
-	$roles_id *= 1;
-	$conferences_id *= 1;
-
-	// make sure the specified id's actually exist
-	if(mysql_result(mysql_query("SELECT COUNT(*) FROM accounts WHERE id = $accounts_id"), 0) != 1){
-		return "invalidaccount";
-	}
-	if(mysql_result(mysql_query("SELECT COUNT(*) FROM roles WHERE id = $roles_id"), 0) != 1){
-		return "invalidrole";
-	}
-	if(mysql_result(mysql_query("SELECT COUNT(*) FROM conferences WHERE id = $conferences_id"), 0) != 1){
-		return "invalidconference";
-	}
-
-	// very little error catching needed here.  If the role's there, we hopfully succeed in
-	// removing it.  If it's not, then we succeed in doing nothing
-	$data = mysql_fetch_array(mysql_query("
-		SELECT * FROM users
-		WHERE conferences_id = $conferences_id
-		AND accounts_id = $accounts_id
-	"));
-	if(is_array($data)){ 
-		// they do indeed have a user record for this conference.
-		$users_id = $data['id'];
-
-		// Do role-specific remove actions
-		$role = mysql_result(mysql_query("SELECT `type` FROM roles WHERE id = $roles_id"), 0);
-		switch($role) {
-			case 'committee':
-				mysql_query("DELETE FROM committees_link WHERE accounts_id='{$accounts_id}'");
-				break;
-
-			case 'judge':
-				mysql_query("DELETE FROM judges_teams_link WHERE users_id='$users_id'");
-				mysql_query("DELETE FROM judges_specialawards_sel WHERE users_id='$users_id'");
-				break;
-
-			default:
-				break;
-		}
-
-		// and now we can remove the role link itself
-		mysql_query("DELETE FROM user_roles WHERE roles_id={$roles_id} AND users_id='$users_id'");
-	}
-	return 'ok';
-}
-
-// A function for handling updates of any fields that can be modified through an API call.
-// returns 'ok' on success, error message otherwise.
-function account_update_info($fields){
-	if($_SESSION['accounts_id']) {
-		$accounts_id = $_SESSION['accounts_id'];
-	}else{
-		return 'you must be logged in to change your account settings';
-	}
-
-	if(!is_array($fields)) return 'account_update_info expects an array';
-	$message = 'ok';
-	$updates = array();
-	foreach($fields as $index => $value){
-		switch($index){
-			case 'username':
-				if(account_valid_user($value)){
-					$u = mysql_real_escape_string($value);
-					$q = mysql_query("SELECT id FROM accounts WHERE username = '$u' AND deleted = 'no' AND id != $accounts_id");
-					if(mysql_num_rows($q) != 0){
-						$message = "username already in use";
-					}else{
-						$updates[$index] = $value;
-					}
-				}else{
-					$message = "invalid username";
-				}
-				break;
-
-			case 'password':
-				$q = mysql_query("SELECT password FROM accounts WHERE id='$accounts_id' AND password='" . mysql_real_escape_string($value) . "'");
-				if(mysql_num_rows($q)){
-					// ignore this parameter.  The password has not changed
-				}else if(!account_valid_password($value)){
-					$message = "invalid password";
-				}else{
-					$updates[$index] = $value;
-				}
-				break;
-
-			case 'link_username_to_email':
-				if(in_array($value, array('yes', 'no'))){
-					if($value=='yes') {
-						//if its yes, we can only do it if username==email
-						if($fields['username']==$fields['email']) {
-							$updates[$index] = $value;
-						} else {
-							$message="username and email must match for link_username_toemail";
-						}
-					}
-					else {
-						$updates[$index] = $value;
-					}
-				}else{
-					$message = '"link_username_to_email" must be either a "yes" or "no" value';
-				}
-				break;
-
-			case 'email':
-				if(isEmailAddress($value)){
-					$updates[$index] = $value;
-				}else{
-					$message = 'invalid e-mail address';
-				}
-				break;
-
-			default:
-				$message = 'invalid field name';
-		}
-	}
-
-	if($message != 'ok'){
-		return $message;
-	}
-
-	// the data's all been validated, so we can continue with the actual update.
-	// doing it separately from the above loop to ensure that it's an all-or nothing update;
-	// none of it will happen if any one part is erroneous.
-	foreach($updates as $index => $value){
-		switch($index){
-			case 'username':
-				$username = mysql_real_escape_string($value);
-				mysql_query("UPDATE accounts SET username = '$username' WHERE id = $accounts_id");
-				break;
-
-			case 'password':
-				account_set_password($accounts_id, mysql_real_escape_string($value));
-				break;
-
-			case 'link_username_to_email':
-				mysql_query("UPDATE accounts SET link_username_to_email = '$value' WHERE id = $accounts_id");
-				break;
-
-			case 'email':
-				account_set_email($accounts_id, $value);
-				break;
-		}
-	}
-
-	return $message;
-}
-
-?>

activities.php

@@ -1,190 +0,0 @@
-<?php
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
-   Copyright (C) 2005 James Grant <james@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?php
-require_once('common.inc.php');
-require_once('user.inc.php');
-require_once('activities.inc.php'); 
-require_once("questions.inc.php");
-require_once('user_edit.inc.php');
-
-/* Ensure they're logged in as a judge, volunteer or admin */
-user_auth_required(array(), array('judge', 'volunteer', 'admin'));
-
-$edit_id = isset($_GET['users_id']) ? intval($_GET['users_id']) : $_SESSION['users_id'];
-if($edit_id != $_SESSION['users_id']) 
-	user_auth_required('admin');
-else
-	user_auth_required();
-
-$u = user_load($edit_id);
-
-// load the times at which the various events are happening
-$times = array();
-$q = mysql_query("
-	SELECT schedule.id, date, hour, minute, duration, title
-	FROM schedule
-	JOIN events ON schedule.events_id = events.id
-	WHERE schedule.conferences_id = {$conference['id']}
-	ORDER BY date, hour, minute
-");
-$x = 0;
-while($r = mysql_fetch_assoc($q)){
-	$dateParts = explode('-', $r['date']);
-	$startTime = mktime($r['hour'], $r['minute'], 0, $dateParts[1], $dateParts[2], $dateParts[0]);
-	$endTime = $startTime + $r['duration'] * 60;
-	$times[$r['id']] = array(
-		'date' => $r['date'],
-		'starttime' => date('g:ia', $startTime),
-		'endtime' => date('g:ia', $endTime),
-		'name' => $r['title'],
-	);
-}
-
-switch($_GET['action']) {
-case 'save':
-	if(!is_array($_POST['languages'])) $_POST['languages']=array();
-
-	$u['languages'] = array();
- 	foreach($_POST['languages'] AS $val)
-		$u['languages'][] = $val;
-
-	$u['willing_chair'] = ($_POST['willing_chair'] == 'yes') ? 'yes' : 'no';
-	$u['highest_psd'] = stripslashes($_POST['highest_psd']);
-	$u['available_events'] = array_values($_POST['time']);
-	user_save($u);
-/*
-	if(is_array($_POST['questions'])){
-		questions_save_answers("judgereg",$u['id'],$_POST['questions']);
-	}
-*/
-
-
-	happy_("Preferences successfully saved");
-
-	$u = user_load($u['id']);
-	$newstatus=activities_status($u);
-?>
-	<script type="text/javascript">
-		user_update_tab_status('activities','<?=$newstatus?>');
-	</script>
-<?
-	exit;
-}
-
-$fields = array('languages[]', 'willing_chair','highest_psd','time[]');
-$required = array('languages[]');
-
-if(count($times) > 1) $required[] = 'time[]';
-
-?>
-<h4><?=i18n("Activity Information")?> - <span class="status_activities"></span></h4>
-<br/>
-<form class="editor" id="activities_form">
-<table width="90%">
-<tr><td style="text-align: left" colspan="2"><b><?=i18n('Language(s)')?></b><hr /></td></tr>
-<tr><?=user_edit_item($u, 'Languages', 'languages[]', 'languages')?></tr>
-<?php if(count($times) > 1) { ?>
-	<tr><td style="text-align: left" colspan="2"><br /><b><?=i18n('Time Availability')?></b><hr />
-	<i><?=i18n('Please specify the events you are available for')?></i>
-	</td></tr>
-
-<?php
-	// get a list of the times they already have selected
-	$sel = array();
-	$q = mysql_query("
-		SELECT eual.* FROM schedule_users_availability_link eual
-		JOIN schedule ON schedule.id = eual.schedule_id
-		WHERE eual.users_id=\"{$u['id']}\"
-		AND schedule.conferences_id = {$conference['id']}
-		ORDER BY `schedule`.`date`, `schedule`.`hour`, `schedule`.`minute`
-	");
-
-	while($r = mysql_fetch_assoc($q)) {
-		foreach($times as $x => $t) {
-			if($x == $r['schedule_id']){
-				$sel[] = $x;
-			}
-		}
-	}
-
-	$items = array();
-	foreach($times as $x => $t) {
-		$items[$x] = "{$t['name']} ({$t['date']} {$t['starttime']} - {$t['endtime']})";
-	}
-
-	echo '<tr>';
-	user_edit_item($u, 'Time Availability', 'time[]', 'checklist', $items, $sel);
-	echo '</tr>';
-}
-//questions_print_answer_editor('judgereg', $u, 'questions');
-?>
-</table>
-<br />
-<button><?=i18n("Save Information")?></button>
-</form>
-
-<script type="text/javascript">
-
-function activities_save()
-{
-	$("#debug").load("<?=$config['SFIABDIRECTORY']?>/activities.php?action=save&users_id=<?=$u['id']?>", $("#activities_form").serializeArray());
-        return false;
-}
-
-$(document).ready(function() {
-	$("#activities_form").validate({
- 		errorPlacement: function(error, element) {
-			if( element.attr('type') == 'checkbox' ) {
-				error.insertAfter( element.parent("span") );
-			} else {
-				error.insertAfter(element);
-			}
-
-		},
-
-		rules: {
-			"languages[]": { required: true },
-			"time[]": { required: <?=in_array('time[]', $required)?'true':'false'?> },
-		},
-
-		messages: {
-			"languages[]": { required:  "<?=i18n('Please select the language(s) you can work in')?>" },
-			"time[]": { required:  "<?=i18n('Please select the time(s) you are available')?>" }
-		},
-		submitHandler: function() {
-			activities_save();
-			return false;
-		},
-		cancelHandler: function() {
-			activities_save();
-			return false;
-		}
-	});
-
-	user_update_tab_status('activities');
-
-});
-
-</script>
-

admin/account_list.php

@@ -1,144 +0,0 @@
-<?
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
-   Copyright (C) 2005 James Grant <james@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?
-if($_GET['show_types'])
-	$NAV_IDENT=$_GET['show_types'][0];
-if($_POST['show_types'])
-	$NAV_IDENT=$_POST['show_types'][0];
-
- require_once('../common.inc.php');
- require_once('../user.inc.php');
- require_once('../judge.inc.php');
- user_auth_required('admin');
-
- require_once('judges.inc.php');
-
- if($_GET['action']=="join" && $_GET['accounts_id']) {
-	 //we're making this user join this conference
-		echo "joining {$_GET['accounts_id']} with {$conference['id']}";
-		$u = user_create(intval($_GET['accounts_id']), $conference['id']);
-		echo happy(i18n("User joined conference"));
- }
-
- send_header("Account List",
- 		array('Committee Main' => 'committee_main.php',
-			'Administration' => 'admin/index.php')
-				);
-
-	$querystr = "SELECT * FROM accounts ORDER BY username";
-	 /*
-	echo $querystr;
-	echo "<br />\n";
-	echo "<br />\n";
-	*/
-	$q = mysql_query($querystr);
-	echo mysql_error();
-	echo "<br />\n";
-	$num = mysql_num_rows($q);
-	echo i18n("Listing %1 account total.",array($num));
-
-	echo mysql_error();
-	echo "<table class=\"tableview\">";
-	echo "<thead>";
-	echo "<tr>";
-	echo " <th>".i18n("Account ID")."</th>";
-	echo " <th>".i18n("Username")."</th>";
-	echo " <th>".i18n("Email Address")."</th>";
-	echo " <th>".i18n("Pending Email")."</th>";
-	echo " <th>".i18n("User Info")."</th>";
-//	echo " <th>".i18n("Actions")."</th>";
-	echo "</tr>";
-	echo "</thead>";
-	echo "<tbody>";
-
-	$tally = array();
-	$tally['active'] = array();
-	$tally['inactive'] = array();
-	$tally['active']['complete'] = 0;
-	$tally['active']['incomplete'] = 0;
-	$tally['active']['na'] = 0;
-	$tally['inactive']['complete'] = 0;
-	$tally['inactive']['incomplete'] = 0;
-	$tally['inactive']['na'] = 0;
-	while($r=mysql_fetch_assoc($q)) {
-		// get the role data for this user
-		echo "<tr>";
-		echo "<td>";
-		echo $r['id'];
-		echo "</td>";
-
-		echo "<td>";
-		echo $r['username'];
-		echo "</td>";
-
-		echo "<td>";
-		echo $r['email'];
-		echo "</td><td>";
-		echo $r['pendingemail'];
-		echo "</td>";
-		echo "<td>";
-		$u=user_load_by_accounts_id($r['id']);
-		if($u) {
-			//we can edit them even if they dont have any roles, duh
-			echo "<b>";
-			echo "<a href=\"#\" onclick=\"return openeditor({$u['id']})\">";
-			if($u['firstname'] || $u['lastname']) {
-				echo $u['firstname']." ".$u['lastname'];
-			}
-			else {
-				echo i18n("No name specified");
-			}
-			echo "</a>";
-			echo "</b>";
-			echo "<br />";
-
-			if(count($u['roles'])) {
-				echo "<table>";
-				foreach($u['roles'] AS $r=>$rd) {
-					echo "<tr><td>";
-					echo $rd['name']; 
-					echo "</td>";
-					if($rd['active']=="yes"){ $cl="happy"; $cls=""; } else { $cl="error"; $cls="not "; }
-					echo "<td class=\"$cl\">{$cls}active</td>";
-					if($rd['complete']=="yes"){ $cl="happy"; $cls=""; } else { $cl="error"; $cls="not "; }
-					echo "<td class=\"$cl\">{$cls}complete</td>";
-					echo "</tr>";
-				}
-				echo "</table>";
-			} else {
-				echo "no roles";
-			}
-		}
-		else {
-			echo "no user record for this conference. ";
-			echo " <a href=\"account_list.php?action=join&accounts_id={$r['id']}\">click to join conference</a>";
-		}
-		echo "</td>";
-		echo "</tr>";
-	}
-	echo "</tbody>";
-	echo "</table>";
-
-	send_footer();
-?>

admin/anneal.inc.php

@@ -1,5 +1,28 @@
-<?php
+<?
+/* 
+   This file is part of the 'Science Fair In A Box' project
+   SFIAB Website: http://www.sfiab.ca
 
+   Copyright (C) 2005-2008 Sci-Tech Ontario Inc <info@scitechontario.org>
+   Copyright (C) 2008-2012 Youth Science Ontario <info@youthscienceontario.ca>
+   Copyright (C) 2005-2012 James Grant <james@lightbox.org>
+
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public
+   License as published by the Free Software Foundation, version 2.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.  If not, write to
+   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+   Boston, MA 02111-1307, USA.
+*/
+?>
+<?
 
 class annealer {
 
@@ -309,6 +332,11 @@ class annealer {
 			
 			if($temperature < 0.1 && $last_cost_count > 10) 
 				break;
+
+			//if we go 1 million iterations without changing the cost, lets give up
+			if($last_cost_count>1000000)
+				break;
+
 //			TRACE("Cost is {$this->cost}\n");
 			$temperature *= $this->rate;
             /*

admin/award_awardcreatedivisional.php

@@ -24,8 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- require_once("awards.inc.php");
+ user_auth_required('committee', 'admin');
- user_auth_required('admin');
 
  send_header('Create All Divisional Awards',
  		array('Committee Main' => 'committee_main.php',
@@ -39,41 +38,39 @@
  if($_GET['award_types_id']) $award_types_id=$_GET['award_types_id'];
  else if($_POST['award_types_id']) $award_types_id=$_POST['award_types_id'];
 
-if($_GET['force'] == "true") {
-	$q=mysql_query("SELECT id FROM award_awards WHERE award_types_id='1' AND conferences_id='{$conference['id']}'");
-	while($r=mysql_fetch_object($q)) {
-		award_delete($r->id);
-	}
-}
-
 	//first, we can only do this if we dont have any type=divisional awards created yet
-	$q=mysql_query("SELECT COUNT(id) AS num FROM award_awards WHERE award_types_id='1' AND conferences_id='{$conference['id']}'");
+	
-	$r=mysql_fetch_object($q);
+	$q = $pdo->prepare("SELECT COUNT(id) AS num FROM award_awards WHERE award_types_id='1' AND year='{$config['FAIRYEAR']}'");
+	$q->execute();
+	$r = $q->fetch(PDO::FETCH_OBJ);
 	if($r->num)
 	{
 		echo error(i18n("%1 Divisional awards already exist.  There must not be any divisional awards in order to run this wizard",array($r->num)));
-		echo "<p><a href='award_awardcreatedivisional.php?force=true'>" . i18n("Proceed Anyways?") . "</a> ";
-		echo i18n("This will delete all existing divisional awards.");
-		echo "</p>";
 	}
 	else
 	{
 
-		$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='".$conference['id']."' ORDER BY id");
+
-		while($r=mysql_fetch_object($q))
+		$q = $pdo->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
+	$q->execute();
+		while($r = $q->fetch(PDO::FETCH_OBJ))
 			$div[$r->id]=$r->division;
 
-		$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='".$conference['id']."' ORDER BY id");
+		
-		while($r=mysql_fetch_object($q))
+		$q = $pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
+		$q->execute();
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 			$cat[$r->id]=$r->category;
 
 		$dkeys = array_keys($div);
 		$ckeys = array_keys($cat);
 
 		if($config['filterdivisionbycategory']=="yes") {
-			$q=mysql_query("SELECT * FROM projectcategoriesdivisions_link WHERE conferences_id='".$conference['id']."' ORDER BY projectdivisions_id,projectcategories_id");
+			
+			$q = $pdo->prepare("SELECT * FROM projectcategoriesdivisions_link WHERE year='".$config['FAIRYEAR']."' ORDER BY projectdivisions_id,projectcategories_id");
+		$q->execute();
 			$divcat=array();
-			while($r=mysql_fetch_object($q)) {
+			while($r=$q->fetch(PDO::FETCH_OBJ)) {
 				$divcat[]=array("c"=>$r->projectcategories_id,"d"=>$r->projectdivisions_id);
 			}
 
@@ -90,9 +87,11 @@ if($_GET['force'] == "true") {
 
 		if($_GET['action']=="create" && $_GET['sponsors_id'])
 		{
-			$q=mysql_query("SELECT * FROM award_prizes WHERE conferences_id='-1' AND award_awards_id='0' ORDER BY `order`");
+		
+			$q = $pdo->prepare("SELECT * FROM award_prizes WHERE year='-1' AND award_awards_id='0' ORDER BY `order`");
+			$q->execute();
 			$prizes=array();
-			while($r=mysql_fetch_object($q))
+			while($r=$q->fetch(PDO::FETCH_OBJ))
 			{
 				$prizes[]=array(
 						"cash"=>$r->cash,
@@ -117,27 +116,35 @@ if($_GET['force'] == "true") {
 				$c_category=$cat[$c_id];
 					
 					echo i18n("Creating %1 - %2",array($c_category,$d_division))."<br />";
-					mysql_query("INSERT INTO award_awards (sponsors_id,award_types_id,name,criteria,`order`,conferences_id) VALUES (
+					
+					$q = $pdo->prepare("INSERT INTO award_awards (sponsors_id,award_types_id,name,criteria,`order`,year) VALUES (
 						'{$_GET['sponsors_id']}',
 						'1',
 						'$c_category - $d_division',
 						'".i18n("Best %1 projects in the %2 division",array($c_category,$d_division))."',
 						'$ord',
-						'{$conference['id']}'
+						'{$config['FAIRYEAR']}'
 					)");
-					echo mysql_error();
+					$q->execute();
-					$award_awards_id=mysql_insert_id();
+					echo $pdo->errorInfo();
+					$award_awards_id=$pdo->lastInsertId();
 
 
-					mysql_query("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,conferences_id) VALUES ('$award_awards_id','$c_id','{$conference['id']}')");
+					
-					mysql_query("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,conferences_id) VALUES ('$award_awards_id','$d_id','{$conference['id']}')");
 
-					$ord++;
+					$q = $pdo->prepare("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,year) VALUES ('$award_awards_id','$c_id','{$config['FAIRYEAR']}')");
+					$q->execute();
+
+					$q = $pdo->prepare("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,year) VALUES ('$award_awards_id','$d_id','{$config['FAIRYEAR']}')");
+					$q->execute();
+										$ord++;
 
 					echo "&nbsp;&nbsp;".i18n("Prizes: ");
 					foreach($prizes AS $prize)
 					{
-						mysql_query("INSERT INTO award_prizes (award_awards_id,cash,scholarship,value,prize,number,`order`,excludefromac,trophystudentkeeper,trophystudentreturn,trophyschoolkeeper,trophyschoolreturn,conferences_id) VALUES (
+						
+						
+						$q = $pdo->prepare("INSERT INTO award_prizes (award_awards_id,cash,scholarship,value,prize,number,`order`,excludefromac,trophystudentkeeper,trophystudentreturn,trophyschoolkeeper,trophyschoolreturn,year) VALUES (
 							'$award_awards_id',
 							'{$prize['cash']}',
 							'{$prize['scholarship']}',
@@ -150,8 +157,12 @@ if($_GET['force'] == "true") {
 							'{$prize['trophystudentreturn']}',
 							'{$prize['trophyschoolkeeper']}',
 							'{$prize['trophyschoolreturn']}',
-							'{$conference['id']}'
+							'{$config['FAIRYEAR']}'
 							)");
+						
+						$q->execute();
+
+
 						echo $prize['prize'].",";
 					}
 					echo "<br />";
@@ -168,11 +179,13 @@ if($_GET['force'] == "true") {
 
 			echo "<table>";
 			echo "<tr><td>".i18n("Sponsor").":</td><td>";
-			$sq=mysql_query("SELECT id,organization FROM sponsors ORDER BY organization");
+			
+			$sq = $pdo->prepare("SELECT id,organization FROM sponsors ORDER BY organization");
+			$sq->execute();
 			echo "<select name=\"sponsors_id\">";
 			//only show the "choose a sponsor" option if we are adding,if we are editing, then they must have already chosen one.
 			echo $firstsponsor;
-			while($sr=mysql_fetch_object($sq))
+			while($sr=$sq->fetch(PDO::FETCH_OBJ))
 			{
 				if($sr->id == $sponsors_id)
 					$sel="selected=\"selected\"";
@@ -183,12 +196,14 @@ if($_GET['force'] == "true") {
 			echo "</select>";
 			echo "</td></tr>";
 
-			echo "<tr><td>".i18n("Prizes")."</td><td><a href=\"award_awards.php?action=edit_prize_template\">Edit prize template for divisional awards</a>";
+			echo "<tr><td>".i18n("Prizes")."</td><td><a href=\"award_prizes.php?award_awards_id=-1\">Edit prize template for divisional awards</a>";
-			//the 'generic' template prizes for the awards are stored with conferences_id =-1 and award_awards_id=0
+			//the 'generic' template prizes for the awards are stored with year =-1 and award_awards_id=0
 
-			$q=mysql_query("SELECT * FROM award_prizes WHERE conferences_id='-1' AND award_awards_id='0' ORDER BY `order`");
+			
+			$q = $pdo->prepare("SELECT * FROM award_prizes WHERE year='-1' AND award_awards_id='0' ORDER BY `order`");
+			$q->execute();
 
-			if(mysql_num_rows($q))
+			if($q->rowCount())
 			{
 			/*
 				echo "<form method=\"post\" action=\"award_prizes.php\">";
@@ -208,7 +223,7 @@ if($_GET['force'] == "true") {
 				echo "</tr>\n";
 
 
-				while($r=mysql_fetch_object($q))
+				while($r=$q->fetch(PDO::FETCH_OBJ))
 				{
 					echo "<tr>\n";
 					echo " <td>$r->prize</td>\n";

admin/award_awards.php

@@ -24,17 +24,21 @@
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require_once('awards.inc.php');
 
  switch($_GET['action']) {
- case 'draw_awards_table':
- 	draw_awards_table();
- 	exit;
  case 'awardinfo_load':
  	$id = intval($_GET['id']);
-	$q=mysql_query("SELECT * FROM award_awards WHERE id='$id'");
+	
-	$ret = mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM award_awards WHERE id='$id'");
+	$q->execute();	
+	$ret = $q->fetch(PDO::FETCH_ASSOC);
+	//json_encode NEEDS UTF8 DATA, but we store it in the database as ISO :(
+	foreach($ret AS $k=>$v) {
+		$ret[$k]=iconv("ISO-8859-1","UTF-8",$v);
+	}
+	//echo iconv("ISO-8859-1","UTF-8",json_encode($ret));
 	echo json_encode($ret);
 	exit;
 
@@ -48,9 +52,11 @@
 	$id=intval($_POST['id']);
 
 	if($id == -1) {
-		$q=mysql_query("INSERT INTO award_awards (conferences_id,self_nominate,schedule_judges) 
+		
-				VALUES ('{$conference['id']}','yes','yes')");
+		$q = $prepare("INSERT INTO award_awards (year,self_nominate,schedule_judges) 
-		$id = mysql_insert_id();
+				VALUES ('{$config['FAIRYEAR']}','yes','yes')");
+		$q->execute();
+		$id = $pdo->lastInsertId();
 		happy_("Award Created");
 		/* Set the award_id in the client */
 		echo "<script type=\"text/javascript\">award_id=$id;</script>";
@@ -58,25 +64,26 @@
 
 	$q = "UPDATE award_awards SET 
 		award_types_id='".intval($_POST['award_types_id'])."',
-		presenter='".mysql_escape_string(stripslashes($_POST['presenter']))."', 
+		presenter='".iconv("UTF-8","ISO-8859-1",stripslashes($_POST['presenter']))."', 
 		excludefromac='".(($_POST['excludefromac'] == 1) ? 1 : 0)."',
 		cwsfaward='".(($_POST['cwsfaward'] == 1) ? 1 : 0)."', 
 		self_nominate='".(($_POST['self_nominate'] == 'yes') ? 'yes' : 'no')."', 
 		schedule_judges='".(($_POST['schedule_judges'] == 'yes') ? 'yes' : 'no')."', 
-		description='".mysql_escape_string(stripslashes($_POST['description']))."' ";
+		description='".iconv("UTF-8","ISO-8859-1",stripslashes($_POST['description']))."' ";
 
 	if(array_key_exists('name', $_POST)) {
 		/* These values may be disabled, if they name key exists, assume
 		 * they aren't disabled and save them too */
-		$q .= ",name='".mysql_escape_string(stripslashes($_POST['name']))."',
+		$q .= ",name='".iconv("UTF-8","ISO-8859-1",stripslashes($_POST['name']))."',
-			criteria='".mysql_escape_string(stripslashes($_POST['criteria']))."', 
+			criteria='".iconv("UTF-8","ISO-8859-1",stripslashes($_POST['criteria']))."', 
 			sponsors_id='".intval($_POST['sponsors_id'])."' ";
 	}
 	$q .= "WHERE id='$id'";
-	mysql_query($q);
+	$q = $pdo->prepare($q);
+	$q->execute();
 	print_r($_POST);
 	echo $q;
-	echo mysql_error();
+	echo $pdo->errorInfo();
 	happy_("Award information saved");
 	exit;
 
@@ -84,14 +91,17 @@
  	$id = intval($_GET['id']);
 	//select the current categories that this award is linked to
 	$ret = array('categories'=>array(), 'divisions'=>array() );
-	$q=mysql_query("SELECT * FROM award_awards_projectcategories WHERE award_awards_id='$id'");
+	
-	while($r=mysql_fetch_assoc($q)) {
+	$q=$pdo->prepare("SELECT * FROM award_awards_projectcategories WHERE award_awards_id='$id'");
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_ASSOC)) {
 		$ret['categories'][] = $r['projectcategories_id'];
 	}
 
 	//select the current categories that this award is linked to
-	$q=mysql_query("SELECT * FROM award_awards_projectdivisions WHERE award_awards_id='$id'");
+	$q = $pdo->$prepare("SELECT * FROM award_awards_projectdivisions WHERE award_awards_id='$id'");
-	while($r=mysql_fetch_assoc($q)) {
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_ASSOC)) {
 		$ret['divisions'][] = $r['projectdivisions_id'];
 	}
 	echo json_encode($ret);
@@ -105,55 +115,31 @@
 		error_("Invalid data");
 		exit;
 	}
-	foreach($_POST['categories'] AS $key=>$cat) {
-		if(!is_numeric($cat)) {
-			error_("Invalid data");
-			exit;
-		}
-	}
-	foreach($_POST['divisions'] AS $key=>$div) {
-		if(!is_numeric($div)) {
-			error_("Invalid data");
-			exit;
-		}
-	}
-
-	$q=mysql_query("SELECT (CASE WHEN ((SELECT a.award_types_id FROM award_awards AS a WHERE id=$id) = 1) THEN (
-			SELECT COUNT(*) AS c FROM award_awards AS aa 
-			LEFT JOIN award_awards_projectcategories AS aapc ON (aa.id = aapc.award_awards_id) 
-			LEFT JOIN award_awards_projectdivisions AS aapd ON (aa.id = aapd.award_awards_id) 
-			WHERE aa.conferences_id = {$conference['id']} AND 
-				aa.award_types_id=1 AND 
-				aa.id != $id AND
-				projectcategories_id IN (". implode(",", $_POST['categories']) .") AND 
-				projectdivisions_id IN (". implode(",", $_POST['divisions']) .")
-		) ELSE 0 END) as c");
-
-	$r = mysql_fetch_object($q);
-	if($r->c != 0) {
-		error_("Cannot save. There is already a divisional award with the same eligibility criteria.");
-		exit;
-	}
 
 	//wipe out any old award-category links
-	mysql_query("DELETE FROM award_awards_projectcategories WHERE award_awards_id='$id'");
+	$q = $pdo->prepare("DELETE FROM award_awards_projectcategories WHERE award_awards_id='$id'");
-
+	$q->execute();
 	foreach($_POST['categories'] AS $key=>$cat) {
 		$c = intval($cat);
-		mysql_query("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,conferences_id) 
+		$q = $pdo->prepare("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,year) 
-				VALUES ('$id','$c','{$conference['id']}')");
+				VALUES ('$id','$c','{$config['FAIRYEAR']}')");
-		echo mysql_error();
+		$q->execute();
+		echo $q->errorInfo();
 	}
 
 	//wipe out any old award-divisions links
-	mysql_query("DELETE FROM award_awards_projectdivisions WHERE award_awards_id='$id'");
+	
+	$q = $pdo->prepare("DELETE FROM award_awards_projectdivisions WHERE award_awards_id='$id'");
+	$q->execute();
 
 	//now add the new ones
 	foreach($_POST['divisions'] AS $key=>$div) {
 		$d = intval($div);
-		mysql_query("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,conferences_id) 
+	
-				VALUES ('$id','$d','{$conference['id']}')");
+		$q = $pdo->prepare("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,year) 
-		echo mysql_error();
+				VALUES ('$id','$d','{$config['FAIRYEAR']}')");
+		$q->execute();
+		echo $pdo->errorInfo();
 	}
 	happy_("Eligibility information saved");
 	exit;
@@ -163,8 +149,9 @@
 	foreach ($_GET['prizelist'] as $position=>$id) {
 		if($id == '') continue;
 		$order++;
-		mysql_query("UPDATE `award_prizes` SET `order`='$order' WHERE `id`='$id'");
+		
-	}
+		$q = $pdo->prepare("UPDATE `award_prizes` SET `order`='$order' WHERE `id`='$id'");
+	$q->execute();	}
 //	print_r($_GET);
 	happy_("Order Updated.");
 	exit;
@@ -174,7 +161,9 @@
 	foreach ($_GET['awardlist'] as $position=>$id) {
 		if($id == '') continue;
 		$order++;
-		mysql_query("UPDATE `award_awards` SET `order`='$order' WHERE `id`='$id'");
+		
+		$q = $pdo->prepare("UPDATE `award_awards` SET `order`='$order' WHERE `id`='$id'");
+		$q->execute();
 	}
 	happy_("Order updated");
 	exit;
@@ -182,52 +171,64 @@
  case 'prizeinfo_load':
 	$id = intval($_GET['id']);
 	if($id == -1) {
-		$q=mysql_query("SELECT * FROM award_prizes WHERE conferences_id='-1' AND award_awards_id='0' ORDER BY `order`");
+		
+		$q = $pdo->prepare("SELECT * FROM award_prizes WHERE year='-1' AND award_awards_id='0' ORDER BY `order`");
+		$q->execute();
 	} else {
-		$q = mysql_query("SELECT * FROM award_prizes WHERE award_awards_id='$id' ORDER BY `order`");
+		
+		$q = $prepare("SELECT * FROM award_prizes WHERE award_awards_id='$id' ORDER BY `order`");
+		$q->execute();
 	}
-	while($r=mysql_fetch_assoc($q)) {
+	while($r=$q->fetch(PDO::FETCH_ASSOC)) {
+		foreach($r AS $k=>$v) {
+			$r[$k]=iconv("ISO-8859-1","UTF-8",$v);
+		}
 		$ret[] = $r;
 	}
 	echo json_encode($ret);
 	exit;
  case 'prize_load':
 	$id = intval($_GET['id']);
-	$q = mysql_query("SELECT * FROM award_prizes WHERE id='$id'");
+	
-	$ret=mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM award_prizes WHERE id='$id'");
+	$q->execute();
+	$ret = $q->fetch(PDO::FETCH_ASSOC);
 	foreach($ret AS $k=>$v) {
-		$ret[$k]=$v;
+		$ret[$k]=iconv("ISO-8859-1","UTF-8",$v);
 	}
 	echo json_encode($ret);
 	exit;
 
  case 'prize_create':
 	$aaid = intval($_GET['award_awards_id']);
-	$conferenceId = $conference['id'];
+	$year = $config['FAIRYEAR'];
 	if($aaid == -1) {
 		$aaid = 0;
-		$conferenceId = -1;
+		$year = -1;
 	}
-	mysql_query("INSERT INTO award_prizes(award_awards_id,conferences_id) VALUES ('$aaid','$conferenceId');");
+
-	$ret = array('id' => mysql_insert_id() );
+	$q = $pdo->prepare("INSERT INTO award_prizes(award_awards_id,year) VALUES ('$aaid','$year');");
+	$ret = array('id' => $pdo->lastInsertId() );
 	echo json_encode($ret);
 	exit;
 
  case 'prize_save':
 	$id = intval($_POST['id']);
-	$q="UPDATE award_prizes SET 
+	
-				prize='".mysql_escape_string(stripslashes($_POST['prize']))."', 
+	$q = $pdo->prepare("UPDATE award_prizes SET 
+				prize='".stripslashes(iconv("UTF-8","ISO-8859-1",$_POST['prize']))."', 
 				cash='".intval($_POST['cash'])."',
 				scholarship='".intval($_POST['scholarship'])."',
 				value='".intval($_POST['value'])."',
 				number='".intval($_POST['number'])."',
 				excludefromac='".(($_POST['excludefromac']==1)? 1 : 0)."',
-				trophystudentkeeper='".(array_key_exists('trophystudentkeeper', $_POST) ? 1 : 0)."',
+				trophystudentkeeper='".(($_POST['trophystudentkeeper']==1) ? 1 : 0)."',
-				trophystudentreturn='".(array_key_exists('trophystudentreturn', $_POST) ? 1 : 0)."',
+				trophystudentreturn='".(($_POST['trophystudentreturn']==1) ? 1 : 0)."',
-				trophyschoolkeeper='".(array_key_exists('trophyschoolkeeper', $_POST) ? 1 : 0)."',
+				trophyschoolkeeper='".(($_POST['trophyschoolkeeper']==1) ? 1 : 0)."',
-				trophyschoolreturn='".(array_key_exists('trophyschoolreturn', $_POST) ? 1 : 0)."'
+				trophyschoolreturn='".(($_POST['trophyschoolreturn']==1) ? 1 : 0)."'
-				WHERE id='$id'";
+				WHERE id='$id'");
-	mysql_query($q);
+	
+	$q->execute();
 //	echo $q;
 //	echo mysql_error();
 	happy_("Prize saved");
@@ -242,15 +243,19 @@
  case 'feeder_load':
  	$id = intval($_GET['id']);
 	/* Prepare two lists of fair IDs, for which fairs can upload and download this award */
-	$q=mysql_query("SELECT * FROM fairs_awards_link WHERE award_awards_id='$id'");
+	
+	$q = $pdo->prepare("SELECT * FROM fairs_awards_link WHERE award_awards_id='$id'");
+	$q->execute();
 	$ul = array(); 
 	$dl = array();
-	while($r=mysql_fetch_assoc($q)) {
+	while($r=$q->fetch(PDO::FETCH_ASSOC)) {
 		if($r['upload_winners'] == 'yes') $ul[$r['fairs_id']] = true;
 		if($r['download_award'] == 'yes') $dl[$r['fairs_id']] = true;
 	}
-	$q = mysql_query("SELECT * FROM award_awards WHERE id='$id'");
+	
-	$a = mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM award_awards WHERE id='$id'");
+	$q -> execute();
+	$a = fetch(PDO::FETCH_ASSOC)
 ?>
 	<h4><?=i18n("Feeder Fairs")?></h4>
 	<form id="feeder_form">
@@ -281,13 +286,15 @@
 		<th style="width: 5em"><?=i18n("Upload Winners")?></th>
 		</tr>
 <?
-	$q = mysql_query("SELECT * FROM fairs WHERE type='feeder'");
+	
-	while($r = mysql_fetch_assoc($q)) {
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE type='feeder'");
+	$q->execute();
+	while($r = $q->fetch(PDO::FETCH_ASSOC)) {
 		echo "<tr><td style=\"padding-left:1em;padding-right:1em\">{$r['name']}</td>";
 		$ch = $dl[$r['id']] == true ? 'checked="checked"' : '';
-		echo "<td style=\"text-align:center\"><input type=\"checkbox\" name=\"feeder_dl[]\" value=\"{$r['id']} $ch \"></td>";
+		echo "<td style=\"text-align:center\"><input type=\"checkbox\" name=\"feeder_dl[]\" value=\"{$r['id']}\" $ch ></td>";
 		$ch = $ul[$r['id']] == true ? 'checked="checked"' : '';
-		echo "<td style=\"text-align:center\"><input type=\"checkbox\" name=\"feeder_ul[]\" value=\"{$r['id']} $ch \"></td>";
+		echo "<td style=\"text-align:center\"><input type=\"checkbox\" name=\"feeder_ul[]\" value=\"{$r['id']}\" $ch ></td>";
 		echo '</tr>';
 	}
 ?>
@@ -312,24 +319,31 @@
 	foreach($ul AS $fairs_id) $data[$fairs_id]['ul']  = true;
 
 	/* Now save each one */
-	mysql_query("DELETE FROM fairs_awards_link WHERE award_awards_id='$id'");
+	
-				echo mysql_error();
+	$q = $pdo->prepare("DELETE FROM fairs_awards_link WHERE award_awards_id='$id'");
+	$q->execute();
+	echo $pdo->errorInfo();
 	foreach($data as $fairs_id=>$f) {
 		$dl = ($f['dl'] == true) ? 'yes' : 'no';
 		$ul = ($f['ul'] == true) ? 'yes' : 'no';
-		mysql_query("INSERT INTO fairs_awards_link (award_awards_id,fairs_id,download_award,upload_winners)
+	
+		$q = $pdo->prepare("INSERT INTO fairs_awards_link (award_awards_id,fairs_id,download_award,upload_winners)
 				VALUES ('$id','$fairs_id','$dl','$ul')");
-				echo mysql_error();
+		$q->execute();
+		echo $pdo->errorInfo();
 	}
-	$ident=mysql_escape_string(stripslashes($_POST['identifier']));
+	$ident=stripslashes($_POST['identifier']);
 	$per_fair = $_POST['per_fair'] == 'yes' ? 'yes' : 'no';
 	$mat = intval($_POST['additional_materials']);
 	$w = intval($_POST['register_winners']);
-	mysql_query("UPDATE award_awards SET external_identifier='$ident',
+	
+	
+	$q = $pdo->prepare("UPDATE award_awards SET external_identifier='$ident',
 						external_additional_materials='$mat',
 						external_register_winners='$w',
 						per_fair='$per_fair'
 					WHERE id='$id'");
+	$q->execute();
 
 	happy_("Feeder Fair information saved");
 	exit;
@@ -427,7 +441,7 @@ function awardinfo_save()
 					$("#popup_editor").dialog('close');
 					popup_editor(award_id, '');
 				}
-				draw_awards_table();
+
 			});
 	return false;
 }
@@ -438,32 +452,17 @@ function update_eligibility()
 	award_tab_update['eligibility'] = award_id;
 	$.getJSON("<?=$_SERVER['PHP_SELF']?>?action=eligibility_load&id="+award_id,  
 		function(json){
-			$("[name^=\"divisions\"]").attr('checked',false);
+			$("[name=categories\\[\\]]").val(json.categories);
-			$("[name^=\"categories\"]").attr('checked',false);
+			$("[name=divisions\\[\\]]").val(json.divisions);
-
-			for(i=0;i<json.categories.length;i++) {
-				var c=json.categories[i];
-				$("#eligibility_categories_"+c).attr('checked', 'checked');
-			}
-			for(i=0;i<json.divisions.length;i++) {
-				var d=json.divisions[i];
-				$("#eligibility_divisions_"+d).attr('checked', 'checked');
-			}
 		});
 }
 
-function prizefields_reset() {
-	$(".prizeinfo").removeAttr("checked");
-	$(".prizeinfo").attr("disabled", "disabled").val('');
-	$("#prizeinfo_save").attr("disabled", "disabled");
-}
-
 function prizelist_refresh()
 {
 	$("#prizelist").tableDnD({
 		        onDrop: function(table, row) {
 				var order = $.tableDnD.serialize();
-				$("#debug").load("<?=$_SERVER['PHP_SELF']?>?action=prize_order&"+order); 
+				$("#prizeinfo_info").load("<?=$_SERVER['PHP_SELF']?>?action=prize_order&"+order); 
 				/* Change the order */
 				var rows = table.tBodies[0].rows;
 				for (var i=0; i<rows.length; i++) {
@@ -513,31 +512,11 @@ function edit_prize(id)
 			$("#prizeinfo_scholarship").val(json.scholarship);
 			$("#prizeinfo_value").val(json.value);
 			$("#prizeinfo_number").val(json.number);
-			if(json.trophystudentkeeper == 1) {
+			$("#prizeinfo_trophystudentkeeper").val([json.trophystudentkeeper]);
-				$("#prizeinfo_trophystudentkeeper").attr("checked", "checked");
+			$("#prizeinfo_trophystudentreturn").val([json.trophystudentreturn]);
-			} else {
+			$("#prizeinfo_trophyschoolreturn").val([json.trophyschoolreturn]);
-				$("#prizeinfo_trophystudentkeeper").removeAttr("checked");
+			$("#prizeinfo_trophyschoolkeeper").val([json.trophyschoolkeeper]);
-			}
+			$("#prizeinfo_excludefromac").val([json.excludefromac]);
-			if(json.trophystudentreturn == 1) {
-				$("#prizeinfo_trophystudentreturn").attr("checked", "checked");
-			} else {
-				$("#prizeinfo_trophystudentreturn").removeAttr("checked");
-			}
-			if(json.trophyschoolreturn == 1) {
-				$("#prizeinfo_trophyschoolreturn").attr("checked", "checked");
-			} else {
-				$("#prizeinfo_trophyschoolreturn").removeAttr("checked");
-			}
-			if(json.trophyschoolkeeper == 1) {
-				$("#prizeinfo_trophyschoolkeeper").attr("checked", "checked");
-			} else {
-				$("#prizeinfo_trophyschoolkeeper").removeAttr("checked");
-			}
-			if(json.excludefromac == 1) {
-				$("#prizeinfo_excludefromac").attr("checked", "checked");
-			} else {
-				$("#prizeinfo_excludefromac").removeAttr("checked");
-			}
 			$(".prizeinfo").removeAttr("disabled");
 			$("#prizeinfo_save").removeAttr("disabled");
         });
@@ -564,13 +543,12 @@ function prize_delete(id)
 {
 	var confirm = confirmClick('Are you sure you want to delete this prize?');
 	if(confirm == true) {
-		$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=prize_delete&id="+id, $("#prizeinfo").serializeArray(),
+		$("#prizeinfo_info").load("<?$_SERVER['PHP_SELF']?>?action=prize_delete&id="+id,null,
 			function(responseText, textStatus, XMLHttpRequest)
 			{
 				$(".prizelist_tr#"+id).fadeTo('slow', 0);
 				$(".prizelist_tr#"+id).remove();
 				prizelist_refresh();
-				prizefields_reset();
 			});
 	}
 	return 0;
@@ -689,10 +667,12 @@ $(document).ready(function() {
 			</td></tr>
 		<tr><td><?=i18n("Sponsor")?>:</td><td>
 <?
-	$sq=mysql_query("SELECT id,organization FROM sponsors ORDER BY organization");
+	
+	$sq = $pdo->prepare("SELECT id,organization FROM sponsors ORDER BY organization");
+	$sq->execute();
 	echo "<select id=\"awardinfo_sponsors_id\" name=\"sponsors_id\">";
 	echo "<option value=\"\">".i18n("Choose a sponsor")."</option>\n";
-	while($sr=mysql_fetch_object($sq)) {
+	while($sr=$sq->fetch(PDO::FETCH_OBJ)) {
 		echo "<option value=\"$sr->id\">".i18n($sr->organization)."</option>";
 	}
 ?>
@@ -702,11 +682,13 @@ $(document).ready(function() {
 			</td></tr>
 		<tr><td><?=i18n("Type")?>:</td><td>
 <?
-	$tq=mysql_query("SELECT id,type FROM award_types WHERE conferences_id='{$conference['id']}' ORDER BY type");
+	
+	$tq = $pdo->prepare("SELECT id,type FROM award_types WHERE year='{$config['FAIRYEAR']}' ORDER BY type");
+	$tq->execute();
 	echo "<select id=\"awardinfo_award_types_id\" name=\"award_types_id\">";
 	//only show the "choose a type" option if we are adding,if we are editing, then they must have already chosen one.
 	echo $firsttype;
-	while($tr=mysql_fetch_object($tq)) {
+	while($tr=$tq->fetch(PDO::FETCH_OBJ)) {
 		echo "<option value=\"$tr->id\">".i18n($tr->type)."</option>";
 	}
 ?>
@@ -747,20 +729,24 @@ $(document).ready(function() {
 //	if(count($currentcategories)==0) $class="class=\"error\""; else $class="";
 
 	//now select all the categories so we can list them all
-	$cq=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='{$conference['id']}' ORDER BY mingrade");
+
-	echo mysql_error();
+	$cq = $pdo->prepare("SELECT * FROM projectcategories WHERE year='{$config['FAIRYEAR']}' ORDER BY mingrade");
-	while($cr=mysql_fetch_object($cq)) {
+	$cq->execute();
-		echo "<input type=\"checkbox\" id=\"eligibility_categories_{$cr->id}\" name=\"categories[]\" value=\"$cr->id\" /> ".i18n($cr->category)."<br />";
+	echo $pdo->errorInfo();
+	while($cr=$cq->fetch(PDO::FETCH_OBJ)) {
+		echo "<input type=\"checkbox\" id=\"eligibility_categories_{$cr->id}\" name=\"categories[]\" value=\"$cr->id\" />".i18n($cr->category)."<br />";
 	}
 ?>
 	</td></tr>
 
 	<tr><td><?=i18n("Divisions")?>:</td><td>
 <?
-	$dq=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conference['id']}' ORDER BY division");
+	
-	echo mysql_error();
+	$dq->prepare("SELECT * FROM projectdivisions WHERE year='{$config['FAIRYEAR']}' ORDER BY division");
-	while($dr=mysql_fetch_object($dq)) {
+	$dq->execute();
-		echo "<input type=\"checkbox\" id=\"eligibility_divisions_{$dr->id}\" name=\"divisions[]\" value=\"$dr->id\" /> ".i18n($dr->division)."<br />";
+	echo errorInfo();
+	while($dr=$dq->fetch(PDO::FETCH_OBJ)) {
+		echo "<input type=\"checkbox\" id=\"eligibility_divisions_{$dr->id}\" name=\"divisions[]\" value=\"$dr->id\" />".i18n($dr->division)."<br />";
 	}
 //	if(count($currentcategories)==0 || count($currentdivisions)==0)
 //		echo "<tr><td colspan=\"2\" class=\"error\">".i18n("At least one age category and one division must be selected")."</td></tr>";
@@ -861,8 +847,6 @@ function popup_editor(id, mode)
 	 * activation anyway */
 	award_tab_update = new Array();
 
-	prizefields_reset();
-
 	/* Force no tabs to be selected, need to set collapsible 
 	 * to true first */
 	$('#editor_tabs').tabs('option', 'collapsible', true);
@@ -905,7 +889,7 @@ function awardlist_refresh()
 		        onDrop: function(table, row) {
 					var order = $.tableDnD.serialize();
 //					$(row).fadeTo('fast',1);
-					$("#debug").load("<?=$_SERVER['PHP_SELF']?>?action=award_order&"+order); 
+					$("#award_info").load("<?=$_SERVER['PHP_SELF']?>?action=award_order&"+order); 
 
 					/* Change the order */
 					var rows = table.tBodies[0].rows;
@@ -935,10 +919,6 @@ function award_delete(id)
 
 }
 
-function draw_awards_table(){
-	$('#awards_table').load("<?=$_SERVER['PHP_SELF']?>?action=draw_awards_table");
-}
-
 $(document).ready(function() { 
 	awardlist_refresh();
 });
@@ -985,10 +965,12 @@ echo "<form method=\"get\" action=\"award_awards.php\" name=\"filterchange\">";
 
 echo "<table><tr><td colspan=\"2\">";
 
-$q=mysql_query("SELECT id,organization FROM sponsors ORDER BY organization");
+
+$q = $pdo->prepare("SELECT id,organization FROM sponsors ORDER BY organization");
+$q->execute();
 echo "<select name=\"sponsors_id\" onchange=\"document.forms.filterchange.submit()\">";
 echo "<option value=\"all\">".i18n("All Sponsors")."</option>";
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	if($r->id == $sponsors_id) {
 		$sel="selected=\"selected\"";
 		$sponsors_organization=$r->organization;
@@ -1000,10 +982,12 @@ echo "</select>";
 echo "</td></tr>";
 echo "<tr><td>";
 
-$q=mysql_query("SELECT id,type FROM award_types WHERE conferences_id='{$conference['id']}' ORDER BY type");
+
+$q = $pdo->prepare("SELECT id,type FROM award_types WHERE year='{$config['FAIRYEAR']}' ORDER BY type");
+$q->execute();
 echo "<select name=\"award_types_id\" onchange=\"document.forms.filterchange.submit()\">";
 echo "<option value=\"all\">".i18n("All Award Types")."</option>";
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	if($r->id == $award_types_id) {
 		$sel="selected=\"selected\"";
 		$award_types_type=$r->type;
@@ -1039,63 +1023,46 @@ echo "</table>";
 <br /><br />
 
 <?
-echo "<div id=\"awards_table\">";
+/* For some reason, this submit button opens the dialog then it closes right away, but it doesn't
-draw_awards_table();
+ * if the entry is done through the a href */
-echo "</div>";
+//<input type="submit" onClick="award_create();" value="<?=i18n("Create New Award")>" />
 
-if($_GET['action'] == 'edit_prize_template') {
+if($sponsors_id) $where_asi="AND sponsors_id='$sponsors_id'";
+if($award_types_id) $where_ati="AND award_types_id='$award_types_id'";
+//			if($award_sponsors_confirmed) $where_asc="AND award_sponsors.confirmed='$award_sponsors_confirmed'";
 
-	?><script type="text/javascript">
+if(!$orderby) $orderby="order";
-$(document).ready(function() { 
-    popup_editor(-1,'template');
-});           
-	</script>
-	<?
- }
-send_footer();
 
-function draw_awards_table(){
-	global $config;
-	global $conference;
-	 $award_types_id=$_SESSION['award_types_id'];
-	 $sponsors_id=$_SESSION['sponsors_id'];
 
-	/* For some reason, this submit button opens the dialog then it closes right away, but it doesn't
+	$q = $pdo->prepare("SELECT 
-	 * if the entry is done through the a href */
+			award_awards.id,
-	//<input type="submit" onClick="award_create();" value="<?=i18n("Create New Award")>" />
+			award_awards.name,
+			award_awards.order,
+			award_awards.award_source_fairs_id,
+			award_types.type,
+			sponsors.organization
+		FROM 
+			award_awards
+		LEFT JOIN sponsors ON sponsors.id = award_awards.sponsors_id
+		LEFT JOIN award_types ON award_types.id = award_awards.award_types_id
+		WHERE 
+				award_awards.year='{$config['FAIRYEAR']}'
+				$where_asi
+				$where_ati
+			AND 	award_types.year='{$config['FAIRYEAR']}'
+		ORDER BY `$orderby`");
+	
+	$q->execute();
 
-	if($sponsors_id) $where_asi="AND sponsors_id='$sponsors_id'";
+echo $pdo->errorInfo();
-	if($award_types_id) $where_ati="AND award_types_id='$award_types_id'";
-	//			if($award_sponsors_confirmed) $where_asc="AND award_sponsors.confirmed='$award_sponsors_confirmed'";
 
-	if(!$orderby) $orderby="order";
+if($q->rowCount())
-
+		{
-	$q=mysql_query("SELECT 
+	echo "* ".i18n("Click on the Script Order and drag to re-order the awards");
-				award_awards.id,
+	echo "<table id=\"awardlist\" class=\"tableview\" >";
-				award_awards.name,
+	echo "<tr class=\"nodrop nodrag\">";
-				award_awards.order,
+	echo " <th>".i18n("Order")."</th>";
-				award_awards.award_source_fairs_id,
+	echo " <th>".i18n("Sponsor")."</th>";
-				award_types.type,
-				sponsors.organization
-			FROM 
-				award_awards
-			LEFT JOIN sponsors ON sponsors.id = award_awards.sponsors_id
-			LEFT JOIN award_types ON award_types.id = award_awards.award_types_id
-			WHERE 
-					award_awards.conferences_id='{$conference['id']}'
-					$where_asi
-					$where_ati
-				AND 	award_types.conferences_id='{$conference['id']}'
-			ORDER BY `$orderby`");
-
-	echo mysql_error();
-
-	if(mysql_num_rows($q)){
-		echo "* ".i18n("Click on the Script Order and drag to re-order the awards");
-		echo "<table id=\"awardlist\" class=\"tableview\" >";
-		echo "<tr class=\"nodrop nodrag\">";
-		echo " <th>".i18n("Order")."</th>";
-		echo " <th>".i18n("Sponsor")."</th>";
 		echo " <th>".i18n("Type")."</th>";
 		echo " <th>".i18n("Name")."</th>";
 		echo " <th>".i18n("Prizes")."</th>";
@@ -1104,7 +1071,7 @@ function draw_awards_table(){
 
 
 		$hasexternal=false;
-		while($r=mysql_fetch_object($q)) {
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			if($r->award_source_fairs_id) {
 				$cl="externalaward";
 				$hasexternal=true;
@@ -1117,16 +1084,18 @@ function draw_awards_table(){
 			echo " <td $eh>{$r->type}</td>\n";
 			echo " <td $eh>{$r->name}</td>\n";
 
-			$numq=mysql_query("SELECT SUM(number) AS num FROM award_prizes WHERE award_awards_id='{$r->id}'");
+	
-			$numr=mysql_fetch_assoc($numq);
+			$numq = $pdo->prepare("SELECT SUM(number) AS num FROM award_prizes WHERE award_awards_id='{$r->id}'");
+			$numq->execute();
+			$numr=$numq->fetch(PDO::FETCH_ASSOC);
 			if(!$numr['num'])
 				$numr['num']=0;
 
 			echo " <td $eh align=\"center\">{$numr['num']}</td>";
 
 			echo " <td align=\"center\">";
-	//		echo "<img border=\"0\" src=\"{$config['SFIABDIRECTORY']}/images/16/edit.{$config['icon_extension']}\">";
+//			echo "<img border=\"0\" src=\"{$config['SFIABDIRECTORY']}/images/16/edit.{$config['icon_extension']}\">";
-	//		echo "&nbsp;";
+//			echo "&nbsp;";
 			echo "<a onclick=\"award_delete({$r->id});\" href=\"#\" ><img border=0 src=\"{$config['SFIABDIRECTORY']}/images/16/button_cancel.{$config['icon_extension']}\"></a>";
 
 			echo " </td>\n";
@@ -1135,9 +1104,24 @@ function draw_awards_table(){
 		if($hasexternal)
 			echo "<tr class=\"externalaward\"><td colspan=\"6\">".i18n("Indicates award imported from an external source")."</td></tr>";
 		echo "</table>\n";
-//		echo "</form>";
+		echo "</form>";
 	}
 	echo "<br />";
-	//echo "<a href=\"award_prizes.php?award_awards_id=-1\">Edit prizes for the generic prize template</a>";
+//	echo "<a href=\"award_prizes.php?award_awards_id=-1\">Edit prizes for the generic prize template</a>";
-}
+
+
+	if($_GET['action'] == 'edit_prize_template') {
+ 	
+		?><script type="text/javascript">
+        $(document).ready(function() { 
+            popup_editor(-1,'template');
+        });           
+		</script>
+		<?
+	 }
+
+
+
+send_footer();
+
 ?>

admin/award_download.php

@@ -23,7 +23,7 @@
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require_once('curl.inc.php');
  require_once('awards.inc.php');
 
@@ -32,8 +32,10 @@
 switch($_GET['action']) {
 case 'check':
 	$fairs_id = intval($_GET['fairs_id']);
-	$q=mysql_query("SELECT * FROM fairs WHERE id='$fairs_id'");
+	
-	$fair=mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='$fairs_id'");
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);
 	if(!($fair['username'] && $fair['password'])) {
 		echo error(i18n("Username and Password are not set for source '%1'.  Please set them in the SFIAB Configuration/External Award Sources editor first",array($r->name)));
 		return;
@@ -71,9 +73,11 @@ case 'check':
 	}			
 
 	//get a list of all the existing awards for this external source
-	$aq=mysql_query("SELECT * FROM award_awards WHERE award_source_fairs_id='$fairs_id' AND conferences_id='{$conference['id']}'");
+	
+	$aq = $pdo->prepare("SELECT * FROM award_awards WHERE award_source_fairs_id='$fairs_id' AND year='{$config['FAIRYEAR']}'");
+	$aq->execute();
 	$existingawards=array();
-	while($ar=mysql_fetch_object($aq)) {
+	while($ar=$aq->fetch(PDO::FETCH_OBJ)) {
 		$existingawards[$ar->id] = true;
 	}
 	
@@ -106,27 +110,34 @@ case 'check':
 			continue;
 		}
 
-		$tq=mysql_query("SELECT * FROM award_awards WHERE 
+	
+		$tq = $pdo->prepare("SELECT * FROM award_awards WHERE 
 					external_identifier='$identifier' AND 
 					award_source_fairs_id='$fairs_id' AND 
-					conferences_id='{$conference['id']}'");
+					year='$year'");
-		if(mysql_num_rows($tq)  == 0) {
+		$tq->execute();
+		if($tq->rowCount()  == 0) {
 			/* Award doesn't exist, create it, then update it with the common code below */
-			mysql_query("INSERT INTO award_awards (award_types_id,
+			
+			$q = $pdo->prepare("INSERT INTO award_awards (award_types_id,
 						year, external_identifier,
 						award_source_fairs_id) 
 					VALUES (2,'{$year}',
-					'".mysql_escape_string($identifier)."',
+					'".$identifier."',
 					'$fairs_id')");
-			$award_id=mysql_insert_id();
+			$q->execute();
+			$award_id=$q->insertLastId();
 			/* By default make all divs/cats eligible */
 			foreach($divs as $id=>$d) 
-				mysql_query("INSERT INTO award_awards_projectdivisions(award_awards_id,projectdivisions_id,conferences_id) VALUES ('$award_id','$id','{$conference['id']}')");
+			$q = $pdo->prepare("INSERT INTO award_awards_projectdivisions(award_awards_id,projectdivisions_id,year) VALUES ('$award_id','$id','{$config['FAIRYEAR']}')");	
+			$q->execute();
+			
 			foreach($cats as $id=>$c) 
-				mysql_query("INSERT INTO award_awards_projectcategories(award_awards_id,projectcategories_id,conferences_id) VALUES ('$award_id','$id','{$conference['id']}')");
+			$q = $pdo->prepare("INSERT INTO award_awards_projectcategories(award_awards_id,projectcategories_id,year) VALUES ('$award_id','$id','{$config['FAIRYEAR']}')");	
+			$q->execute();
 		} else {
 			echo i18n("Award already exists, updating info")."<br />";
-			$awardrecord=mysql_fetch_object($tq);
+			$awardrecord=Tq->fetch(PDO::FETCH_OBJ);
 			$award_id = $awardrecord->id;
 		}
 
@@ -134,35 +145,40 @@ case 'check':
 		unset($existingawards[$award_id]);
 
 		//check if the sponsor exists, if not, add them
-		$sponsor_str = mysql_escape_string($award['sponsor']);
+		$sponsor_str = $award['sponsor'];
-		$sponsorq=mysql_query("SELECT * FROM sponsors WHERE organization='$sponsor_str'");
+		
-		if($sponsorr=mysql_fetch_object($sponsorq)) {
+		$sponsorq=$pdo->prepare("SELECT * FROM sponsors WHERE organization='$sponsor_str'");
+		$sponsorq->execute();
+		if($sponsorr=$sponsorq->fetch(PDO::FETHC_OBJ)) {
 			$sponsor_id=$sponsorr->id;
 		} else {
-			mysql_query("INSERT INTO sponsors (organization,year,notes) 
+			$q = $pdo->prepare("INSERT INTO sponsors (organization,year,notes) 
-				VALUES ('$sponsor_str','$year','".mysql_escape_string("Imported from external source: $r->name")."')");
+				VALUES ('$sponsor_str','$year','"."Imported from external source: $r->name"."')");
-			echo mysql_error();
+			$q->execute();
-			$sponsor_id=mysql_insert_id();
+			echo $q->errroInfo();
+			$sponsor_id=$pdo->lastInsertId();
 		}
 
 
 		$self_nominate = ($award['self_nominate'] == 'yes') ? 'yes' : 'no';
 		$schedule_judges = ($award['schedule_judges'] == 'yes') ? 'yes' : 'no';
-		mysql_query("UPDATE award_awards SET
+		
+		$q = $pdo->prepare("UPDATE award_awards SET
 				sponsors_id='$sponsor_id',
-				name='".mysql_escape_string($award['name_en'])."',
+				name='".$award['name_en']."',
-				criteria='".mysql_escape_string($award['criteria_en'])."',
+				criteria='".$award['criteria_en']."',
-				external_postback='".mysql_escape_string($postback)."',
+				external_postback='".$postback."',
 				external_register_winners='".(($award['external_register_winners']==1)?1:0)."',
 				external_additional_materials='".(($award['external_additional_materials']==1)?1:0)."',
 				self_nominate='$self_nominate',
 				schedule_judges='$schedule_judges'
 			WHERE 
 				id='$award_id' 
-				AND external_identifier='".mysql_escape_string($identifier)."' 
+				AND external_identifier='".$identifier."' 
 				AND year='$year'
 		");
-		echo mysql_error();
+		$q->execute();
+		echo $q->errorInfo();
 
 		//update the prizes
 		$prizes = $award['prizes'];
@@ -172,9 +188,11 @@ case 'check':
 
 		echo i18n("Number of prizes: %1",array(count($prizes)))."<br />";
 		/* Get existing prizes */
-		$pq=mysql_query("SELECT * FROM award_prizes WHERE award_awards_id='$award_id'");
+		
+		$pq = $pdo->prepare("SELECT * FROM award_prizes WHERE award_awards_id='$award_id'");
+		$pq->execute();
 		$existingprizes=array();
-		while($pr=mysql_fetch_assoc($pq)) 
+		while($pr=$pq->fetch(PDO::FETCH_ASSOC)) 
 			$existingprizes[$pr['prize']]=$pr;
 
 
@@ -186,10 +204,12 @@ case 'check':
 				 * but it's much shorter code, and means changing things in only
 				 * one spot */
 				echo "&nbsp;".i18n("Adding prize %1",array($prize['prize_en']))."<br />";
-				$p = mysql_escape_string(stripslashes($prize['prize_en']));
+				$p = stripslashes($prize['prize_en']);
-				mysql_query("INSERT INTO award_prizes (award_awards_id,prize,year,external_identifier)
+				
+				$q = $pdo->prepare("INSERT INTO award_prizes (award_awards_id,prize,year,external_identifier)
 					VALUES ('$award_id','$p','$year','$p')");
-				$prize_id = mysql_insert_id();
+				$q->execute();
+				$prize_id = $pdo->insertLastId();
 			} else {
 				$ep=$existingprizes[$prize['prize_en']];
 				echo "&nbsp;".i18n("Updating prize %1",array($ep['prize']))."<br />";
@@ -200,22 +220,25 @@ case 'check':
 
 			if(!array_key_exists('identifier', $prize)) $prize['identifier'] = $prize['prize_en'];
 
-			mysql_query("UPDATE award_prizes SET 
+			
+			$q = $pdo->prepare("UPDATE award_prizes SET 
 					cash='".intval($prize['cash'])."',
 					scholarship='".intval($prize['scholarship'])."',
 					value='".intval($prize['value'])."',
-					prize='".mysql_escape_string($prize['prize_en'])."',
+					prize='".$prize['prize_en']."',
 					number='".intval($prize['number'])."',
 					`order`='".intval($prize['ord'])."',
-					external_identifier='".mysql_real_escape_string(stripslashes($prize['identifier']))."',
+					external_identifier='".stripslashes($prize['identifier'])."',
 					trophystudentkeeper='".intval($prize['trophystudentkeeper'])."',
 					trophystudentreturn='".intval($prize['trophystudentreturn'])."',
 					trophyschoolkeeper='".intval($prize['trophyschoolkeeper '])."',
 					trophyschoolreturn='".intval($prize['trophyschoolreturn'])."'
 				WHERE
 					id='$prize_id'");
+			
+			$q->execute();
 
-			echo mysql_error();
+			echo $pdo->errorInfo();
 			//FIXME: update the translations
 		}
 
@@ -272,8 +295,10 @@ if(!function_exists('curl_init')) {
 </tr></thead>
 <?
 
-$q=mysql_query("SELECT * FROM fairs WHERE enable_awards='yes' ORDER BY name");
+
-while($r=mysql_fetch_object($q)) {
+$q = $pdo->prepare("SELECT * FROM fairs WHERE enable_awards='yes' ORDER BY name");
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	echo "<tr>";
 	echo "<td>{$r->name}</td>\n";
 	echo "<td>{$r->url}</td>";

admin/award_upload.php

@@ -24,7 +24,7 @@ require_once('../common.inc.php');
 require_once('../user.inc.php');
 require_once('../projects.inc.php');
 require_once('curl.inc.php');
-user_auth_required('admin');
+user_auth_required('committee', 'admin');
 
 //function get_cwsf_award_winners()
 function get_winners($awardid, $fairs_id)
@@ -68,28 +68,34 @@ function get_winners($awardid, $fairs_id)
 	$awards = array();
 	if($awardid == -1) {
 		/* Get all for this fair */
-	 	$q=mysql_query("SELECT * FROM award_awards WHERE award_source_fairs_id='$fairs_id' AND conferences_id='{$conference['id']}'");
+	
-		if(mysql_num_rows($q) == 0) {
+		$q = $pdo->prepare("SELECT * FROM award_awards WHERE award_source_fairs_id='$fairs_id' AND year='{$config['FAIRYEAR']}'");
+		if($q->rowCount() == 0) {
 			error_("Can't find award id $awardid");
 			return false;
 		}
-		while($a = mysql_fetch_assoc($q)) {
+		while($a = $q->fetch(PDO::FETCH_ASSOC)) {
 			$awards[] = $a;
 		}
 	} else {
 		/* Get the award */
-	 	$q=mysql_query("SELECT * FROM award_awards WHERE id='$awardid' AND conferences_id='{$conference['id']}'");
+	 	
-		if(mysql_num_rows($q)!=1) {
+		$q = $pdo->prepare("SELECT * FROM award_awards WHERE id='$awardid' AND year='{$config['FAIRYEAR']}'");
+		$q->execute();
+		if($q->rowCount()!=1) {
 			error_("Can't find award id $awardid");
 			return false;
 		}
-		$award=mysql_fetch_assoc($q);
+		$award=$q->fetch(PDO::FETCH_ASSOC);
 		$awards[] = $award;
 	}
 
 	/* Get the fair for the div/cat mappings */
-	$q = mysql_query("SELECT * FROM fairs WHERE id='{$award['award_source_fairs_id']}'");
+	
-	$fair = mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='{$award['award_source_fairs_id']}'");
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);
+	
 	$catmap = unserialize($fair['catmap']);
 	$divmap = unserialize($fair['divmap']);
 
@@ -98,7 +104,7 @@ function get_winners($awardid, $fairs_id)
 		$winners=array(	'id' => $award['id'],
 				'award_name' => $award['name'],
 				'external_identifier' => $award['external_identifier'],
-				'year' => $config['FAIRYEAR'], // FIXME - this needs to be updated to use conference id's
+				'year' => $config['FAIRYEAR'],
 				'prizes' => array());
 
 		if($fair['type'] != 'sfiab') {
@@ -107,29 +113,37 @@ function get_winners($awardid, $fairs_id)
 		}
 
 		/* Get the prizes */
-		$q=mysql_query("SELECT * FROM award_prizes WHERE award_awards_id='{$award['id']}'");
+	
-		while($prize=mysql_fetch_assoc($q)) {
+		$q = $pdo->prepare("SELECT * FROM award_prizes WHERE award_awards_id='{$award['id']}'");
+		$q->execute();
+		while($prize=$q->fetch(PDO::FETCH_ASSOC)) {
 			$pid = $prize['id'];
-			$wq=mysql_query("SELECT projects.* FROM award_prizes
+		
+			$wq = $pdo->prepare("SELECT projects.* FROM award_prizes
 						LEFT JOIN winners ON winners.awards_prizes_id=award_prizes.id
 						LEFT JOIN projects ON projects.id=winners.projects_id
 					WHERE 
 						awards_prizes_id='$pid' AND 
-						winners.conferences_id='{$conference['id']}'");
+						winners.year='{$config['FAIRYEAR']}'");
-			echo mysql_error();
+			$wq->execute();
+			echo $pdo->erroInfo();
 			/* Get all projects assigned to this prize */
 			$prizewinners = array();
-			while($project=mysql_fetch_assoc($wq)) {
+			while($project=$wq->fetch(PDO::FETCH_ASSOC)) {
 
 				/* Get the students */
-				$sq=mysql_query("SELECT * FROM students WHERE registrations_id='{$project['registrations_id']}'
+			
-							AND conferences_id='{$conference['id']}'");
+				$sq = $pdo->prepare("SELECT * FROM students WHERE registrations_id='{$project['registrations_id']}'
+							AND year='{$config['FAIRYEAR']}'");
+				$sq->execute();
 				$students=array();
-				while($s=mysql_fetch_assoc($sq)) {
+				while($s=$sq->fetch(PDO::FETCH_ASSOC)) {
 
 					/* Get the student's school */
-					$schoolq=mysql_query("SELECT * FROM schools WHERE id='{$s['schools_id']}'");
+					
-					$schoolr=mysql_fetch_assoc($schoolq);
+					$schoolq = $pdo->prepare("SELECT * FROM schools WHERE id='{$s['schools_id']}'");
+					$schoolq->execute();
+					$schoolr=$schoolq->fetch(PDO::FETCH_ASSOC);
 					$school = array("xml_type"=>"school");/* for ysc compatability */
 					foreach($school_fields as $k=>$v) 
 						$school[$k] = $schoolr[$v];
@@ -179,37 +193,45 @@ function count_winners($awardid, $fairs_id)
 	$awards = array();
 	if($awardid == -1) {
 		/* Get all for this fair */
-	 	$q=mysql_query("SELECT * FROM award_awards WHERE award_source_fairs_id='$fairs_id' AND conferences_id='{$conference['id']}'");
+	 	
-		if(mysql_num_rows($q) == 0) {
+		$q = $pdo->prepare("SELECT * FROM award_awards WHERE award_source_fairs_id='$fairs_id' AND year='{$config['FAIRYEAR']}'");
+		$q->execute();
+		if($q->rowCount() == 0) {
 			error_("Can't find award id $awardid");
 			return 0;
 		}
-		while($a = mysql_fetch_assoc($q)) {
+		while($a = $q->fetch(PDO::FETCH_ASSOC)) {
 			$awards[] = $a;
 		}
 	} else {
 		/* Get the award */
-	 	$q=mysql_query("SELECT * FROM award_awards WHERE id='$awardid' AND conferences_id='{$conference['id']}'");
+	 	
-		if(mysql_num_rows($q)!=1) {
+		$q = $pdo->prepare("SELECT * FROM award_awards WHERE id='$awardid' AND year='{$config['FAIRYEAR']}'");
+		$q->execute();
+		if($q->rowcount()!=1) {
 			error_("Can't find award id $awardid");
 			return 0;
 		}
-		$award=mysql_fetch_assoc($q);
+		$award=$q->fetch(PDO::FETCH_ASSOC);
 		$awards[] = $award;
 	}
 
 	foreach($awards as $award) {
 		/* Get the prizes */
-		$q=mysql_query("SELECT * FROM award_prizes WHERE award_awards_id='{$award['id']}'");
+		
-		while($prize=mysql_fetch_assoc($q)) {
+		$q = $pdo->prepare("SELECT * FROM award_prizes WHERE award_awards_id='{$award['id']}'");
+		$q->execute();
+		while($prize=$q->fetch(PDO::FETCH_ASSOC)) {
 			$pid = $prize['id'];
-			$wq=mysql_query("SELECT COUNT(projects.id) as C FROM award_prizes
+		
+			$wq = $pdo->prepare("SELECT COUNT(projects.id) as C FROM award_prizes
 						LEFT JOIN winners ON winners.awards_prizes_id=award_prizes.id
 						LEFT JOIN projects ON projects.id=winners.projects_id
 					WHERE 
 						awards_prizes_id='$pid' AND 
-						winners.conferences_id='{$conference['id']}'");
+						winners.year='{$config['FAIRYEAR']}'");
-			$wc = mysql_fetch_assoc($wq);
+			$wq->execute();
+			$wc = $wq->fetch(PDO::FETCH_ASSOC);
 			$count += $wc['C'];
 		}
 	}
@@ -221,10 +243,12 @@ function count_winners($awardid, $fairs_id)
 function load_server_cats_divs($fairs_id)
 {
 	global $config;
-	$q = mysql_query("SELECT * FROM fairs WHERE id='$fairs_id'");
-	$fair = mysql_fetch_assoc($q);
 
-	$req = array('get_categories' => array('year' => $config['FAIRYEAR']), // FIXME - this needs to be updated to use conference id's
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='$fairs_id'");
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);
+
+	$req = array('get_categories' => array('year' => $config['FAIRYEAR']),
 			'get_divisions' => array('year' => $config['FAIRYEAR'])
 			);
 	$data = curl_query($fair, $req);
@@ -235,8 +259,10 @@ function load_server_cats_divs($fairs_id)
 	} else {
 		$catmap = array();
 		/* Load ours */
-		$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='{$conference['id']}' ORDER BY mingrade");
+	
-		while($r=mysql_fetch_object($q)) {
+		$q = $pdo->prepare("SELECT * FROM projectcategories WHERE year='{$config['FAIRYEAR']}' ORDER BY mingrade");
+		$q->execute();
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			foreach($data['categories'] as $id=>$c) {
 				if($c['mingrade'] == $r->mingrade) {
 					$catmap[$r->id] = $id;
@@ -249,8 +275,10 @@ function load_server_cats_divs($fairs_id)
 		$divmap = unserialize($fair['divmap']);
 	} else {
 		$ret['divmap'] = array();
-		$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conference['id']}' ORDER BY id");
+	
-		while($r=mysql_fetch_object($q)) {
+		$q = $pdo->prepare("SELECT * FROM projectdivisions WHERE year='{$config['FAIRYEAR']}' ORDER BY id");
+		$q->execute();
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			$lowest = 999;
 			$lowest_id = 0;
 			foreach($data['divisions'] as $id=>$d) {
@@ -278,8 +306,10 @@ case 'award_upload':
 	$all_winners = get_winners($award_awards_id, $fairs_id);
 
 	/* Get the fair */
-	$q = mysql_query("SELECT * FROM fairs WHERE id='$fairs_id}'");
+	
-	$fair = mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='$fairs_id}'");
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);;
 
 	echo '<br />';
 	/* Check that we're going to upload something, and override the 
@@ -365,8 +395,11 @@ case 'catdiv_load':
 	list($c, $d, $cm, $dm) = load_server_cats_divs($fairs_id);
 	$divs = projectdivisions_load();
 
-	$q = mysql_query("SELECT * FROM fairs WHERE id='$fairs_id}'");
+	
-	$fair = mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='$fairs_id}'");
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);
+
 
 ?>	<h4><?=i18n("Division Mapping")?></h4>
 	<br />
@@ -407,23 +440,29 @@ case 'catdiv_save':
 		$div[intval($key)] = intval($d);
 	}
 	
-	$catmap = mysql_real_escape_string(serialize($cat));
+	$catmap = serialize($cat);
-	$divmap = mysql_real_escape_string(serialize($div));
+	$divmap = serialize($div);
-	mysql_query("UPDATE fairs SET catmap='$catmap',divmap='$divmap' WHERE id='$fairs_id'");
+
-	echo "UPDATE fairs SET catmap='$catmap',divmap='$divmap' WHERE id='$fairs_id'";
+	$q = $pdo->prepare("UPDATE fairs SET catmap='$catmap',divmap='$divmap' WHERE id='$fairs_id'");
-	echo mysql_error();
+
+	$q->execute();
+	echo $pdo->errorInfo();
 
 	happy_("Category/Division mapping information saved");
 	exit;
 
 case 'additional_materials':
 	$award_awards_id = intval($_GET['award_awards_id']);
-	$q = mysql_query("SELECT award_source_fairs_id,external_identifier FROM award_awards WHERE id='$award_awards_id'");
+	
-	$a = mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT award_source_fairs_id,external_identifier FROM award_awards WHERE id='$award_awards_id'");
-	$q = mysql_query("SELECT * FROM fairs WHERE id='{$a['award_source_fairs_id']}'");
+	$q->execute();
-	$fair = mysql_fetch_assoc($q);
+	$a = $q->fetch(PDO::FETCH_ASSOC);
+	
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='{$a['award_source_fairs_id']}'");
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);
 	$req = array('award_additional_materials' => array(
-				'year'=>$config['FAIRYEAR'], // FIXME - this needs to be updated to use conference id's
+				'year'=>$config['FAIRYEAR'],
 				'identifier'=>$a['external_identifier'])
 			);
 	$data = curl_query($fair, $req, $url);
@@ -439,8 +478,11 @@ case 'load':
 	$winners = get_winners($award_awards_id, $fairs_id);
 	$divs = projectdivisions_load();
 
-	$q = mysql_query("SELECT * FROM fairs WHERE id='$fairs_id}'");
+	
-	$fair = mysql_fetch_assoc($q);
+	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='$fairs_id}'");
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);
+	
 
 	echo i18n("The following list of winning projects/students will be sent to: <b>%1</b>.  Use the 'Edit Default Division Assignments' button to change the default mappings for divisions.  You can over-ride any division assignment by changing it in the list below.  Category assignments are done automatically based on grade.  When you are happy with the list below, click the 'Upload Winners' button.", array($fair['name']));
 
@@ -659,13 +701,15 @@ if(!function_exists('curl_init')) {
 
 
 /* Fairs first */
-$q = mysql_query("SELECT fairs.id, fairs.name, fairs.type, COUNT(award_awards.id) as AWARD_COUNT FROM fairs 
+
+$q = $pdo->prepare("SELECT fairs.id, fairs.name, fairs.type, COUNT(award_awards.id) as AWARD_COUNT FROM fairs 
 			LEFT JOIN award_awards ON award_awards.award_source_fairs_id=fairs.id
 			WHERE award_awards.award_source_fairs_id IS NOT NULL
-				AND award_awards.conferences_id='{$conference['id']}'
+				AND award_awards.year='{$config['FAIRYEAR']}'
 			GROUP BY fairs.id
 			ORDER BY fairs.name ");
-echo mysql_error();
+$q->execute();
+echo $q->errorInfo();
 
 ?>
 <h4><?=i18n('Upload all winners to a source')?>:</h4>
@@ -678,7 +722,7 @@ echo mysql_error();
 </tr></thead>
 <?
 
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$count = count_winners(-1, $r->id);
 ?>
 	<tr><td><?=$r->name?></td>
@@ -700,15 +744,16 @@ while($r=mysql_fetch_object($q)) {
 
 <?
 
-$q = mysql_query("SELECT award_awards.id, award_awards.name AS awardname,
+$q = $pdo->prepare("SELECT award_awards.id, award_awards.name AS awardname,
 			  fairs.name as fairname, award_source_fairs_id, 
 			  fairs.type as fairtype, award_awards.external_additional_materials
 			FROM award_awards 
 			LEFT JOIN fairs ON fairs.id=award_awards.award_source_fairs_id 
 			WHERE award_awards.award_source_fairs_id IS NOT NULL
-				AND award_awards.conferences_id='{$conference['id']}'
+				AND award_awards.year='{$config['FAIRYEAR']}'
 			ORDER BY fairs.name, award_awards.name");
-echo mysql_error();
+$q->execute();
+echo $pdo->errorInfo();
 
 ?>
 <h4><?=i18n('Upload individual winners to a source')?>:</h4>
@@ -721,7 +766,7 @@ echo mysql_error();
 <th><?=i18n("Additional<br />Info")?></th>
 </tr></thead>
 <?
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$count = count_winners($r->id, $r->award_source_fairs_id);
 ?>	
 	<tr><td><?=$r->awardname?></td>

admin/awards.inc.php

@@ -25,25 +25,42 @@
 function award_delete($award_awards_id)
 {
 	/* Delete all winners attached to this award */
-	$q = mysql_query("SELECT id FROM award_prizes WHERE award_awards_id='$award_awards_id'");
+	
-	while(($p = mysql_fetch_assoc($q))) {
+   $q = $pdo->prepare("SELECT id FROM award_prizes WHERE award_awards_id='$award_awards_id'");
-		mysql_query("DELETE FROM winners WHERE award_prizes_id='{$p['id']}'");
+   $q->execute();
+   	while(($p = $q->fetch(PDO::FETCH_ASSOC))) {
+		
+      $q = $pdo->prepare();
+      $q->execute("DELETE FROM winners WHERE award_prizes_id='{$p['id']}'");
 	}
 
 	/* FIXME: maybe delte judging teams and judge 
 	 * assignments and timeslots?
 
 	/* Delete the award */
-	mysql_query("DELETE FROM award_prizes WHERE award_awards_id='$award_awards_id'");
+	
-	mysql_query("DELETE FROM award_awards_projectcategories WHERE award_awards_id='$award_awards_id'");
+   $q = $pdo->prepare("DELETE FROM award_prizes WHERE award_awards_id='$award_awards_id'");
-	mysql_query("DELETE FROM award_awards_projectdivisions WHERE award_awards_id='$award_awards_id'");
+   $q->execute();
-	mysql_query("DELETE FROM award_awards WHERE id='$award_awards_id'");
+	
+   $q = $pdo->prepare("DELETE FROM award_awards_projectcategories WHERE award_awards_id='$award_awards_id'");
+   $q->execute();
+
+   $q = $pdo->prepare("DELETE FROM award_awards_projectdivisions WHERE award_awards_id='$award_awards_id'");
+   $q->execute();
+	
+   $q = $pdo->prepare("DELETE FROM award_awards WHERE id='$award_awards_id'");
+   $q->execute();
 }
 
 function award_prize_delete($award_prizes_id)
 {
-	mysql_query("DELETE FROM winners WHERE award_prizes_id='$award_prizes_id'");
+	
-	mysql_query("DELETE FROM award_prizes WHERE id='$award_prizes_id'");
+   $q = $pdo->prepare("DELETE FROM winners WHERE award_prizes_id='$award_prizes_id'");
+   $q->execute();
+
+   $q = $pdo->prepare("DELETE FROM award_prizes WHERE id='$award_prizes_id'");
+   $q->execute();
+
 }
 
 ?>

admin/awards.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  send_header("Awards", 
  	array('Committee Main' => 'committee_main.php',

admin/cms.php

@@ -23,7 +23,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  //make sure storage folder exists
  if(!file_exists("../data/userfiles"))
@@ -53,15 +53,17 @@
 		$insertdt=date("Y-m-d H:i:s");
 		$text=stripslashes($_POST[$textname]);
 
-		mysql_query("INSERT INTO cms (filename,dt,lang,text,title,showlogo) VALUES (
+		
-			'".mysql_escape_string($filename)."',
+		$q = $pdo->prepare("INSERT INTO cms (filename,dt,lang,text,title,showlogo) VALUES (
+			'".$filename."',
 			'$insertdt',
 			'$lang',
-			'".mysql_escape_string($text)."',
+			'".$text."',
-			'".mysql_escape_string($_POST[$titlename])."',
+			'".$_POST[$titlename]."',
 			'".$_POST[$showlogoname]."'
 			)");
-		if(mysql_error()) {
+		$q->execute();
+		if($pdo->errorInfo()) {
 			echo error(i18n("An error occurred saving %1 in %2",array($filename,$langname)));
 			$err=true;
 		}
@@ -85,14 +87,18 @@
 	foreach($config['languages'] AS $lang=>$langname) {
 		echo "<table class=\"tableview\" width=\"100%\">";
 		echo "<tr><th colspan=\"2\">";
-		$q=mysql_query("SELECT * FROM cms WHERE filename='".mysql_escape_string($_GET['filename'])."' AND lang='$lang' ORDER BY dt DESC LIMIT 1");
+		
-		if($r=mysql_fetch_object($q)) {
+		$q = $pdo->prepare("SELECT * FROM cms WHERE filename='".$_GET['filename']."' AND lang='$lang' ORDER BY dt DESC LIMIT 1");
+		$q->execute();
+		if($r=$q->fetch(PDO::FETCH_OBJ)) {
 			if($r->dt=="0000-00-00 00:00:00" || !$r->dt) $dt="Never";
 			else $dt=$r->dt;
 			echo "<b>".htmlspecialchars($_GET['filename'])." - $langname</b> &nbsp;&nbsp; ".i18n("Last updated").": $dt<br />";
 			if($_GET['dt']) {
-				$q2=mysql_query("SELECT * FROM cms WHERE filename='".mysql_escape_string($_GET['filename'])."' AND lang='$lang' AND dt<='".$_GET['dt']."' ORDER BY dt DESC LIMIT 1");
+				
-				$r2=mysql_fetch_object($q2);
+				$q2 = $pdo->prepare("SELECT * FROM cms WHERE filename='".$_GET['filename']."' AND lang='$lang' AND dt<='".$_GET['dt']."' ORDER BY dt DESC LIMIT 1");
+				$q2->execute();
+				$r2=$q2->fetch(PDO::FETCH_OBJ);
 				if($r2->dt!=$r->dt)
 				{
 					echo "Displaying historical file.  Date: $r->dt";
@@ -136,10 +142,13 @@
 	else $historylimit=30;
 
 	echo "<tr><th>".i18n("File History")."</th></tr>\n";
-	$q=mysql_query("SELECT DISTINCT(dt) FROM cms WHERE filename='".mysql_escape_string($_GET['filename'])."' ORDER BY dt DESC LIMIT $historylimit");
+	
+
+	$q = $pdo->prepare("SELECT DISTINCT(dt) FROM cms WHERE filename='".$_GET['filename']."' ORDER BY dt DESC LIMIT $historylimit");
+	$q->execute();
 	$first=true;
-	if(mysql_num_rows($q)) {
+	if($q->rowCount()) {
-		while($r=mysql_fetch_object($q)) 
+		while($r=$q->fetch(PDO::FETCH_OBJ)) 
 		{
 			if($r->dt==$_GET['dt']) $style="font-weight: bold;"; 
 			else $style="font-weight: normal;";
@@ -177,14 +186,15 @@
 	 echo "<a href=\"cms.php?action=create\">".i18n("or click here to create a new file")."</a><br />\n";
 
 	 echo "<table class=\"summarytable\">";
-
+	$q = $pdo->prepare("SELECT DISTINCT(filename) AS filename FROM cms ORDER BY filename");
-	 $q=mysql_query("SELECT DISTINCT(filename) AS filename FROM cms ORDER BY filename");
+	
 	 echo "<tr><th>".i18n("Filename")."</th><th>".i18n("Last Update")."</th></tr>";
-	 while($r=mysql_fetch_object($q))
+	 while($r=$q->fetch(PDO::FETCH_ASSOC))
 	 {
 		echo "<tr><td><a href=\"cms.php?filename=".rawurlencode($r->filename)."\">/web/$r->filename</a></td>";
-		$q2=mysql_query("SELECT dt FROM cms WHERE filename='".mysql_escape_string($r->filename)."' ORDER BY dt DESC LIMIT 1");
+		$q2 = $pdo->prepare("SELECT dt FROM cms WHERE filename='".$r->filename."' ORDER BY dt DESC LIMIT 1");
-		$r2=mysql_fetch_object($q2);
+	
+		$r2=$q2->fetch(PDO::FETCH_OBJ);
 		if($r2->dt=="0000-00-00 00:00:00") $dt="Never";
 		else $dt=$r2->dt;
 		echo "<td>$dt</td>";

admin/committee_committees.php

@@ -1,56 +0,0 @@
-<?
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
-   Copyright (C) 2005 James Grant <james@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?
- require_once("../common.inc.php");
- require_once("../user.inc.php");
- require_once("../committee.inc.php");
-
- user_auth_required('admin');
-
- require("../tableeditor.class.php");
-/* Now, start the output for this page */
- send_header("Committee Management",
- 		array('Committee Main' => 'committee_main.php',
-			'Administration' => 'admin/index.php' ),
-            "committee_management");
-
-	echo "<a href=\"committees.php\">Manage Committee Members</a><br />";
-
- $_SESSION['last_page'] = 'committee_management';
-
- //make sure storage folder exists
-
- $editor=new TableEditor("committees",
- 			array("name"=>"Committee Name",
-			)
-			);
-
- $editor->setPrimaryKey("id");
- $editor->setDefaultSortField("name");
- $editor->setRecordType("Committee");
- $editor->execute();
-
-send_footer();
-?>
-

admin/committees.php

@@ -26,14 +26,14 @@
  require_once("../user.inc.php");
  require_once("../committee.inc.php");
 
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
-if($_POST['accounts_id'])
+if($_POST['users_uid'])
-	$accounts_id = intval($_POST['accounts_id']);
+	$uid = intval($_POST['users_uid']);
 
 
  /* Now, start the output for this page */
- send_header("Committee Member Management",
+ send_header("Committee Management",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php' ),
             "committee_management");
@@ -46,10 +46,16 @@ if($_POST['accounts_id'])
 <script type="text/javascript">
 <!--
 
+function openeditor(id)
+{
+	window.open("user_editor_window.php?id="+id,"UserEditor","location=no,menubar=no,directories=no,toolbar=no,width=770,height=500,scrollbars=yes"); 
+	return false;
+}
+
 function neweditor()
 {
 	var username = document.forms.addmember.add_member.value;
-	window.open("../user_editor_window.php?type=committee&username="+username,"UserEditor","location=no,menubar=no,directories=no,toolbar=no,width=770,height=500,scrollbars=yes"); 
+	window.open("user_editor_window.php?type=committee&username="+username,"UserEditor","location=no,menubar=no,directories=no,toolbar=no,width=770,height=500,scrollbars=yes"); 
 	document.forms.addmember.add_member.value = "";
 	return false;
 }
@@ -95,7 +101,7 @@ function actionSubmit()
 		alert('You must choose an action');
 		return false;
 	}
-	if(document.forms.memberaction.accounts_id.selectedIndex==0)
+	if(document.forms.memberaction.users_uid.selectedIndex==0)
 	{
 		alert('You must choose a member');
 		return false;
@@ -103,7 +109,7 @@ function actionSubmit()
 
 	if(document.forms.memberaction.action.selectedIndex == 2) {
 		// Edit
-		var id = document.forms.memberaction.accounts_id.options[document.forms.memberaction.accounts_id.selectedIndex];
+		var id = document.forms.memberaction.users_uid.options[document.forms.memberaction.users_uid.selectedIndex];
 		openeditor(id.value);
 //		alert("id="+id.value);
 		return false;
@@ -119,15 +125,28 @@ function actionSubmit()
 </script>
 <?
 
-if($_POST['committees_id']) {
+if($_POST['addcommittee'])
+{
+	//add a new committee
+	//re-order the committees
+	$q = $pdo->prepare("INSERT INTO committees (name) VALUES ('".$_POST['addcommittee']."')");
+	$q->execute();
+	echo happy(i18n("Committee successfully added"));
+}
+
+if($_POST['committees_id'] && $_POST['committees_ord']) {
 	//re-order the committees
 	$x=0;
 	$ids=$_POST['committees_id'];
+	$ords=$_POST['committees_ord'];
 
 	$titles=$_POST['title'];
 	$pords = $_POST['order'];
 	while($ids[$x]) {
 		$cid = intval($ids[$x]);
+
+		$q = $pdo->prepare("UPDATE committees SET ord='".intval($ords[$x])."' WHERE id='$cid'");
+		$q->execute();
 		$x++;
 
 		$ctitle = $titles[$cid];
@@ -138,14 +157,14 @@ if($_POST['committees_id']) {
 		if(!is_array($ctitle)) continue;
 //		print_r($ctitle);
 
-		foreach($ctitle as $accounts_id=>$title) {
+		foreach($ctitle as $uid=>$title) {
-			$o = intval($cord[$accounts_id]);
+			$o = intval($cord[$uid]);
-			$t = mysql_escape_string(stripslashes($title));
+			$t = stripslashes($title);
-			$u = intval($accounts_id);
+			$u = intval($uid);
-			$q = "UPDATE committees_link SET title='$t', ord='$o'
+			
-				WHERE committees_id='$cid' AND accounts_id='$u'";
+			$q = $pdo->prepare("UPDATE committees_link SET title='$t', ord='$o'
-//				echo $q;
+				WHERE committees_id='$cid' AND users_uid='$u'");
-			mysql_query($q);
+			$q->execute();
 		}
 
 	}
@@ -155,12 +174,14 @@ if($_POST['committees_id']) {
 
 if($_POST['action']=="assign")
 {
-	if($_POST['committees_id'] && $_POST['accounts_id']) {
+	if($_POST['committees_id'] && $_POST['users_uid']) {
 		$cid = intval($_POST['committees_id']);
-		$q=mysql_query("SELECT * FROM committees_link WHERE committees_id='$cid' AND accounts_id='$accounts_id'");
+		$q = $pdo->prepare("SELECT * FROM committees_link WHERE committees_id='$cid' AND users_uid='$uid'");
+		$q->execute();
 
-		if(!mysql_num_rows($q)) {
+		if(!$q->rowCount()) {
-			mysql_query("INSERT INTO committees_link (committees_id,accounts_id) VALUES ('$cid','$accounts_id')");
+			$q = $pdo->prepare("INSERT INTO committees_link (committees_id,users_uid) VALUES ('$cid','$uid')");
+			$q->execute();
 			echo happy(i18n("Successfully added member to committee"));
 		}
 		else
@@ -170,9 +191,17 @@ if($_POST['action']=="assign")
 		echo error(("You must choose both a member and a committee"));
 }
 
+if($_GET['deletecommittee']) {
+	$del = intval($_GET['deletecommittee']);
+
+	$q = $pdo->prepare("DELETE FROM committees WHERE id='$del'");
+	$q->execute();
+	echo happy(i18n("Committee removed"));
+}
+
 if($_POST['action']=="remove") {
 	/* user_delete takes care of unlinking the user in other tables */
-	user_delete($accounts_id, 'committee');
+	user_delete($uid, 'committee');
 	echo happy(i18n("Committee member deleted"));
 }
 
@@ -180,12 +209,43 @@ if($_GET['unlinkmember'] && $_GET['unlinkcommittee']) {
 	$mem = intval($_GET['unlinkmember']);
 	$com = intval($_GET['unlinkcommittee']);
 	//unlink the member from the committee
-	mysql_query("DELETE FROM committees_link WHERE accounts_id='$mem' AND committees_id='$com'");
+
+	$q = $pdo->prepare("DELETE FROM committees_link WHERE users_uid='$mem' AND committees_id='$com'");
+	$q->execute();
 	echo happy(i18n("Committee member unlinked from committee"));
 }
 
-	echo '<a href="../user_invite.php?type=committee">Create a new member</a><br/>';
+
-	echo "<a href=\"committee_committees.php\">Manage Committees</a><br />";
+	echo "<table>";
+	echo "<tr><td>";
+
+	echo "<h4>".i18n("Add Committee")."</h4>\n";
+	echo "<form method=\"post\" action=\"committees.php\">\n";
+	echo "<table>\n";
+	echo "<tr><td>".i18n("Committee Name").": </td><td><input type=\"text\" size=\"15\" name=\"addcommittee\" /></td>";
+	echo "    <td><input type=\"submit\" value=\"".i18n("Add")."\" /></td></tr>\n";
+	echo "</table>\n";
+	echo "</form>\n";
+
+	echo "</td><td width=\"40\">&nbsp;</td><td>";
+
+	echo "<h4>".i18n("Add Committee Member")."</h4>\n";
+	echo "<form method=\"post\" name=\"addmember\" action=\"committees.php\" onsubmit=\"return neweditor();\">\n";
+	echo "<table>\n";
+	echo "<tr><td>".i18n("Member Email").": </td><td>";
+	echo "<input type=\"text\" size=\"15\" name=\"add_member\" />\n";
+	echo "</td>\n";
+	echo " <td><input type=\"submit\" onclick=\"return neweditor();\" value=\"".i18n("Add")."\" /></td></tr>\n";
+	echo "</table>\n";
+	echo "<a href=\"committees.php\">".i18n("Reload committee list (needed after adding a new member)")."</a>\n";
+	echo "</form>\n";
+
+	echo "</td></tr>";
+	echo "</table>";
+
+
+	echo "<hr />";
+	echo "<h4>".i18n("Committee Member Management")."</h4>\n";
 	echo "<form name=\"memberaction\" method=\"post\" action=\"committees.php\" onsubmit=\"return actionSubmit()\">\n";
 	echo "<table>";
 	echo "<tr><td>";
@@ -197,19 +257,17 @@ if($_GET['unlinkmember'] && $_GET['unlinkcommittee']) {
 	echo "</select>";
 
 	echo "</td><td>";
-	$query = "
+	$q = $pdo->prepare("SELECT uid,MAX(year),firstname,lastname,email,deleted FROM users WHERE types LIKE '%committee%' GROUP BY uid ORDER BY firstname");
-		SELECT accounts_id, firstname, lastname, email, deleted FROM users WHERE accounts_id IN(
+	$q->execute();
-		SELECT accounts_id FROM user_roles JOIN roles ON user_roles.roles_id = roles.id WHERE roles.type = 'committee'
+	
-		)
+	
-		AND conferences_id = " . $conference['id'];
+	echo "<select name=\"users_uid\">";
-	$q = mysql_query($query);
-	echo "<select name=\"accounts_id\">";
 	echo "<option value=\"\">".i18n("Select a Member")."</option>\n";
-	while($r=mysql_fetch_object($q))
+	while($r=$q->fetch(PDO::FETCH_OBJ))
 	{
-		if($r->deleted == 'yes') continue;
+		if($r->deleted != 'no') continue;
 		$displayname = $r->firstname.' '.$r->lastname;
-		echo "<option value=\"$r->accounts_id\">$displayname ($r->email)</option>\n";
+		echo "<option value=\"$r->uid\">$displayname ($r->email)</option>\n";
 	}
 	echo "</select>";
 
@@ -220,10 +278,11 @@ if($_GET['unlinkmember'] && $_GET['unlinkcommittee']) {
 	//The Assign Div
 	echo "<div id=\"assigndiv\">";
 	echo i18n("To Committee").": ";
-	$q=mysql_query("SELECT * FROM committees ORDER BY ord,name");
+	$q = $pdo->prepare("SELECT * FROM committees ORDER BY ord,name");
+	$q->execute();
 	echo "<select name=\"committees_id\">";
 	echo "<option value=\"\">".i18n("Select a Committee")."</option>\n";
-	while($r=mysql_fetch_object($q))
+	while($r=$q->fetch(PDO::FETCH_OBJ))
 	{
 		echo "<option value=\"$r->id\">$r->name</option>\n";
 	}
@@ -242,60 +301,78 @@ if($_GET['unlinkmember'] && $_GET['unlinkcommittee']) {
 	echo "<hr />";
 
 
-	$q=mysql_query("SELECT * FROM committees ORDER BY ord,name");
+
-	if(mysql_num_rows($q))
+	$q = $pdo->prepare("SELECT * FROM committees ORDER BY ord,name");
+	$q->execute();
+	if($q->rowCout())
 	{
+		echo "<h4>".i18n("Committees")."</h4>";
 		echo "<form method=\"post\" action=\"committees.php\">\n";
 		echo "<table>";
-		echo "<tr><td colspan=\"2\"></td><th colspan=\"2\">".i18n('Title within committee / Sort order')."</th>";
+		echo "<tr><td colspan=\"2\"></td><td><b>".i18n('Title')."</b></td>";
-		echo "</tr>";
+		echo "<td><b>".i18n('Order')."</b></td>";
-		while($r=mysql_fetch_object($q)) {
+		echo "<td><b>".i18n("Public Email / Private Email")."</b></td></tr>";
+		while($r=$q->fetch(PDO::FETCH_OBJ))
+		{
 			echo "<tr>";
-			echo "<td colspan=\"4\">";
+			echo "<td colspan=\"3\">";
 			echo "<input type=\"hidden\" name=\"committees_id[]\" value=\"$r->id\" />";
-//			echo "<input size=\"1\" type=\"text\" name=\"committees_ord[]\" value=\"$r->ord\" />";
+			echo "<input size=\"1\" type=\"text\" name=\"committees_ord[]\" value=\"$r->ord\" />";
-			echo "<b>".i18n($r->name)."</b>";
+			echo "&nbsp; <b>".i18n($r->name)."</b>";
 
 
-			$q2=mysql_query("SELECT 
+			
+			$q2 = $pdo->prepare("SELECT 
 								committees_link.title,
 								committees_link.ord,
-								committees_link.accounts_id
+								users.uid,
+								MAX(users.year) AS my,
+								users.lastname
 								FROM committees_link 
+								JOIN users ON users.uid = committees_link.users_uid 
 								WHERE committees_id='{$r->id}' 
-								ORDER BY ord");
+								GROUP BY users.uid 
+								ORDER BY ord,
+								users.lastname ");
+			$q2->execute();
+
+			if($q2->rowCount()==0) {
+				echo "&nbsp; &nbsp;";
+				echo "<a title=\"Remove Committee\" onclick=\"return confirmClick('Are you sure you want to remove this committee?');\" href=\"committees.php?deletecommittee=$r->id\"><img src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\" border=\"0\" alt=\"Remove Committee\" /></a>";
+			}
 
 			echo "</td></tr>\n";
-			echo mysql_error();
+			echo $pdo->errorInfo();
-			while($r2=mysql_fetch_object($q2)) {
+			while($r2=$q2->fetch(PDO::FETCH_OBJ)) {
-				$u = user_load_by_accounts_id($r2->accounts_id);
+				$u = user_load_by_uid($r2->uid);
-
-				//if rollover is proper, this shouldnt be necessary, but, the simcoe rollover didnt do this, so lets do it here as a safety
-				if(!$u) {
-					$roleq=mysql_query("SELECT * FROM roles WHERE type='committee'");
-					$roler=mysql_fetch_object($roleq);
-					//hmm thats okay,w e must have missed something in the rollover... sicne its tied to the accounts_id, we just need to add a record
-					account_add_role($r2->accounts_id,$roler->id,$conference['id']);
-
-					//and now we should be able to load them
-					$u = user_load_by_accounts_id($r2->accounts_id);
-				}
-
-
 				echo "<tr><td align=\"right\">&nbsp;&nbsp;&nbsp;&nbsp;";
 				echo "<a title=\"Edit Member\" href=\"#\" onclick=\"openeditor({$u['id']})\"><img src=\"{$config['SFIABDIRECTORY']}/images/16/edit.{$config['icon_extension']}\" border=\"0\" alt=\"Edit\" /></a>";
 				echo "&nbsp;";
-				echo "<a title=\"Unlink Member from Committee\" onclick=\"return confirmClick('Are you sure you want to unlink this member from this committee?');\" href=\"committees.php?unlinkmember={$u['accounts_id']}&amp;unlinkcommittee={$r->id}\"><img src=\"{$config['SFIABDIRECTORY']}/images/16/undo.{$config['icon_extension']}\" border=\"0\" alt=\"Unlink\" /></a>";
+				echo "<a title=\"Unlink Member from Committee\" onclick=\"return confirmClick('Are you sure you want to unlink this member from this committee?');\" href=\"committees.php?unlinkmember={$u['uid']}&amp;unlinkcommittee={$r->id}\"><img src=\"{$config['SFIABDIRECTORY']}/images/16/undo.{$config['icon_extension']}\" border=\"0\" alt=\"Unlink\" /></a>";
 				echo "</td>";
 				echo "<td valign=\"top\">";
-				echo "<b>{$u['firstname']} {$u['lastname']}</b>";
+				echo "<b>{$u['name']}</b>";
 				echo "</td><td>";
-				echo "<input type=\"text\" value=\"{$r2->title}\" name=\"title[{$r->id}][{$u['accounts_id']}]\" size=\"25\">";
+				echo "<input type=\"text\" value=\"{$r2->title}\" name=\"title[{$r->id}][{$u['uid']}]\" size=\"15\">";
 				echo "</td><td>";
-				echo "<input type=\"text\" value=\"{$r2->ord}\" name=\"order[{$r->id}][{$u['accounts_id']}]\" size=\"2\">";
+				echo "<input type=\"text\" value=\"{$r2->ord}\" name=\"order[{$r->id}][{$u['uid']}]\" size=\"2\">";
+
+				echo "</td><td>";
+
+				if($u['email']) {
+					list($b,$a)=split("@",$u['email']);
+					echo "<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>";
+				}
+
+				if($u['emailprivate']) {
+					if($u['email']) echo " <b>/</b> ";
+					list($b,$a)=split("@",$u['emailprivate']);
+					echo "<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>";
+				}
+
 				echo "</td></tr>\n";
 			}
-			echo "<tr><td colspan=\"4\">&nbsp;</td></tr>\n";
+			echo "<tr><td colspan=\"2\">&nbsp;</td></tr>\n";
 		}
 		echo "<tr><td colspan=\"2\"><input type=\"submit\" value=\"".i18n("Save Committee Orders and Titles")."\" /></td></tr>\n";
 		echo "</table>";

admin/communication.inc.php

@@ -1,154 +1,170 @@
 <?
-	$mailqueries=array(
+// This file was modified Jan of 2014 by Richard Sin
-		"myself"=>array("name"=>"Yourself (for testing)","query"=>"SELECT users.id FROM users WHERE users.id='{$_SESSION['users_id']}'"),
+// A glitch that grabs old emails has been resolved.
 
+	$mailqueries=array(
 		"committee_all"=>array("name"=>"Committee members (all)","query"=>
-			"SELECT users.id FROM users
+			"SELECT u.firstname, u.lastname, u.organization, u.email, u.deleted, q.year FROM users AS u INNER JOIN (SELECT uid, max(year) AS year FROM users GROUP BY uid) AS q ON u.uid = q.uid AND u.year = q.year WHERE u.types LIKE '%committee%' AND u.deleted='no' GROUP BY `u`.`id` ASC"),
-			JOIN accounts ON users.accounts_id=accounts.id
-			JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type = 'committee' AND accounts.deleted = 'no' "),
 
 		/* The WHERE clause evaluates which rows to add to the GROUP
 		BY, the HAVING clase evaluates which grouped rows show up.  We
 		want to to evaluate 'deleted' AFTER the grouping, so we catch
-		the case where the MAX(conferences_id) has deleted='yes'.  If we use WHERE
+		the case where the MAX(year) has deleted='yes'.  If we use WHERE
 		deleted='no', we'll only add non-deleted rows to the group, and
 		end up picking up a user active in, say 2007 and 2008, but
 		deleted in 2009. */
-		"judges_all"=>array("name"=>"Judges from all conferences (except deleted judges)","query"=>
+		"judges_all"=>array("name"=>"Judges from all years (except deleted judges)","query"=>
-			"SELECT firstname, lastname, email, deleted, MAX(conferences_id) FROM users 
+			"SELECT u.firstname, u.lastname, u.email, u.deleted, q.year FROM users AS u INNER JOIN (SELECT uid, max(year) AS year FROM users GROUP BY uid ) AS q ON u.uid = q.uid AND u.year = q.year WHERE u.types LIKE '%judge%' AND u.deleted='no' ORDER BY `u`.`email` ASC"),
-			JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type ='judge' GROUP BY users.accounts_id HAVING deleted='no' ORDER BY email"),
 
-		"judges_active_thisconference"=>array("name"=>"Judges active for this conference", "query"=>
+		"judges_active_lastyear"=>array("name"=>"Judges (all) active from last year", "query"=>
-			"SELECT users.id FROM users
+			"SELECT firstname, lastname, email FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id WHERE types LIKE '%judge%' AND year='".($config['FAIRYEAR']-1)."' AND deleted='no' AND users_judge.judge_active='yes' ORDER BY email"),
-			LEFT JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type='judge' AND conferences_id={$conference['id']} AND deleted='no' AND user_roles.active='yes' ORDER BY email"),
 
-		"judges_inactive_thisconference"=>array("name"=>"Judges in the conference that are not active", "query"=>
+		"judges_active_thisyear"=>array("name"=>"Judges (all) active for this year", "query"=>
-			"SELECT users.id FROM users
+			"SELECT firstname, lastname, email FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id WHERE types LIKE '%judge%' AND year='{$config['FAIRYEAR']}' AND deleted='no' AND users_judge.judge_active='yes' ORDER BY email"),
-			LEFT JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type='judge' AND conferences_id={$conference['id']} AND deleted='no' AND user_roles.active='no' ORDER BY email"),
 
-		"judges_inactive_allconferences"=>array("name"=>"Judges inactive for any conference", "query"=>
+		"judges_div_active_thisyear"=>array("name"=>"Judges (regular judges only) active for this year", "query"=>
-			"SELECT users.id FROM users
+			"SELECT firstname, lastname, email FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id WHERE types LIKE '%judge%' AND year='{$config['FAIRYEAR']}' AND deleted='no' AND users_judge.judge_active='yes' AND (users_judge.special_award_only='no' OR users_judge.special_award_only='' OR users_judge.special_award_only IS NULL) ORDER BY email"),
-			LEFT JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type='judge' AND deleted='no' AND user_roles.active='no' ORDER BY email"),
 
-		"judges_active_complete_thisconference"=>array("name"=>"Judges active for this conference and complete", "query"=>
+		"judges_spec_active_thisyear"=>array("name"=>"Judges (special award judges only) active for this year", "query"=>
-			"SELECT users.id FROM users
+			"SELECT firstname, lastname, email FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id WHERE types LIKE '%judge%' AND year='{$config['FAIRYEAR']}' AND deleted='no' AND users_judge.judge_active='yes' AND users_judge.special_award_only='yes' ORDER BY email"),
-			LEFT JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.id
-			WHERE roles.type = 'judge' AND conferences_id = {$conference['id']}
-			AND user_roles.complete='yes'
-			AND deleted='no'
-			AND user_roles.active='yes'
-			ORDER BY email"),
 
-		"judges_active_incomplete_thisconference"=>array("name"=>"Judges active for this conference but not complete", "query"=>
+		"judges_inactive"=>array("name"=>"Judges (all) not active for this year", "query"=>
-			"SELECT users.id FROM users
+			"SELECT firstname, lastname, email, judge_active, deleted, MAX(year) 
-			LEFT JOIN user_roles ON user_roles.users_id = users.id
+				FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id 
-			JOIN roles ON roles.id = user_roles.id
+				WHERE types LIKE '%judge%'
-			WHERE roles.type = 'judge' AND conferences_id = {$conference['id']}
+				GROUP BY uid HAVING  deleted='no' AND ((max(year)='{$config['FAIRYEAR']}' AND judge_active='no') OR max(year)<'{$config['FAIRYEAR']}')
-			AND user_roles.complete='no'
+				ORDER BY email"),
-			AND deleted='no'
-			AND user_roles.active='yes'
-			ORDER BY email"),
 
-		"participants_all_thisconference"=>array("name"=>"Participants (all) for this conference","query"=>
+		"judges_active_complete_thisyear"=>array("name"=>"Judges (all) active for this year and complete", "query"=>
-			"SELECT users.id
+			"SELECT firstname, lastname, email FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id WHERE types LIKE '%judge%' AND year='{$config['FAIRYEAR']}' AND users_judge.judge_complete='yes' AND deleted='no' AND users_judge.judge_active='yes' ORDER BY email"),
-			 FROM users
-			 JOIN user_roles ON user_roles.users_id=users.id
-			 JOIN roles ON user_roles.roles_id=roles.id
-			 WHERE users.conferences_id='{$conference['id']}'
-			 AND roles.type='participant'"),
 
-		"participants_complete_thisconference"=>array("name"=>"Participants complete/paymentpending for this conference","query"=>
+		"judges_active_incomplete_thisyear"=>array("name"=>"Judges (all) active for this year but not complete", "query"=>
-			"SELECT users.id FROM users
+			"SELECT firstname, lastname, email FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id WHERE types LIKE '%judge%' AND year='{$config['FAIRYEAR']}' AND (users_judge.judge_complete!='yes' OR users_judge.judge_complete IS NULL) AND deleted='no' AND users_judge.judge_active='yes' ORDER BY email"),
-			JOIN registrations ON users.registrations_id=registrations.id
-			JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type = 'participant'
-			AND registrations.conferences_id='".$conference['id']."' 
-			AND ( registrations.status='complete' OR registrations.status='paymentpending')"),
 
-		"participants_complete_paymentpending_thisconference"=>array("name"=>"Participants payment pending for this conference","query"=>
+		"participants_complete_thisyear"=>array("name"=>"Participants complete this year","query"=>
-			"SELECT users.id FROM users
+			"SELECT firstname, lastname, students.email FROM students,registrations WHERE students.registrations_id=registrations.id AND registrations.year='".$config['FAIRYEAR']."' AND ( registrations.status='complete' OR registrations.status='paymentpending') ORDER BY students.email"),
-			JOIN registrations ON users.registrations_id=registrations.id
-			JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type = 'participant'
-			AND registrations.conferences_id='".$conference['id']."' 
-			AND registrations.status='paymentpending'"),
 
-		"participants_notcomplete_thisconference"=>array("name"=>"Participants not complete for this conference","query"=>
+		"participants_complete_paymentpending_thisyear"=>array("name"=>"Participants complete this year but payment pending","query"=>
-			"SELECT users.id
+			"SELECT firstname, lastname, students.email FROM students,registrations WHERE students.registrations_id=registrations.id AND registrations.year='".$config['FAIRYEAR']."' AND registrations.status!='complete' AND registrations.status='paymentpending' ORDER BY students.email"),
-			 FROM users
-			 JOIN user_roles ON user_roles.users_id=users.id
-			 JOIN roles ON user_roles.roles_id=roles.id
-			 LEFT JOIN registrations ON users.registrations_id=registrations.id
-			 WHERE users.conferences_id='{$conference['id']}'
-			 AND roles.type='participant'
-			 AND (registrations.status IS NULL OR registrations.status='open' OR registrations.status='new')"),
 
+		"participants_notcomplete_thisyear"=>array("name"=>"Participants not complete this year","query"=>
+			"SELECT firstname, lastname, students.email FROM students,registrations WHERE students.registrations_id=registrations.id AND registrations.year='".$config['FAIRYEAR']."' AND registrations.status!='complete' AND registrations.status!='new' ORDER BY students.email"),
 
-/*  // FIXME - not sure if this has a sensible equivalent when dealing with "conferences" rather than fair years
 		"participants_complete_lastyear"=>array("name"=>"Participants complete last year","query"=>
 			"SELECT firstname, lastname, students.email FROM students,registrations WHERE students.registrations_id=registrations.id AND registrations.year='".($config['FAIRYEAR']-1)."' AND ( registrations.status='complete' OR registrations.status='paymentpending') ORDER BY students.email"),
-		"participants_complete_allconferences"=>array("name"=>"Participants complete for all conferences","query"=>
 
-			"SELECT users.id, users.firstname, users.lastname, accounts.email FROM users 
+		"participants_complete_allyears"=>array("name"=>"Participants complete all years","query"=>
-			JOIN accounts on users.accounts_id=accounts.id
+			"SELECT DISTINCT firstname, lastname, students.email FROM students,registrations WHERE students.registrations_id=registrations.id AND ( registrations.status='complete' OR registrations.status='paymentpending') ORDER BY students.email"),
-			JOIN registrations ON users.registrations_id=registrations.id
-			JOIN user_roles ON user_roles.users_id = users.id
-			JOIN roles ON roles.id = user_roles.roles_id
-			WHERE roles.type = 'participant'
-			AND (registrations.status='complete' OR registrations.status='paymentpending') ORDER BY accounts.email"),
 
-*/
+		"participants_cwsf_thisyear"=>array("name"=>"CWSF Winners for this year","query"=>"
-		"participants_cwsf_thisconference"=>array("name"=>"CWSF Winners for this conference","query"=>"
+		SELECT DISTINCT students.firstname, students.lastname, students.email 
-		SELECT users.id
 			FROM award_awards
 			JOIN award_prizes ON award_prizes.award_awards_id=award_awards.id
 			JOIN winners ON winners.awards_prizes_id=award_prizes.id
 			JOIN projects ON winners.projects_id=projects.id
 			JOIN registrations ON projects.registrations_id=registrations.id
-			JOIN users ON users.registrations_id=registrations.id
+			JOIN students ON students.registrations_id=registrations.id
-			WHERE award_awards.cwsfaward='1' 
+			WHERE award_awards.cwsfaward='1' AND winners.year='".$config['FAIRYEAR']."'
-			AND winners.conferences_id='".$conference['id']."' "),
+			ORDER BY students.email"),
+
+		"participants_cwsf_lastyear"=>array("name"=>"CWSF Winners from last year","query"=>"
+		SELECT DISTINCT students.firstname, students.lastname, students.email 
+			FROM award_awards
+			JOIN award_prizes ON award_prizes.award_awards_id=award_awards.id
+			JOIN winners ON winners.awards_prizes_id=award_prizes.id
+			JOIN projects ON winners.projects_id=projects.id
+			JOIN registrations ON projects.registrations_id=registrations.id
+			JOIN students ON students.registrations_id=registrations.id
+			WHERE award_awards.cwsfaward='1' AND winners.year='".($config['FAIRYEAR']-1)."'
+			ORDER BY students.email"),
+
+		"participants_cwsf_allyears"=>array("name"=>"CWSF Winners from all years","query"=>"
+		SELECT DISTINCT students.firstname, students.lastname, students.email 
+			FROM award_awards
+			JOIN award_prizes ON award_prizes.award_awards_id=award_awards.id
+			JOIN winners ON winners.awards_prizes_id=award_prizes.id
+			JOIN projects ON winners.projects_id=projects.id
+			JOIN registrations ON projects.registrations_id=registrations.id
+			JOIN students ON students.registrations_id=registrations.id
+			WHERE award_awards.cwsfaward='1'
+			ORDER BY students.email"),
 
 		"sponsors"=>array("name"=>"Organization sponsors","query"=>
 			"SELECT id, organization, email FROM sponsors WHERE email!='' ORDER BY email"),
 
 		"sponsors_primarycontacts"=>array("name"=>"Organization sponsors (primary contacts)","query"=>
-			"SELECT users.id, conferences_id, organization, firstname, lastname, email, `primary` 
+			"SELECT uid, MAX(users.year) AS year, sponsors.organization, users.firstname, users.lastname, users.email, deleted, users_sponsor.primary 
-                FROM users
+                FROM sponsors, 
-		JOIN user_roles on users.id = user_roles.id
+                        users_sponsor, 
-		JOIN roles ON user_roles.roles_id = roles.id
+                        users 
                 WHERE 
-                    roles.type = 'sponsor'
+                    users.id=users_sponsor.users_id
-                    AND email != ''
+                    AND users_sponsor.sponsors_id=sponsors.id
-                    AND deleted='no'
+                    AND users.types LIKE '%sponsor%'
-		    AND `primary`='yes'
+                    AND users.email!=''
-                ORDER BY email
+                GROUP BY uid 
+                HAVING deleted='no' AND users_sponsor.primary='yes'
+                ORDER BY users.email
                 "),
+
 		"sponsors_allcontacts"=>array("name"=>"Organization sponsors (all contacts)","query"=>
-		"SELECT DISTINCT(users.email), sponsors.organization, users.firstname, users.lastname, users.email
+			"SELECT DISTINCT(users.email), sponsors.organization, users.firstname, users.lastname, users.email 
-		FROM sponsors
+                FROM sponsors, 
-		JOIN users_sponsor ON users_sponsor.sponsors_id = sponsors.id
+                        users_sponsor, 
-		JOIN users ON users.id = users_sponsor.users_id
+                        users 
-		JOIN user_roles ON user_roles.users_id = users.id
+                WHERE 
-		JOIN roles ON roles.id = user_roles.roles_id
+                    users.id=users_sponsor.users_id
-		WHERE
+                    AND users_sponsor.sponsors_id=sponsors.id
-		roles.type = 'sponsor'
+                    AND users.types LIKE '%sponsor%'
-		AND users.deleted='no'
+                    AND users.deleted='no'
-		AND users.email!=''
+                    AND users.email!=''
-		ORDER BY users.email"),
+                ORDER BY users.email
+                "),
+
+		"sponsors_specialawards"=>array("name"=>"Organization sponsors for Special Awards","query"=>
+			"SELECT DISTINCT sponsors.id, organization, email 
+			FROM sponsors 
+			JOIN award_awards ON sponsors.id=award_awards.sponsors_id
+			WHERE 
+				email!='' 
+				AND award_awards.award_types_id=2
+			ORDER BY email"),
+
+
+		"sponsors_primarycontacts_specialawards"=>array("name"=>"Organization sponsors for Special Awards (primary contacts)","query"=>
+			"SELECT DISTINCT uid, MAX(users.year) AS year, sponsors.organization, users.firstname, users.lastname, users.email, deleted, users_sponsor.primary 
+                FROM sponsors, 
+                        users_sponsor, 
+                        users,
+						award_awards 
+                WHERE 
+                    users.id=users_sponsor.users_id
+                    AND users_sponsor.sponsors_id=sponsors.id
+                    AND users.types LIKE '%sponsor%'
+                    AND users.email!=''
+					AND sponsors.id=award_awards.sponsors_id
+					AND award_awards.award_types_id=2
+                GROUP BY uid 
+                HAVING deleted='no' AND users_sponsor.primary='yes'
+                ORDER BY users.email
+                "),
+
+		"sponsors_allcontacts_specialawards"=>array("name"=>"Organization sponsors for Special Awards (all contacts)","query"=>
+			"SELECT DISTINCT(users.email), sponsors.organization, users.firstname, users.lastname, users.email 
+                FROM sponsors, 
+                        users_sponsor, 
+                        users,
+						award_awards 
+                WHERE 
+                    users.id=users_sponsor.users_id
+                    AND users_sponsor.sponsors_id=sponsors.id
+                    AND users.types LIKE '%sponsor%'
+                    AND users.deleted='no'
+                    AND users.email!=''
+					AND sponsors.id=award_awards.sponsors_id
+					AND award_awards.award_types_id=2
+                ORDER BY users.email
+                "),
 
 /*
 		"special_award_sponsors_unconfirmed"=>array("name"=>"Special award sponsors (unconfirmed only)","query"=>
@@ -158,87 +174,35 @@
 			"SELECT DISTINCT(award_sponsors.id), organization, firstname, lastname, award_contacts.email FROM award_sponsors, award_awards, award_contacts WHERE award_awards.sponsors_id=award_sponsors.id AND award_contacts.award_sponsors_id=award_sponsors.id AND award_awards.award_types_id='2' AND award_contacts.year='".$config['FAIRYEAR']."'"),
 
 */
-		"school_principals"=>array("name"=>"School principals this conference","query"=>
+		"school_principals"=>array("name"=>"School principals","query"=>
-			"SELECT principal_uid AS id FROM schools
+			"SELECT schools.principal_uid AS uid, schools.school, users.firstname AS firstname, users.lastname AS lastname, users.email AS email FROM schools 
-			WHERE schools.conferences_id='".$conference['id']."'
+			JOIN users ON schools.principal_uid=users.uid AND users.id=(SELECT id FROM users WHERE users.uid=schools.principal_uid ORDER BY `year` DESC LIMIT 1)
-			AND principal_uid>0
+				WHERE schools.year='".$config['FAIRYEAR']."' AND users.email!=''"),
-			 "),
 
-		"school_scienceheads"=>array("name"=>"School science heads this conference","query"=>
+		"school_scienceheads"=>array("name"=>"School science heads","query"=>
-			"SELECT sciencehead_uid AS id FROM schools
+			"SELECT schools.sciencehead_uid AS uid, schools.school, users.firstname AS firstname, users.lastname AS lastname, users.email AS email FROM schools 
-			WHERE schools.conferences_id='".$conference['id']."'
+			JOIN users ON schools.sciencehead_uid=users.uid AND users.id=(SELECT id FROM users WHERE users.uid=schools.sciencehead_uid ORDER BY `year` DESC LIMIT 1)
-			AND sciencehead_uid>0
+				WHERE schools.year='".$config['FAIRYEAR']."' AND users.email!=''"),
-			"),
+                "school_with_project_thisyear"=>array("name"=>"Schools with projects this year","query"=>
+                        "SELECT  DISTINCT(sc.schoolemail) AS email, sc.school AS firstname FROM students AS st LEFT JOIN schools AS sc ON sc.id = st.schools_id WHERE st.year = ".$config['FAIRYEAR']." AND LENGTH( sc.schoolemail ) !=0 ORDER BY email
+"),
 
-		"teachers_with_school"=>array("name"=>"Teachers with a school in this conference","query"=>
+		"school_thisyear"=>array("name"=>"Schools this year","query"=>
-			"SELECT users.id
+			"SELECT school AS firstname, schoolemail AS email FROM `schools` WHERE `year` ='".$config['FAIRYEAR']."' GROUP BY schoolemail"),
-			FROM users
+		"school_teachers_thisyear"=>array("name"=>"Teachers (as entered by students) this year","query"=>
-			JOIN schools ON users.schools_id=schools.id
+			"SELECT teachername AS firstname, teacheremail AS email FROM students WHERE year = '".$config['FAIRYEAR']."' GROUP BY teacheremail"),
-			JOIN user_roles ON users.id=user_roles.users_id
-			JOIN roles ON user_roles.roles_id=roles.id
-			WHERE schools.conferences_id='".$conference['id']."'
-			AND roles.type='teacher'
-			"),
 
-		"teachers_without_school"=>array("name"=>"Teachers without a school in this conference","query"=>
-			"SELECT users.id
-			FROM users
-			JOIN user_roles ON users.id=user_roles.users_id
-			JOIN roles ON user_roles.roles_id=roles.id
-			WHERE roles.type='teacher'
-			AND users.conferences_id='".$conference['id']."'
-			AND (users.schools_id='' OR users.schools_id=0)
-			"),
-
-/*
-		"school_teachers_thisconference"=>array("name"=>"Teachers (as entered by students) for this conference","query"=>
-			"SELECT DISTINCT(teacheremail) AS email, teachername AS firstname FROM students WHERE conferences_id='".$conference['id']."' AND teacheremail!=''"),
-			*/
-/* // FIXME again, not sure that this has a sensible equivalent with conferences
 		"school_teachers_lastyear"=>array("name"=>"Teachers (as entered by students) last year","query"=>
-			"SELECT DISTINCT(teacheremail) AS email, teachername AS firstname FROM students WHERE year='".($config['FAIRYEAR']-1)."' AND teacheremail!=''"),
+			"SELECT teachername AS firstname, teacheremail AS email FROM students WHERE year = '".($config['FAIRYEAR']-1)."' GROUP BY teacheremail"),
-*/
+
-/*
+		"school_teachers_allyears"=>array("name"=>"Teachers (as entered by students) all years","query"=>
-		"school_teachers_allconferences"=>array("name"=>"Teachers (as entered by students) all conferences","query"=>
+			"SELECT teachername AS firstname, teacheremail AS email FROM students GROUP BY teacheremail"),
-			"SELECT DISTINCT(teacheremail) AS email, teachername AS firstname FROM students WHERE teacheremail!=''"),
-			*/
 /* Volunteers */
-		"volunteers_active_complete_thisconference"=>array("name"=>"Volunteers active for this conference and complete", "query"=>
+		"volunteers_active_complete_thisyear"=>array("name"=>"Volunteers active for this year and complete", "query"=>
-			"SELECT users.id, firstname, lastname, email
+			"SELECT id, firstname, lastname, email FROM users LEFT JOIN users_volunteer ON users_volunteer.users_id=users.id WHERE users.year='{$config['FAIRYEAR']}' AND users_volunteer.volunteer_complete='yes' AND users_volunteer.volunteer_active='yes' AND users.deleted='no' AND types LIKE '%volunteer%' ORDER BY email"),
-			FROM users LEFT JOIN user_roles ON user_roles.users_id = users.id JOIN roles ON roles.id = user_roles.roles_id
-			WHERE users.conferences_id = '".$conference['id']."'
-			AND roles.type='volunteer'
-			AND user_roles.complete='yes'
-			AND user_roles.active='yes'
-			AND users.deleted='no'
-			ORDER BY email"),
 
-		"volunteers_active_incomplete_thisconference"=>array("name"=>"Volunteers active for this conference but not complete", "query"=>
+		"volunteers_active_incomplete_thisyear"=>array("name"=>"Volunteers active for this year but not complete", "query"=>
-			"SELECT users.id, firstname, lastname, email
+			"SELECT id, firstname, lastname, email FROM users LEFT JOIN users_volunteer ON users_volunteer.users_id=users.id WHERE users.year='{$config['FAIRYEAR']}' AND users_volunteer.volunteer_complete='no' AND users_volunteer.volunteer_active='yes' AND users.deleted='no' AND users.types LIKE '%volunteer%' ORDER BY email"),
-			FROM users LEFT JOIN user_roles ON user_roles.users_id = users.id JOIN roles ON roles.id = user_roles.roles_id
-			WHERE users.conferences_id = '".$conference['id']."'
-			AND roles.type='volunteer'
-			AND user_roles.complete='no'
-			AND user_roles.active='yes'
-			AND users.deleted='no'
-			ORDER BY email"),
 
-		"accounts_email_unconfirmed" => array("name" => "Users active in any active conference with unconfirmed e-mail addresses", "query" =>
-			"SELECT users.id
-			FROM users
-			JOIN accounts ON users.accounts_id = accounts.id
-			JOIN conferences ON users.conferences_id = conferences.id
-			WHERE conferences.status = 'running'
-			AND accounts.pendingemail IS NOT NULL
-			AND accounts.pendingemail != ''
-			"),
-
-		"accounts_email_unconfirmed_thisconference" => array("name" => "Users active for this conference with unconfirmed e-mail addresses", "query" =>
-			"SELECT users.id
-			FROM users JOIN accounts ON users.accounts_id = accounts.id
-			WHERE users.conferences_id = {$conference['id']}
-			AND accounts.pendingemail IS NOT NULL
-			AND accounts.pendingemail != ''
-			"),
 		);
 ?>

admin/communication.php

@@ -24,7 +24,9 @@
 <?
  require_once("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ include "communication.inc.php";
+
+ user_auth_required('committee', 'admin');
 
  function launchQueue() {
 	 if(!file_exists("../data/logs")) {
@@ -40,8 +42,9 @@
 switch($_GET['action']) {
 case 'dialog_choose_load':
 	$emails_id = intval($_GET['emails_id']);
-	$q = mysql_query("SELECT * FROM emails WHERE id='$emails_id'");
+	$q = $pdo->prepare("SELECT * FROM emails WHERE id='$emails_id'");
-	$e = mysql_fetch_assoc($q);
+	$q->execute();
+	$e = $q->fetch(PDO::FETCH_ASSOC);
 	?>
 	<table class="editor">
 	<tr><td class="label" style="width:15%"><?=i18n('Name')?>:</td><td class="input"><?=$e['name']?></td></tr>
@@ -62,9 +65,10 @@ case 'dialog_choose':
 	<select id="comm_dialog_choose_emails_id">
 		<option value="-1">-- <?=i18n('Choose a Communication')?> --</option>
 	<?
-	$type = mysql_real_escape_string($_GET['type']);
+	$type = $_GET['type'];
-	$q = mysql_query("SELECT * FROM emails WHERE type='$type'");
+	$q = $pdo->prepare("SELECT * FROM emails WHERE type='$type'");
-	while($e = mysql_fetch_assoc($q)) {
+	$q->execute();
+	while($e = $q->fetch(PDO::FETCH_ASSOC)) {
 		echo "<option value=\"{$e['id']}\">{$e['name']}</option>";
 	}
 	?>
@@ -136,22 +140,39 @@ case 'dialog_choose':
 case 'email_save':
 	$id = intval($_POST['emails_id']);
 
-	// escape all strings for the db query
+	//we need to character encode BEFORE we myql_real_escape_strintg
-	$name = mysql_real_escape_string($_POST['name']);
+	//otherwise, a smartquote ' will turn into a normal ' that ends up
-	$description = mysql_real_escape_string($_POST['description']);
+	//not being escaped!
-	$from = mysql_real_escape_string($_POST['from']);
+	$name=$_POST['name'];
-	$subject = mysql_real_escape_string($_POST['subject']);
+	$description=$_POST['description'];
-	$bodyhtml = mysql_real_escape_string($_POST['bodyhtml']);
+	$from=$_POST['from'];
+	$subject=$_POST['subject'];
+	$bodyhtml=$_POST['bodyhtml'];
 
-	$type = mysql_real_escape_string($_POST['type']);
+	//add //TRANSLIT to approximate any characters (eg smartquotes) that it doesnt know
-	$key = mysql_real_escape_string($_POST['key']);
+	$bodyhtml=iconv("UTF-8","ISO-8859-1//TRANSLIT",$bodyhtml);
-	$fcid = mysql_real_escape_string($_POST['fcid']);
+	$name=iconv("UTF-8","ISO-8859-1//TRANSLIT",$name);
+	$description=iconv("UTF-8","ISO-8859-1//TRANSLIT",$description);
+	$from=iconv("UTF-8","ISO-8859-1//TRANSLIT",$from);
+	$subject=iconv("UTF-8","ISO-8859-1//TRANSLIT",$subject);
+
+	//Now its safe to escape it for the db query
+	$name = stripslashes($name);
+	$description = stripslashes($description);
+	$from = stripslashes($from);
+	$subject = stripslashes($subject);
+	$bodyhtml = stripslashes($bodyhtml);
+
+	$type = $_POST['type'];
+	$key = $_POST['key'];
+	$fcid = $_POST['fcid'];
 
 	if($id == 0) {
 		if($key && $name) {
-			mysql_query("INSERT INTO emails(type,val) VALUES('$type','$key')");
+			$q = $pdo->prepare("INSERT INTO emails(type,val) VALUES('$type','$key')");
-			echo mysql_error();
+			$q->execute();
-			$id = mysql_insert_id();
+			echo $pdo->errorInfo();
+			$id = lastInsertId();
 		} else {
 			error_("Email Key and Name are required");
 			exit;
@@ -162,7 +183,7 @@ case 'email_save':
 	$fcstr = ($fcid == 0) ? 'NULL' : "'$fcid'";
 
 	$body=getTextFromHtml($bodyhtml);
-	mysql_query("UPDATE emails SET 
+	$q = $pdo->prepare("UPDATE emails SET 
 								name='$name',
 								description='$description',
 								`from`='$from',
@@ -171,7 +192,8 @@ case 'email_save':
 								bodyhtml='$bodyhtml',
 								fundraising_campaigns_id=$fcstr
 						WHERE id='$id'");
-	echo mysql_error();
+	$q->execute();
+	echo $pdo->errorInfo();
 	happy_("Email Saved");
 	exit;
 
@@ -190,8 +212,8 @@ case 'dialog_edit':
 		if(array_key_exists('fundraising_campaigns_id', $_GET)) {
 			$fcid = intval( $_GET['fundraising_campaigns_id']);
 			$type = 'fundraising';
-			$q=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$fcid'");
+			$q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$fcid'");
-			$fc=mysql_fetch_object($q);
+			$fc=$q->fetch(PDO::FETCH_OBJ);
 			$name=i18n("%1 communication for %2",array(ucfirst($key),$fc->name));
 		} else {
 			$fcid = 0;
@@ -201,12 +223,13 @@ case 'dialog_edit':
 		$from=$_SESSION['name']." <".$_SESSION['email'].">";
 	}
 	if($id) {
-		$q = mysql_query("SELECT * FROM emails WHERE id='$id'");
+		$q = $pdo->prepare("SELECT * FROM emails WHERE id='$id'");
-		if(mysql_num_rows($q) != 1) {
+		$q->execute();
+		if($q->rowCount() != 1) {
 			echo "Ambiguous edit";
 			exit;
 		}
-		$e = mysql_fetch_assoc($q);
+		$e = $q->fetch(PDO::FETCH_ASSOC);
 
 		/* If we're supposed to clone it, load it then zero out the
 		 * id so we make a new record on save, and override the key */
@@ -289,12 +312,11 @@ case 'dialog_edit':
 					<option value="LASTNAME">[LASTNAME]</option>
 					<option value="NAME">[NAME]</option>
 					<option value="SALUTATION">[SALUTATION]</option>
-					<option value="USERNAME">[USERNAME]</option>
 					<option value="PASSWORD">[PASSWORD]</option>
 					<option value="REGNUM">[REGNUM]</option>
 					<option value="URLMAIN">[URLMAIN]</option>
 					<option value="URLLOGIN">[URLLOGIN]</option>
-					<option value="EMAILCONFIRMATIONLINK">[EMAILCONFIRMATIONLINK]</option>
+					<option value="ACCESSCODE" title="School Access Code">[ACCESSCODE]</option>
 					</select>
 				</td></tr></table>
 		</td>
@@ -381,18 +403,21 @@ case 'dialog_send':
 	$fcid=intval($_GET['fundraising_campaigns_id']);
 	$emailid=intval($_GET['emails_id']);
 
-	$fcq=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$fcid'");
+	$fcq=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$fcid'");
-	$fc=mysql_fetch_object($fcq);
+	$fcq->execute();
+	$fc=$fcq->fetch(PDO::FETCH_OBJ);
 
-	$emailq=mysql_query("SELECT * FROM emails WHERE id='$emailid'");
+	$emailq=$pdo->prepare("SELECT * FROM emails WHERE id='$emailid'");
-	$email=mysql_fetch_object($emailq);
+	$emailq->execute();
+	$email=$email->fetch(PDO::FETCH_OBJ);
 
 	?>
 	<form id="send">
 	<table style="width:100%">
 	<?
-	$q=mysql_query("SELECT COUNT(*) AS num FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$fcid'");
+	$q=$pdo->prepare("SELECT COUNT(*) AS num FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$fcid'");
-	$r=mysql_fetch_object($q);
+	$q->execute();
+	$r=$q->fetch(PDO::FETCH_OBJ);
 	$numrecipients=$r->num;
 
 	echo "<tr><td>".i18n("Appeal")."</td><td>".$fc->name." - ".i18n(ucfirst($email->val))."</td></tr>\n";
@@ -485,8 +510,9 @@ case 'dialog_sender':
 	$u=user_load_by_uid(intval($_GET['uid']));
 
 	if($_GET['template']) {
-		$emailq=mysql_query("SELECT * FROM emails WHERE `val`='".mysql_real_escape_string($_GET['template'])."'");
+		$emailq=$pdo->prepare("SELECT * FROM emails WHERE `val`='".$_GET['template']."'");
-		$e=mysql_fetch_assoc($emailq);
+		$emailq->execute();
+		$e=$emailq->fetch(PDO::FETCH_ASSOC);
 	}
 	else
 		$e=null;
@@ -592,14 +618,15 @@ case "email_send":
 
 case "email_get_list":
 
-	 $q=mysql_query("SELECT * FROM emails ORDER BY type,name");
+	$q = $pdo->prepare("SELECT * FROM emails ORDER BY type,name");
+
 	 echo "<table class=\"tableview\">";
 	 echo "<thead><tr>";
 	 echo " <th>".i18n("Name")."</th>";
 	 echo " <th>".i18n("Type")."</th>";
 	 echo " <th>".i18n("Actions")."</th>";
 	 echo "</tr></thead>";
-	 while($r=mysql_fetch_object($q)) {
+	 while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		if($r->fundraising_campaigns_id) $fcid=$r->fundraising_campaigns_id;
 		else $fcid='null';
 		if($r->name) $name=$r->name;
@@ -624,53 +651,83 @@ case "email_get_list":
 
 	 case 'cancel':
 	 if($_GET['cancel']) {
-		mysql_query("UPDATE emailqueue SET finished=NOW() WHERE id='".intval($_GET['cancel'])."'");
+		
-		mysql_query("UPDATE emailqueue_recipients SET result='cancelled' WHERE emailqueue_id='".intval($_GET['cancel'])."' AND sent IS NULL AND result IS NULL");
+		$q = $pdo->prepare("UPDATE emailqueue SET finished=NOW() WHERE id='".intval($_GET['cancel'])."'");
+		$q->execute();
+	
+		$q = $pdo->prepare("UPDATE emailqueue_recipients SET result='cancelled' WHERE emailqueue_id='".intval($_GET['cancel'])."' AND sent IS NULL AND result IS NULL");
+		$q->execute();
 		echo "ok";
 	 }
 	 exit;
+
+	case 'loadaddresses':
+		if($_GET['query'] && array_key_exists($_GET['query'],$mailqueries)) {
+			
+			$q = $pdo->prepare($mailqueries[$_GET['query']]['query']);
+			$q->execute();
+			while($r=$q->fetch(PDO::FETCH_OBJ)) {
+				if($r->organization) $s="($r->organization) ";
+				else $s="";
+				echo "$r->firstname $r->lastname {$s}&lt;$r->email&gt;<br />";
+			}
+		}
+
+	exit;
 }
 
- include "communication.inc.php";
 
  if($_GET['action']=="sendqueue") {
 	$fcid=intval($_POST['fundraising_campaigns_id']);
 	$emailid=intval($_POST['emails_id']);
 
-	$fcq=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$fcid'");
-	$fc=mysql_fetch_object($fcq);
 
-	$emailq=mysql_query("SELECT * FROM emails WHERE id='$emailid'");
+	$fcq = $pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$fcid'");
-	$email=mysql_fetch_object($emailq);
+	$fcq->execute();
+	$fc=$fcq->fetch(PDO::FETCH_OBJ);
 
-	$recipq=mysql_query("SELECT * FROM fundraising_campaigns_users_link
+	
+	$emailq = $pdo->prepare("SELECT * FROM emails WHERE id='$emailid'");
+	$emailq.execute();
+	$email=$emailq.fetch(PDO::FETCH_OBJ);
+
+	$recipq = $pdo->prepare("SELECT * FROM fundraising_campaigns_users_link
 						WHERE fundraising_campaigns_id='$fcid'");
-	echo mysql_error();
+	$recipq.execute();
+	echo $pdo->errorInfo();
 
-	$numtotal=mysql_num_rows($recipq);
+	$numtotal=$recipq->rowCount();
-	mysql_query("INSERT INTO emailqueue (val,name,users_uid,`from`,subject,body,bodyhtml,`type`,fundraising_campaigns_id,started,finished,numtotal,numsent) VALUES (
+
-			'".mysql_real_escape_string($email->val)."',
+	$q = $pdo->prepare("INSERT INTO emailqueue (val,name,users_uid,`from`,subject,body,bodyhtml,`type`,fundraising_campaigns_id,started,finished,numtotal,numsent) VALUES (
-			'".mysql_real_escape_string($email->name)."',
+			'".$email->val."',
+			'".$email->name."',
 			'".$_SESSION['users_uid']."',
-			'".mysql_real_escape_string($email->from)."',
+			'".$email->from."',
-			'".mysql_real_escape_string($email->subject)."',
+			'".$email->subject."',
-			'".mysql_real_escape_string($email->body)."',
+			'".$email->body."',
-			'".mysql_real_escape_string($email->bodyhtml)."',
+			'".$email->bodyhtml."',
-			'".mysql_real_escape_string($email->type)."',
+			'".$email->type."',
 			$fcid,
 			NOW(),
 			NULL,
 			$numtotal,
 			0)");
-	$emailqueueid=mysql_insert_id();
+	$q->execute();
-	echo mysql_error();
+	$emailqueueid=$pdo->lastInsertId();
+	echo $pdo->errorInfo();
 
 	$urlproto = $_SERVER['SERVER_PORT'] == 443 ? "https://" : "http://";
 	$urlmain = "$urlproto{$_SERVER['HTTP_HOST']}{$config['SFIABDIRECTORY']}";
 	$urllogin = "$urlmain/login.php";
-	while($r=mysql_fetch_object($recipq)) {
+	while($r=$recipq->fetch(PDO::FETCH_OBJ)) {
 		$u=user_load_by_uid($r->users_uid);
-		$confirmationLink = account_build_email_confirmation_link($u['accounts_id']);
+
+		//we only send school access codes to science heads or principals
+	
+		$acq = $pdo->prepare("SELECT accesscode FROM schools WHERE (sciencehead_uid='{$u['uid']}' OR principal_uid='{$u['uid']}') AND `year`='{$config['FAIRYEAR']}'");
+		$acq->execute();
+		$acr=$acq->fetch(PDO::FETCH_OBJ);
+		$accesscode=$acr->accesscode;
 
 		$replacements=array(
 					"FAIRNAME"=>$config['fairname'],
@@ -682,19 +739,22 @@ case "email_get_list":
 					"ORGANIZATION"=>$u['sponsor']['organization'],
 					"URLMAIN"=>$urlmain,
 					"URLLOGIN"=>$urllogin,
-					"EMAILCONFIRMATIONLINK" => $confirmationLink,
+					"ACCESSCODE"=>$accesscode,
 					);
 
 		if($u['email'] && $u['email'][0] != '*') {
-			mysql_query("INSERT INTO emailqueue_recipients (emailqueue_id,toemail,toname,replacements,sent) VALUES (
+			
+			$q = $pdo->prepare("INSERT INTO emailqueue_recipients (emailqueue_id,toemail,toname,replacements,sent) VALUES (
 				'$emailqueueid',
-				'".mysql_real_escape_string($u['email'])."',
+				'".$u['email']."',
-				'".mysql_real_escape_string($u['name'])."',
+				'".$u['name']."',
-				'".mysql_real_escape_string(json_encode($replacements))."',
+				'".json_encode($replacements."',
-				NULL)");
+				NULL)"));
-			echo mysql_error();
+			$q->execute();
+			echo $pdo->erroInfo();
 		}
-		mysql_query("UPDATE emails SET lastsent=NOW() WHERE id='$emailid'");
+		$q = $pdo->prepare("UPDATE emails SET lastsent=NOW() WHERE id='$emailid'");
+		$q->execute();
 	}
 	echo "ok";
 	launchQueue();
@@ -707,15 +767,37 @@ case "email_get_list":
             "communication"
 			);
  echo "<br />";
+ ?>
+ <script type="text/javascript">
+ function toggleAddresses() {
+	 if($("#toaddresses").is(":visible")) {
+		 $("#toaddresses").hide();
+		 $("#toaddresses-view").html("Show Recipients");
+	 } else {
+		 $("#toaddresses").show();
+		 $("#toaddresses-view").html("Hide Recipients");
+	 }
+	 return false;
+ }
+ function loadAddresses() {
+	 $("#toaddresses").load("communication.php?action=loadaddresses&query="+$("#to").val());
+ }
+ </script>
+ <?
 
  if($_GET['action']=="delete" && $_GET['delete']) {
- 	mysql_query("DELETE FROM emails WHERE id='".$_GET['delete']."' AND `type`='user'");
+	$q = $pdo->prepare("DELETE FROM emails WHERE id='".$_GET['delete']."' AND `type`='user'");
+ 	$q->execute();
 	echo happy("Email successfully deleted");
  }
 
 	if($_GET['action']=="send" && $_GET['send']) {
-		$q=mysql_query("SELECT * FROM emails WHERE id='".$_GET['send']."'");
+		echo $pdo->errorInfo();
-		$r=mysql_fetch_object($q);
+	
+		$q = $pdo->prepare("SELECT * FROM emails WHERE id='".$_GET['send']."'");
+		$q->execute();
+
+		$r=$q->fetch(PDO::FETCH_OBJ);
 
 		echo i18n("Please confirm you would like to send the following email, and choose who to send it to");
 		echo "<br>";
@@ -724,23 +806,27 @@ case "email_get_list":
 		echo "<table cellspacing=0 cellpadding=3 border=1>";
 		echo "<tr><td><b>From:</b></td><td>".htmlspecialchars($r->from)."</td></tr>";
 		echo "<tr><td><b>To:</b></td><td>";
-		echo "<select name=\"to\">";
+		echo "<select name=\"to\" id=\"to\" onchange=\"loadAddresses();\">";
 		echo " <option value=\"\">Choose Email Recipients</option>";
 		$str="";
 		foreach($mailqueries AS $k=>$mq) {
-			$tq=mysql_query($mq['query']);
+			$tq=$pdo->prepare($mq['query']);
-            if(mysql_error()) {
+			
-                echo mysql_error();
+			$tq->execute();
+            if($pdo->errorInfo()) {
+                echo $pdo->errorInfo();
                 exit;
             }
-			$num=mysql_num_rows($tq);
+			$num=$tq->rowCount();
 			$str.="<h2>".$mq['name']." $num </h2>";
-			while($tr=mysql_fetch_object($tq)) {
+			while($tr=$tq->fetch(PDO::FETCH_OBJ)) {
 				$str.="[".$tr->uid."][".$tr->year."] ".$tr->firstname." ".$tr->lastname." &lt;{$tr->email}&gt;<br />";
 			}
 			echo " <option value=\"$k\">".i18n($mq['name'])." (".i18n("%1 recipients",array($num),array("number")).")</option>";
 		}
 		echo "</select>";
+		echo "<div id=\"toaddresses-view-wrapper\"><a href=\"#\" onclick=\"return toggleAddresses()\"><span id=\"toaddresses-view\">View Recipients</span></a></div>";
+		echo "<div id=\"toaddresses\" style=\"width: 100%; height: 300px; overflow: auto; border: 1px solid grey; background-color: #FFFFFF; display: none;\">empty</div>";
 		echo "</td></tr>";
 		echo "<tr><td><b>Date:</b></td><td>".date("r")."</td></tr>";
 		echo "<tr><td><b>Subject:</b></td><td>".htmlspecialchars($r->subject)."</td></tr>";
@@ -751,7 +837,7 @@ case "email_get_list":
 			$body=nl2br(htmlspecialchars($r->body));
 		}
 
-		echo "<tr><td colspan=2>".$body."</td></tr>";
+		echo "<tr><td colspan=2>".$body."<br />(".mb_detect_encoding($body).")</td></tr>";
 
 		echo "</table>";
 
@@ -776,40 +862,40 @@ case "email_get_list":
 	}
 	else if($_POST['action']=="reallysend" && $_POST['reallysend'] && $_POST['to']) {
 		$emailid=intval($_POST['reallysend']);
-		$emailq=mysql_query("SELECT * FROM emails WHERE id='$emailid'");
+		$emailq=$pdo->prepare("SELECT * FROM emails WHERE id='$emailid'");
-		$email=mysql_fetch_object($emailq);
+		$email=$emailq->fetch(PDO::FETCH_OBJ);
 		$to=$_POST['to'];
 
 		if(array_key_exists($to,$mailqueries)) {
-				$recipq=mysql_query($mailqueries[$to]['query']);
+				$recipq=$pdo->prepare($mailqueries[$to]['query']);
+				$recipq->execute();
 		}
 
-		$numtotal=mysql_num_rows($recipq);
+		$numtotal=$recipq->rowCount();
-		mysql_query("INSERT INTO emailqueue (val,name,users_uid,`from`,subject,body,bodyhtml,`type`,fundraising_campaigns_id,started,finished,numtotal,numsent) VALUES (
+		$q = $pdo->prepare("INSERT INTO emailqueue (val,name,users_uid,`from`,subject,body,bodyhtml,`type`,fundraising_campaigns_id,started,finished,numtotal,numsent) VALUES (
-				'".mysql_real_escape_string($email->val)."',
+				'".$email->val."',
-				'".mysql_real_escape_string($email->name)."',
+				'".$email->name."',
 				'".$_SESSION['users_uid']."',
-				'".mysql_real_escape_string($email->from)."',
+				'".$email->from."',
-				'".mysql_real_escape_string($email->subject)."',
+				'".$email->subject."',
-				'".mysql_real_escape_string($email->body)."',
+				'".$email->body."',
-				'".mysql_real_escape_string($email->bodyhtml)."',
+				'".$email->bodyhtml."',
-				'".mysql_real_escape_string($email->type)."',
+				'".$email->type."',
 				NULL,
 				NOW(),
 				NULL,
 				$numtotal,
 				0)");
-		$emailqueueid=mysql_insert_id();
+		$q->execute();
-		echo mysql_error();
+		$emailqueueid=lastInsertId();
+		echo $pdo->errorInfo();
 
 		$urlproto = $_SERVER['SERVER_PORT'] == 443 ? "https://" : "http://";
 		$urlmain = "$urlproto{$_SERVER['HTTP_HOST']}{$config['SFIABDIRECTORY']}";
 		$urllogin = "$urlmain/login.php";
 
-		while($r=mysql_fetch_object($recipq)) {
+		while($r=$recipq->fetch(PDO::FETCH_OBJ)) {
-			if($r->id)
+			if($r->uid)
-				$u=user_load($r->id);
-			else if($r->uid)
 				$u=user_load_by_uid($r->uid);
 			else if($r->users_uid) 
 				$u=user_load_by_uid($r->users_uid);
@@ -822,28 +908,21 @@ case "email_get_list":
 							"FIRSTNAME"=>$r->firstname,
 							"LASTNAME"=>$r->lastname,
 							"NAME"=>$r->firstname." ".$r->lastname,
+							"EMAIL"=>$r->email,
 							"ORGANIZATION"=>$r->organization,
 							"URLMAIN"=>$urlmain,
 							"URLLOGIN"=>$urllogin,
+							"ACCESSCODE"=>"unknown",
 							);
 			}
 			if($u) {
-				$a=account_load($u['accounts_id']);
+
-				$apassword=account_get_password($u['accounts_id']);
+				//we only send school access codes to science heads or principals
-				$confirmationLink = account_build_email_confirmation_link($u['accounts_id']);
+				$acq=$pdo->prepare("SELECT accesscode FROM schools WHERE (sciencehead_uid='{$u['uid']}' OR principal_uid='{$u['uid']}') AND `year`='{$config['FAIRYEAR']}'");
-				if($a['email']) {
+				$acq->execute();
-					 $e=$a['email'];
+				echo $pdo->errorInfo();
-				}
+				$acr=$acq->fetch(PDO::FETCH-OBJ);
-				else if ($a['pendingemail']) {
+				$accesscode=$acr->accesscode;
-					$e=$a['pendingemail'];
-				}
-				else {
-					$e="";
-				}
-				if($u['registrations_id']) {
-					$regq=mysql_query("SELECT num FROM registrations WHERE id='{$u['registrations_id']}'");
-					$regr=mysql_fetch_assoc($regq);
-				}
 
 				$replacements=array(
 							"FAIRNAME"=>$config['fairname'],
@@ -851,30 +930,30 @@ case "email_get_list":
 							"FIRSTNAME"=>$u['firstname'],
 							"LASTNAME"=>$u['lastname'],
 							"NAME"=>$u['name'],
-							"EMAIL"=>$e,
+							"EMAIL"=>$u['email'],
-							"USERNAME"=>$a['username'],
-							"PASSWORD"=>$apassword,
-							"REGNUM"=>$regq['num'],
 							"ORGANIZATION"=>$u['sponsor']['organization'],
 							"URLMAIN"=>$urlmain,
 							"URLLOGIN"=>$urllogin,
-							"EMAILCONFIRMATIONLINK" => $confirmationLink,
+							"ACCESSCODE"=>$accesscode,
 							);
 
 				$toname=$u['name'];
-				$toemail=$e;
+				$toemail=$u['email'];
 			}
 
 			if($toemail) {
-				mysql_query("INSERT INTO emailqueue_recipients (emailqueue_id,toemail,toname,replacements,sent) VALUES (
+				$q = $pdo->prepare("INSERT INTO emailqueue_recipients (emailqueue_id,toemail,toname,replacements,sent) VALUES (
 					'$emailqueueid',
-					'".mysql_real_escape_string($toemail)."',
+					'".$toemail."',
-					'".mysql_real_escape_string($toname)."',
+					'".$toname."',
-					'".mysql_real_escape_string(json_encode($replacements))."',
+					'".json_encode($replacements)."',
 					NULL)");
-				echo mysql_error();
+				$q->execute();
+				echo $pdo->errorInfo();
 			}
-			mysql_query("UPDATE emails SET lastsent=NOW() WHERE id='$emailid'");
+			
+			$q = $pdo->prepare("UPDATE emails SET lastsent=NOW() WHERE id='$emailid'");
+			$q->execute();
 		}
 		launchQueue();
 		echo "<br />";

admin/communication_send_status.php

@@ -24,15 +24,18 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  if($_GET['action']=="status") {
-	 $q=mysql_query("SELECT * FROM emailqueue WHERE finished IS NULL");
+	
+	 $q = $pdo->prepare("SELECT * FROM emailqueue WHERE finished IS NULL");
+	 $q->execute();
 
-	 if($config['emailqueue_lock'] || mysql_num_rows($q)) {
+	 if($config['emailqueue_lock'] || $q->rowCount()) {
 		echo "<h4>".i18n("Active Send Queues")."</h4>\n";
-		$q=mysql_query("SELECT *,UNIX_TIMESTAMP(started) AS ts FROM emailqueue WHERE finished IS NULL ORDER BY started DESC");
+		
-
+		$q = $pdo->prepare("SELECT *,UNIX_TIMESTAMP(started) AS ts FROM emailqueue WHERE finished IS NULL ORDER BY started DESC");
+		$q->execute();
 	 	if(!$config['emailqueue_lock']) {
 			echo error(i18n("It looks like there's emails waiting to send, but the sending process isnt running.").
 			"<br />".
@@ -51,7 +54,7 @@
 		echo " <th>".i18n("Cancel")."</th>\n";
 		echo "</tr></thead>\n";
 
-		while($r=mysql_fetch_object($q)) {
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<tr>";
 			echo " <td>$r->name</td>\n";
 			echo " <td>$r->subject</td>\n";
@@ -89,7 +92,9 @@
 		<?
 	 }
 
-	$q=mysql_query("SELECT * FROM emailqueue WHERE finished IS NOT NULL ORDER BY started DESC LIMIT 10");
+
+	$q = $pdo->prepare("SELECT * FROM emailqueue WHERE finished IS NOT NULL ORDER BY started DESC LIMIT 10");
+	$q->execute();
 	echo "<h4>".i18n("Completed Send Queues")."</h4>\n";
 	echo "<table class=\"tableview\">\n";
 	echo "<thead><tr>";
@@ -103,7 +108,7 @@
 	//FIXME: comment bounced until we implement it
 //	echo " <th>".i18n("Bounced")."</th>\n";
 	echo "</tr></thead>\n";
-	while($r=mysql_fetch_object($q)) {
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		echo "<tr>";
 		echo " <td>$r->name</td>\n";
 		echo " <td>$r->subject</td>\n";

admin/curl.inc.php

@@ -24,7 +24,7 @@
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require_once('xml.inc.php');
 
  function xml_dearray(&$array)
@@ -94,7 +94,7 @@
 	curl_setopt ($ch, CURLOPT_POST, 1);  /// tell it to make a POST, not a GET
 	curl_setopt ($ch, CURLOPT_POSTFIELDS, "$var=".urlencode($str));  /// put the query string here starting with "?"
 	curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); /// This allows the output to be set into a variable $datastream
-	curl_setopt ($ch, CURLOPT_POSTFIELDSIZE, 0);
+//	curl_setopt ($ch, CURLOPT_POSTFIELDSIZE, 0);
 	curl_setopt ($ch, CURLOPT_TIMEOUT, 360);
 	curl_setopt ($ch, CURLOPT_SSLVERSION, 3);
 	curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, false);

admin/cwsfregister.php

@@ -28,15 +28,16 @@ include "xml.inc.php";
  {
  	global $config;
  	$winners=array();
- 	$winners_ids=array();
 
- 	$q=mysql_query("SELECT * FROM award_awards WHERE cwsfaward='1' AND conferences_id='".$conference['id']."'");
+ 	$q=$pdo->prepare("SELECT * FROM award_awards WHERE cwsfaward='1' AND year='".$config['FAIRYEAR']."'");
-	while($award=mysql_fetch_object($q)) 
+	$q->execute();
+	if($q->rowCount()==1)
 	{
-		$pq=mysql_query("SELECT * FROM award_prizes WHERE award_awards_id='$award->id'");
+		$award=$q->fetch(PDO::FETCH_OBJ);
-		while($prize=mysql_fetch_object($pq))
+		$pq=$pdo->prepare("SELECT * FROM award_prizes WHERE award_awards_id='$award->id'");
+		while($prize=$pq->fetch(PDO::FETCH_OBJ))
 		{
-			$wq=mysql_query("SELECT 
+			$wq=$pdo->prepare("SELECT 
 						projects.id,
 						projects.projectnumber,
 						projects.title,
@@ -51,19 +52,17 @@ include "xml.inc.php";
 					WHERE 
 						winners.projects_id=projects.id AND
 						awards_prizes_id='$prize->id' AND 
-						winners.conferences_id='".$conference['id']."'");
+						winners.year='".$config['FAIRYEAR']."'");
-						echo mysql_error();
+				$wq->execute();
-			while($project=mysql_fetch_object($wq))
+				
+						echo $pdo->errorInfo();
+			while($project=$wq->fetch(PDO::FETCH_OBJ))
 			{
-				if(array_key_exists($project->id, $winners_ids)) {
+				$sq=$pdo->prepare("SELECT * FROM students WHERE registrations_id='$project->registrations_id' AND year='".$config['FAIRYEAR']."'");
-					continue;
+				$sq->execute();
-				} else {
-					$winners_ids[$project->id] = true;
-				}
-				$sq=mysql_query("SELECT * FROM students WHERE registrations_id='$project->registrations_id' AND conferences_id='".$conference['id']."'");
 				$students=array();
 				$cwsf_agecategory=0;
-				while($s=mysql_fetch_object($sq))
+				while($s=$sq->fetch(PDO::FETCH_OBJ))
 				{
 					if($s->grade>=7 && $s->grade<=8)
 					{
@@ -122,7 +121,7 @@ include "xml.inc.php";
 <?
  require("../common.inc.php");
  require("../projects.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("One-Click CWSF Registration",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php'),
@@ -134,7 +133,8 @@ include "xml.inc.php";
  {
  	foreach($_POST['cwsfdivision'] AS $p=>$d)
 	{
-		mysql_query("UPDATE projects SET cwsfdivisionid='$d' WHERE id='$p'");
+		$q = $pdo->prepare("UPDATE projects SET cwsfdivisionid='$d' WHERE id='$p'");
+		$q->execute();
 	}
 	echo happy(i18n("CWSF Project Divisions saved"));
  }
@@ -171,12 +171,13 @@ include "xml.inc.php";
  }
 
  /* Load the YSC fair */
- $q = mysql_query("SELECT * FROM fairs WHERE abbrv='YSC'");
+ $q = $pdo->prepare("SELECT * FROM fairs WHERE abbrv='YSC'");
- if(mysql_num_rows($q) < 1) {
+ $q->execute();
+ if($q->rowCount() < 1) {
  	echo error(i18n("You have not defined the YSC upstream fair in the Science Fair Management area."));
 	$ok = false;
  } else {
-	 $f = mysql_fetch_assoc($q);
+	 $f = $q->fetch(PDO::FETCH_ASSOC);
 	 $ysc_region_id = $f['username'];
 	 $ysc_region_password = $f['password'];
  }
@@ -193,20 +194,22 @@ include "xml.inc.php";
 
  if($ok)
  {
- 	$q=mysql_query("SELECT * FROM award_awards WHERE cwsfaward='1' AND conferences_id='".$conference['id']."'");
+ 	$q=$pdo->prepare("SELECT * FROM award_awards WHERE cwsfaward='1' AND year='".$config['FAIRYEAR']."'");
-	if(!mysql_num_rows($q))
+	$q->execute();
+	if(!$q->rowCount())
 	{
 		echo error(i18n("Cannot find an award that is specified as the Canada-Wide Science Fair Award"));
 		echo i18n("Please go to the awards manager and select which award identifies your CWSF students");
 	}
+	else if($q->rowCount()>1)
+	{
+		echo error(i18n("There is more than one award that is identified as your Canada-Wide Science Fair award."));
+		echo i18n("Please go to the awards manager and choose only one award that identifies your CWSF students");
+	}
 	else
 	{
-		echo "<b>".i18n("CWSF Awards").":</b> <br />";
+		$award=$q->fetch(PDO::FETCH_OBJ);
-		echo "<ul>";
+		echo "<b>".i18n("CWSF Award").":</b> ".$award->name."<br />";
-		while($award=mysql_fetch_object($q)) {
-			echo "<li>{$award->name}</li>";
-		}
-		echo "</ul>";
 		echo i18n("Please review the list of winning projects/students below.  If it is all correct then you can click the 'Register for CWSF' button at the bottom of the page to send the information to YSC");
 		echo "<br />";
 		echo "<br />";
@@ -262,8 +265,9 @@ include "xml.inc.php";
 
 			echo "</td><td>";
 
-			$t=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='".$conference['id']."' AND id='".$winner['projectdivisions_id']."'");
+			$t=$q->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' AND id='".$winner['projectdivisions_id']."'");
-			$tr=mysql_fetch_object($t);
+			$t->execute();
+			$tr=$t->fetch(PDO::FETCH_OBJ);
 			echo $tr->division;
 			echo "<br />";
 

admin/documentdownloader.php

@@ -23,9 +23,10 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
- $q=mysql_query("SELECT * FROM documents WHERE id='".$_GET['id']."'");
+ $q=$pdo->prepare("SELECT * FROM documents WHERE id='".$_GET['id']."'");
- if($r=mysql_fetch_object($q))
+ $q->execute();
+ if($r=$q->fetch(PDO::FETCH_OBJ))
  {
 	header("Content-type: ".trim(exec("file -bi ../data/documents/$r->filename")));
 	header("Content-disposition: inline; filename=\"".$r->filename."\"");

admin/documents.php

@@ -31,7 +31,7 @@
  if(!file_exists("../data/documents/.htaccess"))
  	file_put_contents("../data/documents/.htaccess","Order Deny,Allow\r\nDeny From All\r\n");
 
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("Internal Document Manager",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php'),

admin/donations.php

@@ -0,0 +1,179 @@
+<?
+/* 
+   This file is part of the 'Science Fair In A Box' project
+   SFIAB Website: http://www.sfiab.ca
+
+   Copyright (C) 2008 James Grant <james@lightbox.org>
+
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public
+   License as published by the Free Software Foundation, version 2.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.  If not, write to
+   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+   Boston, MA 02111-1307, USA.
+*/
+?>
+<?
+ require("../common.inc.php");
+ require("../tableeditor.class.php");
+ require_once("../user.inc.php");
+
+ user_auth_required('committee', 'admin');
+ 
+ include ("fundraising_sponsorship_handler.inc.php");
+ include ("fundraising_goals_handler.inc.php");
+ include ("fundraising_main.inc.php");
+
+ send_header("Donations",
+ 		array('Committee Main' => 'committee_main.php',
+			'Administration' => 'admin/index.php',
+			'Fundraising' => 'admin/fundraising.php'),
+            "fundraising"
+			);
+
+?>
+<script type="text/javascript">
+$(document).ready(function() {
+    //initialize the dialog
+    $("#sponsorship_editor").dialog({
+        bgiframe: true, autoOpen: false,
+        modal: true, resizable: false,
+        draggable: false
+    });
+
+    $("#fund_editor").dialog({
+        bgiframe: true, autoOpen: false,
+        modal: true, resizable: falsefundraising
+        draggable: false
+    });
+
+refresh_fundraising_table(); 
+
+});
+
+function popup_sponsorship_editor(url) {
+    var w = (document.documentElement.clientWidth * 0.6);
+    $('#sponsorship_editor').dialog('option','width',w);
+    //let the height autocalculate
+/*    
+    var h = (document.documentElement.clientHeight * 0.6);
+    $('#sponsorship_editor').dialog('option','height',h);
+    */
+    $('#sponsorship_editor').dialog('option','buttons',{ "<?=i18n("Save")?>": function() { save_sponsorship(); },
+    "<?=i18n("Cancel")?>": function(){ $(this).dialog("close");}});
+    $('#sponsorship_editor').dialog('open');
+
+    $('#sponsorship_editor_content').load(url);
+
+    return false;
+}
+
+function save_sponsorship() {
+    $('#debug').load("<?=$config['SFIABDIRECTORY']?>/admin/fundraising.php",
+    $("#fundraisingsponsorship").serializeArray(),
+    function() {
+        $('#sponsorship_editor').dialog('close');
+        refresh_fundraising_table();
+    });
+    return false;
+}
+
+function popup_fund_editor(url) {
+    var w = (document.documentElement.clientWidth * 0.6);
+    $('#fund_editor').dialog('option','width',w);
+    //let the height autocalculate
+/*    
+    var h = (document.documentElement.clientHeight * 0.6);
+    $('#fund_editor').dialog('option','height',h);
+    */
+    $('#fund_editor').dialog('option','buttons',{ "<?=i18n("Save")?>": function() { save_fund(); },
+    "<?=i18n("Cancel")?>": function(){ $(this).dialog("close");}});
+    $('#fund_editor').dialog('open');
+
+    $('#fund_editor_content').load(url);
+
+    return false;
+}
+
+function save_fund() {
+    $("#debug").load("<?=$config['SFIABDIRECTORY']?>/admin/fundraising.php",
+    $("#fundraisingfundraising").serializeArray(),
+    function(data) {
+        $('#fund_editor').dialog('close');
+        refresh_fundraising_table();
+    });
+    return false;
+}
+
+function delete_fund(id) {
+    if(confirmClick('Are you sure you want to remove this fund?')) {
+        $('#debug').load("<?=$config['SFIABDIRECTORY']?>/admin/fundraising.php",
+        { action: 'funddelete', delete: id },
+        function() {
+            refresh_fundraising_table();
+        }
+        );
+    }
+    return false;
+}
+
+function delete_sponsorship(id) {
+    if(confirmClick('Are you sure you want to remove this sponsorship?')) {
+        $('#debug').load("<?=$config['SFIABDIRECTORY']?>/admin/fundraising.php",
+        { action: 'sponsorshipdelete', delete: id },
+        function() {
+            refresh_fundraising_table();
+        }
+        );
+    }
+    return false;
+}
+
+function refresh_fundraising_table() {
+    $("#fundraisingmain").load("fundraising.php?action=fundraisingmain");
+}
+</script>
+<?
+
+ //first, insert any defaults
+ $q=$pdo->prepare("SELECT * FROM fundraising WHERE year='".$config['FAIRYEAR']."'");
+ $q->execute();
+ if(!$q->rowCount()) {
+	 $q=$pdo->prepare("SELECT * FROM fundraising WHERE year='-1'");
+
+     $q->execute();
+	 while($r=$q->fetch(PDO::FETCH_OBJ)) {
+		$q = $pdo->prepare("INSERT INTO fundraising (`type`,`name`,`description`,`system`,`goal`,`year`) VALUES ('$r->type','".$r->name."','".$r->description."','$r->system','$r->goal','".$config['FAIRYEAR']."')");
+        $q->execute();
+	 }
+ }
+
+echo "<div id=\"fundraisingmain\">";
+echo "</div>";
+
+ echo "<br />\n";
+ echo "<br />\n";
+ echo "<a href=\"sponsorship_levels.php\">Manage Donation Levels</a>\n";
+ echo "<br />\n";
+ echo "<a href=\"donors.php\">Manage Donors</a>\n";
+ echo "<br />\n";
+
+?>
+<div style="display: none" title="<?=i18n("Donation Editor")?>" id="sponsorship_editor">
+<div id="sponsorship_editor_content">
+</div>
+</div>
+<div style="display: none" title="<?=i18n("Fund Editor")?>" id="fund_editor">
+<div id="fund_editor_content">
+</div>
+</div>
+<?
+ send_footer();
+?>

admin/donors.php

@@ -24,16 +24,16 @@
 <?
 require("../common.inc.php");
 require_once("../user.inc.php");
-require_once("../account.inc.php");
+user_auth_required('committee', 'admin');
-user_auth_required('admin');
 require_once("fundraising_common.inc.php");
 
 
 switch($_GET['action']) {
 	case 'organizationinfo_load':
 		$id=intval($_GET['id']);
-		$q=mysql_query("SELECT * FROM sponsors WHERE id='$id'");
+		$q=$pdo->prepare("SELECT * FROM sponsors WHERE id='$id'");
-		$ret=mysql_fetch_assoc($q);
+		$q->execute();
+		$ret=$q->fetch(PDO::FETCH_ASSOC);
 		echo json_encode($ret);		
 		exit;
 		break;
@@ -41,8 +41,9 @@ switch($_GET['action']) {
 	case 'organizationinfo_save':
 		$id=intval($_POST['sponsor_id']);
 		if($id==-1) {
-			$q=mysql_query("INSERT INTO sponsors (conferences_id) VALUES ('".$conference['id']."')");
+			$q=$pdo->prepare("INSERT INTO sponsors (year) VALUES ('".$config['FAIRYEAR']."')");
-			$id=mysql_insert_id();
+			$q->execute();
+			$id=$pdo->lastInsertId();
 			echo json_encode(array("id"=>$id));
 			save_activityinfo("Created donor/sponsor", $id, $_SESSION['users_uid'],"System");
 			$createnew=true;
@@ -51,26 +52,27 @@ switch($_GET['action']) {
 
 		if($id) {
 			$exec="UPDATE sponsors SET ".
-			"donortype='".mysql_escape_string(stripslashes($_POST['donortype']))."', ".
+			"donortype='".stripslashes($_POST['donortype'])."', ".
-			"organization='".mysql_escape_string(stripslashes($_POST['organization']))."', ".
+			"organization='".stripslashes($_POST['organization'])."', ".
-			"address='".mysql_escape_string(stripslashes($_POST['address']))."', ".
+			"address='".stripslashes($_POST['address'])."', ".
-			"address2='".mysql_escape_string(stripslashes($_POST['address2']))."', ".
+			"address2='".stripslashes($_POST['address2'])."', ".
-			"city='".mysql_escape_string(stripslashes($_POST['city']))."', ".
+			"city='".stripslashes($_POST['city'])."', ".
-			"province_code='".mysql_escape_string(stripslashes($_POST['province_code']))."', ".
+			"province_code='".stripslashes($_POST['province_code'])."', ".
-			"postalcode='".mysql_escape_string(stripslashes($_POST['postalcode']))."', ".
+			"postalcode='".stripslashes($_POST['postalcode'])."', ".
-			"phone='".mysql_escape_string(stripslashes($_POST['phone']))."', ".
+			"phone='".stripslashes($_POST['phone'])."', ".
-			"tollfree='".mysql_escape_string(stripslashes($_POST['tollfree']))."', ".
+			"tollfree='".stripslashes($_POST['tollfree'])."', ".
-			"fax='".mysql_escape_string(stripslashes($_POST['fax']))."', ".
+			"fax='".stripslashes($_POST['fax'])."', ".
-			"email='".mysql_escape_string(stripslashes($_POST['email']))."', ".
+			"email='".stripslashes($_POST['email'])."', ".
-			"website='".mysql_escape_string(stripslashes($_POST['website']))."', ".
+			"website='".stripslashes($_POST['website'])."', ".
-			"notes='".mysql_escape_string(stripslashes($_POST['notes']))."', ".
+			"notes='".stripslashes($_POST['notes'])."', ".
-			"donationpolicyurl='".mysql_escape_string(stripslashes($_POST['donationpolicyurl']))."', ".
+			"donationpolicyurl='".stripslashes($_POST['donationpolicyurl'])."', ".
-			"fundingselectiondate='".mysql_escape_string(stripslashes($_POST['fundingselectiondate']))."', ".
+			"fundingselectiondate='".stripslashes($_POST['fundingselectiondate'])."', ".
-			"proposalsubmissiondate='".mysql_escape_string(stripslashes($_POST['proposalsubmissiondate']))."', ".
+			"proposalsubmissiondate='".stripslashes($_POST['proposalsubmissiondate'])."', ".
-			"waiveraccepted='".mysql_escape_string(stripslashes($_POST['waiveraccepted']))."' ".
+			"waiveraccepted='".stripslashes($_POST['waiveraccepted'])."' ".
 			"WHERE id='$id'";
-			mysql_query($exec);
+			$q = $pdo->prepare($exec);
-			echo mysql_error();
+			$q->execute();
+			echo $q->errorInfo();
 
 			//FIXME accept the logo
 			//"logo='".mysql_escape_string(stripslashes($_POST['logo']))."', ".
@@ -90,33 +92,35 @@ switch($_GET['action']) {
 
 
 		//LAST DONATION
-		$q=mysql_query("SELECT * FROM fundraising_donations WHERE sponsors_id='$id' ORDER BY datereceived DESC LIMIT 1");
+		$q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE sponsors_id='$id' ORDER BY datereceived DESC LIMIT 1");
-		if($r=mysql_fetch_object($q))
+		$q->execute();
+		if($r=$q->fetch(PDO::FETCH_OBJ))
 			$lastdonation=i18n("%1 on %2",array(format_money($r->value,false),format_date($r->datereceived)),array("Donation amount","Donation date"));
 		else
 			$lastdonation=i18n("Never");
 
 		//TOTAL THIS YEAR
-		$q=mysql_query("SELECT SUM(value) AS total FROM fundraising_donations 
+		$q=$pdo->prepare("SELECT SUM(value) AS total FROM fundraising_donations 
 				WHERE sponsors_id='$id' 
 				AND status='received'
 				AND fiscalyear={$config['FISCALYEAR']} 
 				");
-
+		$q->execute();
-		if($r=mysql_fetch_object($q))
+		if($r=$q->fetch(PDO::FETCH_OBJ))
 			$totalthisyear=format_money($r->total,false);
 		else
 			$totalthisyear=format_money(0);
 
 		//TOTAL LAST YEAR
 		$lastyear=$config['FISCALYEAR']-1;
-		$q=mysql_query("SELECT SUM(value) AS total FROM fundraising_donations 
+		$q=$pdo->prepare("SELECT SUM(value) AS total FROM fundraising_donations 
 				WHERE sponsors_id='$id' 
 				AND status='received'
 				AND fiscalyear=$lastyear
 				");
+		$q->execute();
 
-		if($r=mysql_fetch_object($q))
+		if($r=$q->fetch(PDO::FETCH_OBJ))
 			$totallastyear=format_money($r->total,false);
 		else
 			$totallastyear=format_money(0);
@@ -130,7 +134,7 @@ switch($_GET['action']) {
 		echo "<br />\n";
 		echo "<h4>".i18n("Donations/Sponsorships")."</h4>\n";
 		echo "<div id=\"thisyeardonationhistory\">";
-		$q=mysql_query("SELECT fundraising_donations.*, 
+		$q=$pdo->prepare("SELECT fundraising_donations.*, 
 				fundraising_campaigns.name AS campaignname 
 				FROM fundraising_donations 
 				LEFT JOIN fundraising_campaigns ON fundraising_donations.fundraising_campaigns_id=fundraising_campaigns.id 
@@ -138,9 +142,10 @@ switch($_GET['action']) {
 				AND status='received' 
 				AND fundraising_donations.fiscalyear='{$config['FISCALYEAR']}' 
 				ORDER BY datereceived DESC");
-		echo mysql_Error();
+		$q->execute();
+		echo $pdo->errorInfo();
 
-		if(mysql_num_rows($q)) {
+		if($q->rowCount()) {
 			echo "<table class=\"tableview\">";
 			echo "<thead>";
 			echo "<tr>";
@@ -151,7 +156,7 @@ switch($_GET['action']) {
 			echo " <th>".i18n("Remove")."</th>\n";
 			echo "</tr>";
 			echo "</thead>";
-			while($r=mysql_fetch_object($q)) {
+			while($r=$q->fetch(PDO::FETCH_OBJ)) {
 				echo "<tr>\n";
 				echo " <td>".format_date($r->datereceived)."</td>\n";
 				$goal=getGoal($r->fundraising_goal);
@@ -183,14 +188,15 @@ switch($_GET['action']) {
 		echo "</tr>";
 		echo "</thead>";
 
-		$q=mysql_query("SELECT fundraising_donations.*, 
+		$q=$pdo->prepare("SELECT fundraising_donations.*, 
 				fundraising_campaigns.name AS campaignname 
 				FROM fundraising_donations 
 				LEFT JOIN fundraising_campaigns ON fundraising_donations.fundraising_campaigns_id=fundraising_campaigns.id 
 				WHERE sponsors_id='$id' 
 					AND status='received' 
 				ORDER BY datereceived DESC");
-		while($r=mysql_fetch_object($q)) {
+		$q->execute();
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<tr>\n";
 			echo " <td>".format_date($r->datereceived)."</td>\n";
 				$goal=getGoal($r->fundraising_goal);
@@ -214,39 +220,44 @@ switch($_GET['action']) {
 		echo "<tr><td>";
 		echo i18n("Appeal").":";
 		echo "</td><td>";
-			$query = mysql_query(
-				"SELECT accounts.id as acc_id, users.id as usr_id, users.deleted, MAX(users.id)  FROM accounts JOIN users ON" .
-				" users.accounts_id = accounts.id" .
-				" WHERE users.sponsors_id = '$id'" .
-				" AND types LIKE '%sponsor%'" .
-				" GROUP BY acc_id" .
-				" HAVING deleted='no'" .
-				" ORDER BY `primary` DESC, lastname, firstname"
-			);
 
-			echo mysql_error();
+			// loop through each contact in the donor
+			$query = $pdo->prepare("SELECT users.id,users.uid,users.deleted,MAX(year) 
+				FROM users 
+				LEFT JOIN users_sponsor ON users_sponsor.users_id=users.id
+				WHERE 
+				sponsors_id='$id' 
+				AND types LIKE '%sponsor%'
+				GROUP BY uid
+				HAVING deleted='no' 
+				ORDER BY users_sponsor.primary DESC,lastname,firstname
+			");
+			$query->execute();
+			echo $pdo->errorInfo();
 			$uids=array();
-			while($r=mysql_fetch_object($query)) {
+			while($r=$query->fetch(PDO::FETCH_OBJ)) {
-				$uids[]=$r->usr_id;
+				$uids[]=$r->uid;
 			}
 
-		$q=mysql_query("SELECT * FROM fundraising_campaigns
+		$q=$pdo->prepare("SELECT * FROM fundraising_campaigns
 				WHERE fiscalyear='{$config['FISCALYEAR']}' 
 				ORDER BY name");
+		$q->execute();
 		$str="";
 		echo "<select id=\"fundraising_campaign_id\" name=\"fundraising_campaigns_id\" onchange=\"campaignchange()\">";
 		echo "<option value=\"\">".i18n("Choose an appeal")."</option>\n";
-		while($r=mysql_fetch_object($q)) {
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 				//if there's uids, we can check if this sponsor is in the campaign
 				//if there's no uids, (aka no contacts) then there's no way we could have included them in a cmomunication
 				//but they could still get here fors ome reason, so we still need to show all the campaigns
 
 				if(count($uids)) {
-					$tq=mysql_query("SELECT * FROM fundraising_campaigns_users_link
+					$tq=$pdo->prepare("SELECT * FROM fundraising_campaigns_users_link
 						WHERE fundraising_campaigns_id='$r->id'
 						AND users_uid IN (".implode(",",$uids).")
 						");
-					if(mysql_num_rows($tq)) {
+					$tq->execute();
+					if($tq->rowCount()) {
 						$incampaign=i18n("*In Appeal*").": ";
 					}
 					else $incampaign="";
@@ -271,8 +282,9 @@ switch($_GET['action']) {
 		echo "<option value=\"\">".i18n("Choose a purpose")."</option>\n";
 		//FIXME: only show campaigns that they were included as part of
 		//we need a campaigns_users_link or campaigns_sponsors_link or something
-		$q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+		$q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
-		while($r=mysql_fetch_object($q)) {
+		$q->execute();
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<option value=\"$r->goal\">$r->name</option>\n";
 		}
 
@@ -351,12 +363,12 @@ switch($_GET['action']) {
 	case 'newcontactsearch':
 
 		if($_POST['email'])
-		$q=mysql_query("SELECT *, MAX(id) FROM users WHERE email='".trim($_POST['email'])."' GROUP BY accounts_id HAVING deleted='no'");
+		$q=$pdo->prepare("SELECT *,MAX(year) FROM users WHERE email='".trim($_POST['email'])."' GROUP BY uid HAVING deleted='no'");
-
+		$q->execute();
-		if($r=mysql_fetch_object($q)) {
+		if($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo i18n("There is an exact email address match for %1",array($_POST['email']));
 			echo "<ul>";
-			echo "<li><a href=\"#\" onclick=\"useexistingcontact($r->accounts_id)\">$r->firstname $r->lastname $r->email $r->phonehome</a></li>\n";
+			echo "<li><a href=\"#\" onclick=\"useexistingcontact($r->uid)\">$r->firstname $r->lastname $r->email $r->phonehome</a></li>\n";
 			echo "</ul>";
 
 			?>
@@ -380,16 +392,17 @@ switch($_GET['action']) {
 			if($_POST['email'])
 				$searchstr.=" AND email LIKE '%".$_POST['email']."%'";
 
-			$q=mysql_query("SELECT *, MAX(id) FROM users WHERE $searchstr GROUP BY accounts_id HAVING deleted='no'");
+			$q=$pdo->prepare("SELECT *,MAX(year) FROM users WHERE $searchstr GROUP BY uid HAVING deleted='no'");
-			$num=mysql_num_rows($q);
+			$q->execute();
+			$num=$q->rowCount();
 			if($num==0) {
 				echo i18n("No existing users match, will create a new user");
 			}
 			else if($num<15) {
 				echo i18n("Did you mean one of these existing users? (click to choose one)")."<br />";
 				echo "<ul>";
-				while($r=mysql_fetch_object($q)) {
+				while($r=$q->fetch(PDO::FETCH_OBJ)) {
-					echo "<li><a href=\"#\" onclick=\"useexistingcontact($r->accounts_id)\">$r->firstname $r->lastname $r->email $r->phonehome</a></li>\n";
+					echo "<li><a href=\"#\" onclick=\"useexistingcontact($r->uid)\">$r->firstname $r->lastname $r->email $r->phonehome</a></li>\n";
 				}
 				echo "</ul>";
 			}
@@ -409,22 +422,23 @@ switch($_GET['action']) {
 		$datereceived=$_POST['datereceived'];
 
 		if($goal && $value && $supporttype) {
-			mysql_query("INSERT INTO fundraising_donations (sponsors_id,fundraising_goal,fundraising_campaigns_id,value,status,probability,fiscalyear,thanked,datereceived,supporttype) VALUES (
+			$q = $pdo->prepare("INSERT INTO fundraising_donations (sponsors_id,fundraising_goal,fundraising_campaigns_id,value,status,probability,fiscalyear,thanked,datereceived,supporttype) VALUES (
 			'$sponsorid',
-			'".mysql_real_escape_string($goal)."',
+			'".$goal."',
 			'$campaignid',
 			'$value',
 			'received',
 			'100',
 			'{$config['FISCALYEAR']}',
 			'no',
-			'".mysql_real_escape_string($datereceived)."',
+			'".$datereceived."',
-			'".mysql_real_escape_string($supporttype)."'
+			'".$supporttype."'
 			)");
-			$id=mysql_insert_id();
+			$q->execute();
+			$id=$pdo->lastInsertId();
 			$logStr=getDonationString($id);
 			save_activityinfo("Added donation/sponsorship: $logStr", $sponsorid, $_SESSION['users_uid'],"System");
-			echo mysql_error();
+			echo $pdo->errorInfo();
 
 			happy_("Donation/sponsorship added");
 		} else {
@@ -440,8 +454,9 @@ switch($_GET['action']) {
 		if($logStr=getDonationString($id)) {
 			save_activityinfo("Removed donation/sponsorship: $logStr", $sponsorid, $_SESSION['users_uid'],"System");
 			happy_("Donation/sponsorship removed");
-			mysql_query("DELETE FROM fundraising_donations WHERE id='$id' AND sponsors_id='$sponsorid'");
+			$q = $pdo->prepare("DELETE FROM fundraising_donations WHERE id='$id' AND sponsors_id='$sponsorid'");
-			echo mysql_error();
+			$q->execute();
+			echo $pdo->errorInfo();
 		}
 		else {
 			error_("Invalid donation/sponsorship to remove");
@@ -460,8 +475,9 @@ send_header("Donor/Sponsor Management",
 function delete_contact(){
 	if(array_key_exists('userid', $_POST)){
 		$uid = $_POST['userid'];
-		$data = mysql_query("SELECT CONCAT_WS(' ', users.firstname, users.lastname) AS name FROM users WHERE id=" . $uid);
+		$data = $pdo->prepare("SELECT CONCAT_WS(' ', users.firstname, users.lastname) AS name FROM users WHERE id=" . $uid);
-		$namedata = mysql_fetch_array($data);
+		$data->execute();
+		$namedata = $data->fetch();
 		$name = trim($namedata['name']);
 		user_delete($uid,"sponsor");
 		happy_("Deleted contact %1", array($name));
@@ -472,13 +488,13 @@ function delete_contact(){
 }
 
 function addexisting_contact() {
-	$accid = intval($_POST['accounts_id']);
+	$uid=intval($_POST['uid']);
-	$sponsors_id = intval($_POST['id']);
+	$sponsors_id=intval($_POST['id']);
-	echo "Linking accounts_id=$accid to sponsors_id=$sponsors_id <br />";
+	echo "Linking uid=$uid to sponsors_id=$sponsors_id <br />";
 
-//	echo "uid $uid has users.id {$u['id']}";
+	echo "uid $uid has users.id {$u['id']}";
 
-	$u=user_load_by_accounts_id($accid);
+	$u=user_load_by_uid($uid);
 	$u['sponsors_id']=$sponsors_id;
 	$u['types'][]="sponsor";
 	user_save($u);
@@ -497,8 +513,9 @@ function save_contact(){
 		if($_POST['recordtype'] == 'new'){
 
 			if($_POST['email']) {
-				$q=mysql_query("SELECT *,MAX(id) FROM users WHERE email='".trim($_POST['email'])."' GROUP BY accounts_id HAVING deleted='no'");
+				$q=$pdo->prepare("SELECT *,MAX(year) FROM users WHERE email='".trim($_POST['email'])."' GROUP BY uid HAVING deleted='no'");
-				if(mysql_num_rows($q)) {
+				$q->execute();
+				if($q->rowCount()) {
 					error_("A user with that email address already exists");
 					exit;
 				}
@@ -507,11 +524,8 @@ function save_contact(){
 			// this is a new record being submitted.  Create the user.
 			$successMessage = "Contact created successfully";
 			$successLog = "Added contact ";
-			$acc = account_create($_POST['email']);
+			$u = user_create("sponsor", $_POST['email']);
-			$accid = $acc['id'];
+			$id = $u['id'];
-			$usr = user_create($accid);
-			user_add_role($usr, 'sponsor');
-			//sponsor
 		}else if($_POST['recordtype'] == 'existing'){
 			// this is an existing record being updated.  Load the user.
 			$successMessage = "Contact updated successfully";
@@ -525,25 +539,25 @@ function save_contact(){
 		$p = ($_POST['primary']=='yes')?'yes':'no';
 		if($p == 'no') {
 			/* Make sure this sponsor ($sponsor_id) has a primary */
-			$query = "SELECT users.id 
+			$query = "SELECT users_id 
-				FROM users
+				FROM users_sponsor, users 
-				JOIN user_roles ON users_roles.users_id = users.id
-				JOIN roles ON roles.id = user_roles.id
 				WHERE
-				roles.type = 'sponsor'
+				users_sponsor.users_id=users.id
-				AND users.sponsors_id='$sponsor_id'
+				AND sponsors_id='$sponsor_id'
-				AND users.`primary`='yes'
+				AND `primary`='yes'
-				AND users.conferences_id = '{$conference['id']}'
+				AND year='".$config['FAIRYEAR']."'
-				AND users.id != '$id'";
+				AND users_id!='$id'";
-			$q = mysql_query($query);
+			$q = $pdo->prepare($query);
-			if(mysql_num_rows($q) == 0) {
+			$q->execute();
+			if($q->rowCount() == 0) {
 				/* This has to be the primary since there isn't one already */
 				$p = 'yes';
 			}
 		} else {
 			/* Unset all other primaries */
-			mysql_query("UPDATE users_sponsor SET `primary`='no'
+			$q=$pdo->prepare("UPDATE users_sponsor SET `primary`='no'
 					WHERE sponsors_id='$sponsor_id' AND users_id != '$id'");
+			$q->execute();
 		}
 
 		// we now know whether or not they're the primary user.  Update them with that,
@@ -604,20 +618,20 @@ function draw_contactsinfo_form($contact = null){
 	// start our accordion
 	echo "<div id=\"contactaccordion\" style=\"width: 740px;\">\n";
 
-	// loop through each contact and draw a form with their data in it.
-	$query = mysql_query("
-		SELECT *, MAX(conferences_id)
-		FROM users
-		JOIN user_roles ON user_roles.users_id = users.id
-		JOIN roles ON roles.id = user_roles.id
-		WHERE roles.type = 'sponsor'
-		AND users.sponsors_id = '" . $sponsor_id . "'
-		GROUP BY conferences_id
-		HAVING deleted = 'no'
-		ORDER BY `primary` DESC , lastname, firstname
-	");
 
-	while($contact = mysql_fetch_array($query)){
+	// loop through each contact and draw a form with their data in it.
+	$query = $pdo->prepare("SELECT *,MAX(year) FROM users LEFT JOIN users_sponsor ON users_sponsor.users_id=users.id
+	WHERE 
+	sponsors_id='" . $sponsor_id . "' 
+	AND types LIKE '%sponsor%'
+	GROUP BY uid
+	HAVING deleted='no' 
+	ORDER BY users_sponsor.primary DESC,lastname,firstname
+	");
+	$query->execute();
+	echo $pdo->errorInfo();
+
+	while($contact = $query->fetch()){
 		// draw a header for this user
 		echo "<h3><a href=\"#\">";
 		echo $contact["firstname"] . " " . $contact["lastname"];
@@ -646,18 +660,20 @@ function draw_contactsinfo_form($contact = null){
 
 // draw a form in which to enter information about the various contacts
 function draw_contact_form($sponsor_id, $contact = null){
+	global $salutations;
 	global $config;
 
 	//grab the sponsor details, so we can do diff things for individual vs organization
-	$q=mysql_query("SELECT * FROM sponsors WHERE id='$sponsor_id'");
+	$q=$pdo->prepare("SELECT * FROM sponsors WHERE id='$sponsor_id'");
-	$sponsor=mysql_fetch_object($q);
+	$q->execute();
+	$sponsor=$q->fetch(PDO::FETCH_OBJ);
 
 	if($contact != null){
 		$id = $contact["id"];
 	}else{
 		$id = "new";
 		if($sponsor->donortype=="individual") {
-			list($firstname,$lastname)=explode(" ",$sponsor->organization,2);
+			list($firstname,$lastname)=split(" ",$sponsor->organization,2);
 			$contact['firstname']=$firstname;
 			$contact['lastname']=$lastname;
 			$contact['email']=$sponsor->email;
@@ -691,7 +707,14 @@ function draw_contact_form($sponsor_id, $contact = null){
 		<tr>
 			<td><?=i18n("Salutation"); ?></td>
 			<td>
-			<input name="salutation" type="text" value="<?=htmlspecialchars($contact['salutation'])?>">
+			<select name="salutation">
+			<option value=""><?=i18n("Choose")?></option>
+			<?
+			foreach($salutations AS $salutation) {
+				if($contact['salutation']==$salutation) $sel="selected=\"selected\""; else $sel="";
+				echo "<option $sel value=\"$salutation\">$salutation</option>\n";
+			}
+			?>
 			</select>
 			</td>
 			<td><?=i18n("Position"); ?></td>
@@ -738,7 +761,7 @@ function draw_contact_form($sponsor_id, $contact = null){
 
 		<tr>
 			<td><?=i18n("Notes"); ?></td>
-			<td colspan="3"><textarea name="notes" cols="60" rows="8"><?=htmlspecialchars($contact['notes'])?></textarea></td>
+			<td colspan="3"><textarea name="notes" cols="60" rows="4"><?=htmlspecialchars($contact['notes'])?></textarea></td>
 		</tr>
 		<tr>
 			<td><?=i18n("Primary Contact")?></td>
@@ -791,10 +814,11 @@ function draw_activityinfo_form(){
 			</td>
 			<td align="center">
 <?php
-				$q=mysql_query("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+				$q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+				$q->execute();
 				echo "<select name=\"fundraising_campaigns_id\">";
 				echo "<option value=\"\">".i18n("Choose Appeal")."</option>\n";
-				while($r=mysql_fetch_object($q)) {
+				while($r=$q->fetch(PDO::FETCH_OBJ)) {
 					echo "<option value=\"$r->id\">$r->name</option>\n";
 				}
 				echo "</select>\n";
@@ -812,12 +836,13 @@ function draw_activityinfo_form(){
 		  FROM fundraising_donor_logs AS fdl 
 		  LEFT JOIN users ON fdl.users_id=users.id 
 		  LEFT JOIN fundraising_campaigns ON fdl.fundraising_campaigns_id=fundraising_campaigns.id
-		  WHERE fdl.sponsors_id=" . $sponsorid. " ORDER BY dt DESC";
+		  WHERE sponsors_id=" . $sponsorid. " ORDER BY dt DESC";
-//	echo "<tr><td colspan=\"4\">" . $query . "</td></tr>";
+	//echo "<tr><td colspan=\"3\">" . $query . "</td></tr>";
-	$q = mysql_query($query);
+	$q = $pdo->prepare($query);
-	echo mysql_error();
+	$q->execute();
-	if(mysql_num_rows($q)) {
+	echo $pdo->errorInfo();
-		while($r = mysql_fetch_array($q)) {
+	if($q->rowCount()) {
+		while($r = $q->fetch()) {
 			echo "<tr><td>" . $r["dt"] . "</td>";
 			echo "<td>" . $r["name"] . "</td>";
 			echo "<td>" . $r["type"] . "</td>";
@@ -843,25 +868,27 @@ function save_activityinfo($comment, $donorId, $userId, $type, $campaign_id=null
 		VALUES ($donorId,
 		NOW(),
 		$userId,
-		'".mysql_real_escape_string($comment)."',
+		'".$comment."',
-		'".mysql_real_escape_string($type)."',
+		'".$type."',
 		$cid)";
-	mysql_query($query);
+	$q = $pdo->prepare($query);
-	echo mysql_error();
+	$q->execute();
+	echo $pdo->errorInfo();
 }
 
 function getDonationString($id) {
 	global $config;
-	$q=mysql_query("SELECT fundraising_donations.*, 
+	$q=$pdo->prepare("SELECT fundraising_donations.*, 
 		fundraising_campaigns.name AS campaignname 
 		FROM fundraising_donations 
 		LEFT JOIN fundraising_campaigns ON fundraising_donations.fundraising_campaigns_id=fundraising_campaigns.id 
 		WHERE fundraising_donations.id='$id' 
 		AND fundraising_donations.fiscalyear='{$config['FISCALYEAR']}' 
 		");
-	echo mysql_error();
+	$q->execute();
+	echo $pdo->errorInfo();
 	$str="";
-	if($r=mysql_fetch_object($q)) {
+	if($r=$q->fetch(PDO::FETCH_OBJ)) {
 		$str.=format_date($r->datereceived)." - ";
 		$goal=getGoal($r->fundraising_goal);
 		if($goal) {
@@ -1049,9 +1076,9 @@ function update_contactsinfo()
 	);
 }
 
-function contactsinfo_save(accounts_id) {
+function contactsinfo_save(uid) {
 	var id=sponsor_id;		
-	$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=contactsinfo_save&id="+id, $("#contact_" + accounts_id).serializeArray(),
+	$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=contactsinfo_save&id="+id, $("#contact_" + uid).serializeArray(),
 	function() {
 		$("#contactaccordion").accordion();
 		update_contactsinfo();
@@ -1059,9 +1086,9 @@ function contactsinfo_save(accounts_id) {
 	return false;
 }
 
-function contactsinfo_delete(accounts_id) {
+function contactsinfo_delete(uid) {
 	var id=sponsor_id;		
-	$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=contactsinfo_delete&id="+id, $("#contact_" + accounts_id).serializeArray(),
+	$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=contactsinfo_delete&id="+id, $("#contact_" + uid).serializeArray(),
 	function() {
 		$("#contactaccordion").accordion();
 		update_contactsinfo();
@@ -1111,9 +1138,9 @@ function donewcontactsearch() {
 		$("#newcontactsearch").load("<?=$_SERVER['PHP_SELF']?>?action=newcontactsearch",$("#contact_new").serializeArray());
 }
 
-function useexistingcontact(accounts_id) {
+function useexistingcontact(uid) {
 	var id=sponsor_id;		
-	$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=contactsinfo_addexisting",{id: id, accounts_id: accounts_id} ,function() { update_contactsinfo(); });
+	$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=contactsinfo_addexisting",{id: id, uid: uid} ,function() { update_contactsinfo(); });
 }
 
 function togglefulldonationhistory() {
@@ -1236,7 +1263,7 @@ echo "<hr />";
 			</td></tr>
 			*/
 ?>
-			<tr><td><?=i18n("Notes")?></td><td colspan="5"><textarea id="organizationinfo_notes" name="notes" rows="8" cols="60"></textarea></td></tr>
+			<tr><td><?=i18n("Notes")?></td><td colspan="5"><textarea id="organizationinfo_notes" name="notes" rows="4" cols="60"></textarea></td></tr>
 			</table>
 			<input id="organizationinfo_save_button" type="submit" value="<?=i18n("Save")?>" onClick="return organizationinfo_save()" />
 			</form>

admin/donors_search.php

@@ -24,13 +24,13 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  echo "<br />\n";
 
 		//$q=mysql_query("SELECT * FROM award_sponsors WHERE year='".$config['FAIRYEAR']."' ORDER BY organization");
 		//we want to show all years, infact that year field probably shouldnt even be there.
 		$sql="";
-		if($_POST['search']) $sql.=" AND organization LIKE '%".mysql_real_escape_string($_POST['search'])."%' ";
+		if($_POST['search']) $sql.=" AND organization LIKE '%".$_POST['search']."%' ";
 		if(count($_POST['donortype'])) {
 			$sql.=" AND (0 ";
 			foreach($_POST['donortype'] AS $d) {
@@ -40,19 +40,22 @@
 		}
 		$query="SELECT * FROM sponsors WHERE 1 $sql ORDER BY organization";
 //		echo "query=$query";
-		$q=mysql_query($query);
+		$q=$pdo->prepare($query);
+		$q->execute();
 
 		$thisyear=$config['FISCALYEAR'];
 		$lastyear=$config['FISCALYEAR']-1;
 		$rows=array();
 
-		while($r=mysql_fetch_object($q))
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 		{
-			$cq=mysql_query("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='$r->id' AND status='received' AND fiscalyear='$thisyear'");
+			$cq=$pdo->prepare("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='$r->id' AND status='received' AND fiscalyear='$thisyear'");
-			$cr=mysql_fetch_object($cq);
+			$cq->execute();
+			$cr=$cq->fetch(PDO::FETCH_OBJ);
 			$thisyeartotal=$cr->total;
-			$cq=mysql_query("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='$r->id' AND status='received' AND fiscalyear='$lastyear'");
+			$cq=$pdo->prepare("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='$r->id' AND status='received' AND fiscalyear='$lastyear'");
-			$cr=mysql_fetch_object($cq);
+			$cq->execute();
+			$cr=$cq->fetch(PDO::FETCH_OBJ);
 			$lastyeartotal=$cr->total;
 			if($lastyeartotal)
 				$change=round(($thisyeartotal-$lastyeartotal)/$lastyeartotal*100);

admin/events.php

@@ -1,91 +0,0 @@
-<?
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
-   Copyright (C) 2005 James Grant <james@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?
- require("../common.inc.php");
- require("../tableeditor.class.php");
- require_once("../user.inc.php");
- user_auth_required('admin');
-
- send_header("Events Management", 
- 	array('Committee Main' => 'committee_main.php',
-		'Administration' => 'admin/index.php',
-		'Events & Scheduling' => 'admin/eventsscheduling.php'),
-        "events_scheduling" );
-
-echo "<br />";
-
-$editor = new TableEditor('events',
-	array(
-		"name" => "Event Name",
-		"eventtype" => "Type",
-		"suggested_grades" => "Suggested Grades",
-	),
-	array(
-		"name" => "Event Name",
-		"eventtype" => "Type",
-		"summary" => "Summary",
-		"website" => "Link to Description",
-		"suggested_grades" => "Suggested Grades",
-		"default_min_teams" => "Minimum Number of Teams",
-		"default_max_teams" => "Maximum Number of Teams",
-		"default_min_team_size" => "Minimum Team Size",
-		"default_max_team_size" => "Maximum Team Size",
-		"default_min_judges" => "Minimum Number of Judges",
-		"default_max_judges" => "Maximum Number of Judges",
-		"default_min_volunteers" => "Minimum Number of Volunteers",
-		"default_max_volunteers" => "Maximum Number of Volunteers"
-	),
-	array(
-		"conferences_id" => $conference['id']
-	)
-);
-$eventtypes=array( 	array('key'=>"general", 'val'=>"General"),
-					array('key'=>"scienceolympic", 'val'=>"Science Olympics Activity"),
-					array('key'=>"sciencefairjudging", 'val'=>"Science Fair Judging"),
-					array('key'=>"tour", 'val'=>"Tour")
-					);
-
-$editor->setFieldOptions("eventtype",$eventtypes);
-$editor->setPrimaryKey("id");
-$editor->setRecordType("Event");
-$editor->setDefaultSortField("eventtype,name");
-$editor->filterList("conferences_id", $conference['id']);
-
-$editor->setFieldDefaultValue("default_min_teams",1);
-$editor->setFieldDefaultValue("default_max_teams",4);
-
-$editor->setFieldDefaultValue("default_min_team_size",1);
-$editor->setFieldDefaultValue("default_max_team_size",6);
-
-$editor->setFieldDefaultValue("default_min_judges",1);
-$editor->setFieldDefaultValue("default_max_judges",2);
-
-$editor->setFieldDefaultValue("default_min_volunteers",1);
-$editor->setFieldDefaultValue("default_max_volunteers",5);
-
-$editor->execute();
-
-send_footer();
-
-?>

admin/eventsscheduling.php

@@ -1,41 +0,0 @@
-<?
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
-   Copyright (C) 2005 James Grant <james@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?
- require("../common.inc.php");
- require_once("../user.inc.php");
- user_auth_required('admin');
-
- send_header("Events &amp; Scheduling", 
- 	array('Committee Main' => 'committee_main.php',
-		'Administration' => 'admin/index.php'),
-        "events_scheduling" );
-
- echo "<br />";
- echo "<a href=\"locations.php\">".i18n('Event Locations')."</a><br />";
- echo "<a href=\"events.php\">".i18n('Event Management')."</a><br />";
- echo "<a href=\"schedule.php\">".i18n('Schedule Management')."</a><br />";
-
- send_footer();
-
-?>

admin/exhibithall_sa.php

@@ -172,9 +172,10 @@ TRACE("<pre>\n");
 
 /* Load exhibit halls */
 $exhibithall = array();
-$q = mysql_query("SELECT * FROM exhibithall WHERE type='exhibithall'");
+$q = $pdo->prepare("SELECT * FROM exhibithall WHERE type='exhibithall'");
+$q->execute();
 TRACE("Loading exhibit halls...\n");
-while(($r = mysql_fetch_assoc($q))) {
+while(($r = $q->fetch(PDO::FETCH_ASSOC))) {
 	$r['divs'] = unserialize($r['divs']);
 	$r['cats'] = unserialize($r['cats']);
 	$exhibithall[$r['id']] = $r;
@@ -183,9 +184,10 @@ while(($r = mysql_fetch_assoc($q))) {
 
 /* Load objects */
 $objects = array();
-$q = mysql_query("SELECT * FROM exhibithall WHERE type='wall' OR type='project'");
+$q = $pdo->prepare("SELECT * FROM exhibithall WHERE type='wall' OR type='project'");
+$q->execute();
 TRACE("Loading objects...\n");
-while(($r = mysql_fetch_assoc($q))) {
+while(($r = $q->fetch([PDO::FETCH_ASSOC]))) {
 	$r['divs'] = unserialize($r['divs']);
 	$r['cats'] = unserialize($r['cats']);
 	$objects[$r['id']] = $r;
@@ -215,8 +217,9 @@ TRACE("Grid size: {$grid_size}m\n");
 
 $div = array();
 TRACE("Loading Project Divisions...\n");
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conference['id']}' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='{$config['FAIRYEAR']}' ORDER BY id");
-while($r=mysql_fetch_object($q))
+while($r=$q->fetch(PDO::FETCH_OBJ))
+{
 {
 	$divshort[$r->id]=$r->division_shortform;
 	$div[$r->id]=$r->division;
@@ -225,8 +228,9 @@ while($r=mysql_fetch_object($q))
 
 TRACE("Loading Project Age Categories...\n");
 $cat = array();
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='{$conference['id']}' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='{$config['FAIRYEAR']}' ORDER BY id");
-while($r=mysql_fetch_object($q)) {
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ) {
 	$catshort[$r->id]=$r->category_shortform;
 	$cat[$r->id]=$r->category;
 	TRACE("   {$r->id} - {$r->category}\n");
@@ -234,17 +238,19 @@ while($r=mysql_fetch_object($q)) {
 
 TRACE("Loading Projects...\n");
 $projects = array();
-$q = mysql_query("SELECT projects.* FROM projects, registrations 
+$q = $pdo->prepare("SELECT projects.* FROM projects, registrations 
 				WHERE
-					projects.conferences_id='{$conference['id']}' 
+					projects.year='{$config['FAIRYEAR']}' 
 					AND registrations.id = projects.registrations_id
 				".getJudgingEligibilityCode());
-while($p = mysql_fetch_object($q)) {
+$q->execute();
-	$qq = mysql_query("SELECT grade,schools_id FROM students WHERE registrations_id='{$p->registrations_id}'");
+while($p = $q->fetch(PDO::FETCH_OBJ)) {
-	$num_students = mysql_num_rows($qq);
+	$qq = $pdo->prepare("SELECT grade,schools_id FROM students WHERE registrations_id='{$p->registrations_id}'");
+	$qq->execute();
+	$num_students = $qq->rowCouunt();
 	$grade = 0;
 	$schools_id = 0;
-	while($s = mysql_fetch_assoc($qq)) {
+	while($s = $qq->fetch(PDO::FETCH_ASSOC)) {
 		if($s['grade'] > $grade) {
 			$grade = $s['grade'];
 			$schools_id = $s['schools_id'];
@@ -271,7 +277,8 @@ if($action == 'pn') {
 		$n = sprintf("%03d", $p['floornumber']);
 		$pn = "$c $n $d";
 		TRACE("Project {$p['projects_id']} at loc {$p['floornumber']}: $pn\n");
-		mysql_query("UPDATE projects SET projectnumber='$pn' WHERE id='{$p['projects_id']}'");
+		$q=$pdo->prepare("UPDATE projects SET projectnumber='$pn' WHERE id='{$p['projects_id']}'");
+		$q->execute();
 	}
 	TRACE("Done.\n");
 	exit;
@@ -597,10 +604,12 @@ for($x=0;$x<$a->num_buckets; $x++) {
 print_r($projects);
 
 /* Assign floor numbers */
-mysql_query("UPDATE projects SET floornumber=0 WHERE conferences_id='{$conference['id']}'");
+$q = $pdo->prepare("UPDATE projects SET floornumber=0 WHERE year='{$config['FAIRYEAR']}'");
+$q->execute();
 
 foreach($projects as $pid=>$p) {
-	mysql_query("UPDATE projects SET floornumber='{$p['floornumber']}' WHERE id='$pid'");
+	$q=$pdo->prepare("UPDATE projects SET floornumber='{$p['floornumber']}' WHERE id='$pid'");
+	$q->execute();
 	TRACE("Project $pid => Floor number {$p['floornumber']}\n");
 }
 

admin/export_checkin.php

@@ -24,21 +24,22 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
 
-$catq=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='".$conference['id']."' AND id='".$_GET['cat']."'");
+$catq=$pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' AND id='".$_GET['cat']."'");
-if($catr=mysql_fetch_object($catq))
+$catq->execute();
+if($catr=$catq->fetch(PDO::FETCH_OBJ))
 {
 
  	$pdf=new lpdf(	i18n($config['fairname']),
 			i18n("Checkin List")." - ".i18n($catr->category),
-			$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']-logo-200.gif"
+			$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 			);
 
 	$pdf->newPage();
 	$pdf->setFontSize(11);
-	$q=mysql_query("SELECT  registrations.id AS reg_id,
+	$q=$pdo->prepare("SELECT  registrations.id AS reg_id,
 				registrations.num AS reg_num,
 				registrations.status,
 				projects.title,
@@ -48,13 +49,14 @@ if($catr=mysql_fetch_object($catq))
 				registrations
 				left outer join projects on projects.registrations_id=registrations.id
 			WHERE
-				registrations.conferences_id='".$conference['id']."' 
+				registrations.year='".$config['FAIRYEAR']."' 
 				AND ( registrations.status='complete' OR registrations.status='paymentpending' )
 				AND projects.projectcategories_id='$catr->id'
 			ORDER BY
 				projects.title
 			");
-		echo mysql_error();
+		$q->execute();
+		echo $pdo->errorInfo();
 
 	$table=array();
 
@@ -72,22 +74,24 @@ if($catr=mysql_fetch_object($catq))
 		$table['dataalign']=array("left","left","left","center");
 
 	}
-	while($r=mysql_fetch_object($q))
+	while($r=$q->fetch(PDO::FETCH_OBJ))
 	{
-		$divq=mysql_query("SELECT division,division_shortform FROM projectdivisions WHERE conferences_id='".$conference['id']."' AND id='".$r->projectdivisions_id."'");
+		$divq=$pdo->prepare("SELECT division,division_shortform FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' AND id='".$r->projectdivisions_id."'");
-		$divr=mysql_fetch_object($divq);
+		$divq->execute();
+		$divr=$divq->fetch(PDO::FETCH_OBJ);
 
-		$sq=mysql_query("SELECT students.firstname,
+		$sq=$pdo->prepare("SELECT students.firstname,
 					students.lastname
 				FROM
 					students
 				WHERE
 					students.registrations_id='$r->reg_id'
 				");
+		$sq->execute();
 
 		$students="";
 		$studnum=0;
-		while($studentinfo=mysql_fetch_object($sq))
+		while($studentinfo=$sq->fetch(PDO::FETCH_OBJ))
 		{
 			if($studnum>0) $students.=", ";
 			$students.="$studentinfo->firstname $studentinfo->lastname";

admin/fair_stats.php

@@ -24,15 +24,16 @@
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require_once('xml.inc.php');
  require_once('stats.inc.php');
  require_once('curl.inc.php');
 
  /* Hack so we can jump right to YSC stats */
  if($_GET['abbrv'] == 'YSC') {
- 	$q = mysql_query("SELECT id FROM fairs WHERE abbrv='YSC'");
+ 	$q = $pdo->prepare("SELECT id FROM fairs WHERE abbrv='YSC'");
-	$r = mysql_fetch_assoc($q);
+	$q->execute();
+	$r = $q->fetch(PDO::FETCH_ASSOC);
 	$_GET['id'] = $r['id'];
  }
 
@@ -92,8 +93,9 @@
  else $fairs_id = -1;
 
  if($fairs_id != -1) {
- 	$q = mysql_query("SELECT * FROM fairs WHERE id='$fairs_id'");
+ 	$q = $pdo->prepare("SELECT * FROM fairs WHERE id='$fairs_id'");
-	$fair = mysql_fetch_assoc($q);
+	$q->execute();
+	$fair = $q->fetch(PDO::FETCH_ASSOC);
  }
 
  $action = $_POST['action'];
@@ -134,19 +136,21 @@
 
 
  echo "<form name=\"fairselect\" action=\"$PHPSELF\" method=\"get\">";
- $q=mysql_query("SELECT * FROM fairs WHERE `type`='sfiab' OR `type`='ysc' AND enable_stats='yes'");
+ $q = $pdo->prepare("SELECT * FROM fairs WHERE `type`='sfiab' OR `type`='ysc' AND enable_stats='yes'");
+ $q->execute();
  echo "<select name=\"id\">";
  echo "<option value=\"\">".i18n("Choose a destination")."</option>\n";
- while($r=mysql_fetch_object($q)) {
+ while($r=$q->fetch(PDO::FETCH_OBJ)) {
  	if($fairs_id==$r->id) $sel="selected=\"selected\""; else $sel="";
  	echo "<option $sel value=\"{$r->id}\">{$r->name} ({$r->abbrv})</option>\n";
  }
  echo "</select>\n";
 
- $q=mysql_query("SELECT DISTINCT(year) AS year FROM config WHERE year>0 ORDER BY year");
+ $q = $pdo->prepare("SELECT DISTINCT(year) AS year FROM config WHERE year>0 ORDER BY year");
+ $q->execute();
  echo "<select name=\"year\">";
  echo "<option value=\"\">".i18n("Choose a year")."</option>\n";
- while($r=mysql_fetch_object($q)) {
+ while($r=$q->fetch(PDO::FETCH_OBJ)) {
  	if($year==$r->year) $sel="selected=\"selected\""; else $sel="";
  	echo "<option $sel value=\"$r->year\">$r->year</option>\n";
  }
@@ -213,24 +217,26 @@
  /* And now, overwrite all the stuff we pulled down with stats we can compute */
 
  //number of schools
- $q=mysql_query("SELECT COUNT(id) AS num FROM schools WHERE year='$year'");
+ $q=$pdo->prepare("SELECT COUNT(id) AS num FROM schools WHERE year='$year'");
- $r=mysql_fetch_object($q);
+ $q->execute();
+ $r=$q->fetch(PDO::FETCH_OBJ);
  $stats['schools_total']=$r->num;
 
  //number of schools participating
- $q=mysql_query("SELECT DISTINCT(students.schools_id) AS sid, schools.*
+ $q=$pdo->prepare("SELECT DISTINCT(students.schools_id) AS sid, schools.*
  		 	FROM students 
 				LEFT JOIN registrations ON students.registrations_id=registrations.id 
 				LEFT JOIN schools ON students.schools_id=schools.id
 			WHERE students.year='$year' 
 				AND registrations.year='$year' 
 				AND (registrations.status='complete' OR registrations.status='paymentpending')");
- $stats['schools_active']=mysql_num_rows($q);
+	$q->execute();
+ $stats['schools_active']=$q->rowCount();
  $stats['schools_public'] = 0;
  $stats['schools_private'] = 0;
  $stats['schools_atrisk'] = 0;
  $districts = array();
- while($si=mysql_fetch_assoc($q)) {
+ while($si=$q->fetch(PDO::FETCH_ASSOC)) {
 	if($si['designate'] == 'public') 
 		 $stats['schools_public']++;
 	if($si['designate'] == 'independent') 
@@ -243,15 +249,16 @@
  $stats['schools_districts'] = count($districts);
 
  //numbers of students:
- $q=mysql_query("SELECT students.*,schools.* 
+ $q=$pdo->error("SELECT students.*,schools.* 
 	 		FROM students
 				LEFT JOIN registrations ON students.registrations_id=registrations.id 
 				LEFT JOIN schools on students.schools_id=schools.id
 			WHERE students.year='$year' 
 				AND registrations.year='$year' 
 				AND (registrations.status='complete' OR registrations.status='paymentpending')");
- echo mysql_error();
+$q->execute();
- $stats['students_total'] = mysql_num_rows($q);
+ echo $pdo->errorInfo();
+ $stats['students_total'] = $q->rowCount();
  $stats['students_public'] = 0;
  $stats['students_private'] = 0;
  $stats['students_atrisk'] = 0;
@@ -263,7 +270,7 @@
  	$stats["projects_$g"] = 0;
  }
  $unknown = array();
- while($s=mysql_fetch_assoc($q)) {
+ while($s=$q->fetch(PDO::FETCH_ASSOC)) {
  	if(!in_array($s['sex'], array('male','female'))) 
 		$unknown[$grademap[$s['grade']]]++;
 	else 
@@ -285,7 +292,7 @@
  }
 
  //projects
- $q=mysql_query("SELECT MAX(students.grade) AS grade FROM students
+ $q=$pdo->prepare("SELECT MAX(students.grade) AS grade FROM students
 	 		LEFT JOIN registrations ON students.registrations_id=registrations.id 
 			LEFT JOIN projects ON projects.registrations_id=registrations.id 
 		WHERE  students.year='$year' 
@@ -293,33 +300,31 @@
 			AND projects.year='$year' 
 			AND (registrations.status='complete' OR registrations.status='paymentpending') 
 			GROUP BY projects.id");
- echo mysql_error();
+$q->execute();
- while($r=mysql_fetch_assoc($q)) {
+ echo $pdo->errorInfo();
+ while($r=$q->fetch(PDO::FETCH_ASSOC)) {
 	$stats["projects_{$grademap[$r['grade']]}"]++;
  }
 
 
- $q=mysql_query("SELECT COUNT(users.id) AS num FROM users 
+ $q=$pdo->prepare("SELECT COUNT(id) AS num FROM users 
-	JOIN user_roles ON user_roles.users_id = users.id
+ 				LEFT JOIN users_committee ON users_committee.users_id=users.id
-	JOIN roles ON roles.id = user_roles.roles_id
+	 		WHERE types LIKE '%committee%' 
-	WHERE roles.type = 'committee'
+				AND year='$year' 
-	AND users.conferences_id = '{$conference['id']}'
+				AND users_committee.committee_active='yes'
-	AND users.deleted = 'no'");
+				AND deleted='no'");
-
+$q->execute();
- $r = mysql_fetch_object($q);
+ $r = $q->fetch(PDO::FETCH_OBJ);
  $stats['committee_members'] = $r->num;
 
- $q=mysql_query("
+ $q=$pdo->prepare("SELECT COUNT(id) AS num FROM users LEFT JOIN users_judge ON users_judge.users_id=users.id 
-	SELECT COUNT(users.id) AS num FROM users 
+ 					WHERE users.year='$year' 
-	JOIN user_roles ON user_roles.users_id = users.id
+						AND users.types LIKE '%judge%'
-	JOIN roles ON roles.id = user_roles.roles_id
+						AND users.deleted='no'
-	WHERE users.conferences_id = '{$conference['id']}'
+						AND users_judge.judge_complete='yes' 
-	AND users.deleted = 'no'
+						AND users_judge.judge_active='yes'");
-	AND roles.type = 'judge'
+$q->execute();
-	AND user_roles.complete='yes' 
+ $r=$q->fetch(PDO::FETCH_OBJ);
-	AND user_roles.active='yes'");
-
- $r=mysql_fetch_object($q);
  $stats['judges'] = $r->num;
 
 

admin/fair_stats_select.php

@@ -37,7 +37,7 @@
 		'delegates' => 'Delegate information/jacket size for CWSF',
 		);
 
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
 
  switch($_GET['action']) {
@@ -52,8 +52,9 @@
 		}
 	}
 	$s = join(',', $_POST['stats']);
-	$q = mysql_query("UPDATE fairs SET gather_stats='$s' WHERE id='$id'");
+	$q = $pdo->prepare("UPDATE fairs SET gather_stats='$s' WHERE id='$id'");
-	echo mysql_error();
+	$q->execute();
+	echo $pdo->errorInfo();
 	echo "UPDATE fairs SET gather_stats='$s' WHERE id='$id'";
 	happy_("Saved");
 	exit;
@@ -62,8 +63,9 @@
  /* Load the user we're editting */
  $u = user_load($_SESSION['embed_edit_id']);
  /* Load the fair attached to the user */
- $q = mysql_query("SELECT * FROM fairs WHERE id={$u['fairs_id']}");
+ $q = $pdo->prepare("SELECT * FROM fairs WHERE id={$u['fairs_id']}");
- $f = mysql_fetch_assoc($q);
+ $q->execute();
+ $f = $q->fetch(PDO::FETCH_ASSOC);
 
 ?>
 
@@ -92,7 +94,7 @@ function stats_save()
  <input type="hidden" name="fairs_id" value="<?=$f['id']?>" />
  <table class="editor">
 <?
- $selected_stats =  explode(',', $f['gather_stats']);
+ $selected_stats =  split(',', $f['gather_stats']);
  foreach($stats as $s=>$d) {
  	$ch = in_array($s, $selected_stats) ? 'checked="checked"' : '';
 	echo "<tr><td class=\"left\"><input type=\"checkbox\" id=\"stats_$s\" name=\"stats[]\" value=\"$s\" $ch /></td>";

admin/fix_judges_autocomplete.php

@@ -3,20 +3,24 @@
 require_once("../common.inc.php");
 require_once("../user.inc.php");
 
-user_auth_required('admin');
+user_auth_required('committee', 'admin');
 
-$q = mysql_query("SELECT * FROM judges WHERE passwordexpiry IS NULL");
+$q = $pdo->prepare("SELECT * FROM judges WHERE passwordexpiry IS NULL");
-while($i = mysql_fetch_object($q)) {
+$q->execute();
+while($i = $q->fetch(PDO::FETCH_OBJ)) {
 	echo "Autocompleting Judge {$i->email}<br />";
 	$id = $i->id;
 
 	$p = generatePassword(12);
-	mysql_query("UPDATE judges SET password='$p',complete='yes'");
+	$stmt = $pdo->prepare("UPDATE judges SET password='$p',complete='yes'");
-	echo mysql_error();
+	$stmt->execute();
-	mysql_query("DELETE FROM judges_years WHERE judges_id='$id'");
+	echo $pdo->errorInfo();
-	echo mysql_error();
+	$stmt = $pdo->prepare("DELETE FROM judges_years WHERE judges_id='$id'");
-	mysql_query("INSERT INTO judges_years (`judges_id`,`year`) VALUES ('$id','{$config['FAIRYEAR']}')");
+	$stmt->execute();
-	echo mysql_error();
+	echo $pdo->errorInfo();
+	$stmt = $pdo->prepare("INSERT INTO judges_years (`judges_id`,`year`) VALUES ('$id','{$config['FAIRYEAR']}')");
+	$stmt->execute();
+	echo $pdo->errorInfo();
 }
 
 ?>

admin/fundraising.php

@@ -24,15 +24,15 @@
  require("../common.inc.php");
  require_once("../user.inc.php");
 
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
 if($_GET['action']=="refresh") {
 ?>
 
 <h3><?=i18n("Fundraising Purposes and Progress Year to Date")?></h3>
 <?
-$q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY deadline");
+$q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY deadline");
-
+$q->execute();
 ?>
 <table class="tableview">
  <thead>
@@ -45,11 +45,12 @@ $q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISC
  </tr>
  </thead>
  <?
- while($r=mysql_fetch_object($q)) {
+ while($r=$q->fetch(PDO::FETCH_OBJ)) {
      //lookup all donations made towards this goal
-     $recq=mysql_query("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_goal='$r->goal' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
+     $recq=$pdo->prepare("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_goal='$r->goal' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
-     echo mysql_error();
+     $recq->execute();
-     $recr=mysql_fetch_object($recq);
+     echo $pdo->errorInfo();
+     $recr=$recq->fetch(PDO::FETCH_OBJ);
      $received=$recr->received;
      if($r->budget)
          $percent=round($received/$r->budget*100,1);
@@ -82,15 +83,18 @@ $q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISC
  </tr>
  </thead>
 <?
- $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}'");
+ $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}'");
+ $q->execute();
 
- while($r=mysql_fetch_object($q)) {
+ while($r=$q->fetch(PDO::FETCH_OBJ)) {
 
-    $goalq=mysql_query("SELECT * FROM fundraising_goals WHERE goal='{$r->fundraising_goal}' AND fiscalyear='{$config['FISCALYEAR']}'");
+    $goalq=$pdo->prepare("SELECT * FROM fundraising_goals WHERE goal='{$r->fundraising_goal}' AND fiscalyear='{$config['FISCALYEAR']}'");
-    $goalr=mysql_fetch_object($goalq);
+    $goalq->execute();
-    $recq=mysql_query("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_campaigns_id='$r->id' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
+    $goalr=$goalq->fetch(PDO:FETCH_OBJ);
-    echo mysql_error();
+    $recq=$pdo->prepare("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_campaigns_id='$r->id' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
-    $recr=mysql_fetch_object($recq);
+    $recq->execute();
+    echo $pdo->errorInfo();
+    $recr=$recq->fetch(PDO::FETCH_OBJ);
     $received=$recr->received;
     if($r->target)
         $percent=round($received/$r->target*100,1);
@@ -119,7 +123,7 @@ $q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISC
 <h3><?=i18n("To Do List")?></h3>
 <h4><?=i18n("Thank You's")?></h4>
 <?
-$q=mysql_query("SELECT id,value, thanked, status, sponsors_id, datereceived,
+$q=$pdo->prepare("SELECT id,value, thanked, status, sponsors_id, datereceived,
 	DATE_ADD(datereceived, INTERVAL 1 MONTH) < NOW() AS onemonth,
 	DATE_ADD(datereceived, INTERVAL 2 MONTH) < NOW() AS twomonth
     FROM fundraising_donations
@@ -127,9 +131,10 @@ $q=mysql_query("SELECT id,value, thanked, status, sponsors_id, datereceived,
     AND fiscalyear='{$config['FISCALYEAR']}' 
     ORDER BY datereceived
     ");
-echo mysql_error();
+$q->execute();
+echo $pdo->errorInfo();
 
-if(mysql_num_rows($q)) {
+if($q->rowCount()) {
     echo "<table class=\"tableview\">";
     echo "<thead><tr><th>".i18n("Name")."</th>\n";
     echo "<th>".i18n("Date Received")."</th>\n";
@@ -138,9 +143,10 @@ if(mysql_num_rows($q)) {
     echo "<th>".i18n("Thanked")."</th>\n";
     echo "</tr></thead>\n";
 
-    while($r=mysql_fetch_object($q)) {
+    while($r=$q->fetch(PDO::FETCH_OBJ)) {
-        $dq=mysql_query("SELECT organization AS name FROM sponsors WHERE id='$r->sponsors_id'");
+        $dq=$pdo->prepare("SELECT organization AS name FROM sponsors WHERE id='$r->sponsors_id'");
-        $dr=mysql_fetch_object($dq);
+        $dq->execute();
+        $dr=$dq->fetch(PDO::FETCH_OBJ);
 		if($r->twomonth) $s="style=\"background-color: ".colour_to_percent(0).";\"";
 		else if($r->onemonth) $s="style=\"background-color: ".colour_to_percent(50).";\"";
 		else $s="";
@@ -171,7 +177,7 @@ if(mysql_num_rows($q)) {
 <br />
 <h4><?=i18n("Receipts to Issue")?></h4>
 <?
-$q=mysql_query("SELECT value, receiptrequired, receiptsent, status, sponsors_id, datereceived,
+$q=$pdo->prepare("SELECT value, receiptrequired, receiptsent, status, sponsors_id, datereceived,
 	DATE_ADD(datereceived, INTERVAL 1 MONTH) < NOW() AS onemonth,
 	DATE_ADD(datereceived, INTERVAL 2 MONTH) < NOW() AS twomonth
     FROM fundraising_donations
@@ -179,8 +185,9 @@ $q=mysql_query("SELECT value, receiptrequired, receiptsent, status, sponsors_id,
     AND fiscalyear='{$config['FISCALYEAR']}' 
     ORDER BY datereceived
     ");
-echo mysql_error();
+$q->execute();
-if(mysql_num_rows($q)) {
+echo $pdo->errorInfo();
+if($q->rowCount()) {
     echo "<table class=\"tableview\">";
     echo "<tr><th>".i18n("Name")."</th>\n";
     echo "<th>".i18n("Date Received")."</th>\n";
@@ -188,9 +195,10 @@ if(mysql_num_rows($q)) {
     echo "<th>".i18n("Generate Receipt")."</th>\n";
     echo "</tr>\n";
 
-    while($r=mysql_fetch_object($q)) {
+    while($r=$q->fetch(PDO::FETCH_OBJ)) {
-        $dq=mysql_query("SELECT organization AS name FROM sponsors WHERE id='$r->sponsors_id'");
+        $dq=$pdo->prepare("SELECT organization AS name FROM sponsors WHERE id='$r->sponsors_id'");
-        $dr=mysql_fetch_object($dq);
+        $dq->execute();
+        $dr=$dq->fetch(PDO::FETCH_OBJ);
 		if($r->twomonth) $s="style=\"background-color: ".colour_to_percent(0).";\"";
 		else if($r->onemonth) $s="style=\"background-color: ".colour_to_percent(50).";\"";
 		else $s="";
@@ -213,16 +221,17 @@ if(mysql_num_rows($q)) {
 <br />
 <h4><?=i18n("Appeal Follow-Ups")?></h4>
 <?
-$q=mysql_query("SELECT * FROM fundraising_campaigns WHERE followupdate>=NOW() ORDER BY followupdate LIMIT 5");
+$q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE followupdate>=NOW() ORDER BY followupdate LIMIT 5");
-echo mysql_error();
+$q->execute();
-if(mysql_num_rows($q)) {
+echo $pdo->errorInfo();
+if($q->rowCount()) {
     echo "<table class=\"tableview\">";
     echo "<thead><tr>";
     echo " <th>".i18n("Appeal")."</th>\n";
     echo " <th>".i18n("Start Date")."</th>\n";
     echo " <th>".i18n("Follow-Up Date")."</th>\n";
     echo "</tr></thead>\n";
-    while($r=mysql_fetch_object($q)) {
+    while($r=$q->fetch(PDO::FETCH_OBJ)) {
         echo "<tr><td>$r->name</td><td>".format_date($r->startdate)."</td><td>".format_date($r->followupdate)."</td></tr>\n";
     }
     echo "</table>\n";
@@ -235,16 +244,17 @@ if(mysql_num_rows($q)) {
 <br />
 <h4>Upcoming Proposals</h4>
 <?
-$q=mysql_query("SELECT * FROM sponsors WHERE fundingselectiondate>=NOW() OR proposalsubmissiondate>=NOW() ORDER BY fundingselectiondate LIMIT 5");
+$q=$pdo->prepare("SELECT * FROM sponsors WHERE fundingselectiondate>=NOW() OR proposalsubmissiondate>=NOW() ORDER BY fundingselectiondate LIMIT 5");
-echo mysql_error();
+$q->execute();
-if(mysql_num_rows($q)) {
+echo $pdo->errorInfo();
+if($q->rowCount()) {
     echo "<table class=\"tableview\">";
     echo "<tr>";
     echo " <th>".i18n("Name")."</th>\n";
     echo " <th>".i18n("Proposal Submission Date")."</th>\n";
     echo " <th>".i18n("Funding Selection Date")."</th>\n";
     echo "</tr>\n";
-    while($r=mysql_fetch_object($q)) {
+    while($r=$q->fetch(PDO::FETCH_OBJ)) {
         echo "<tr><td>$r->organization</td>";
         echo "<td>".format_date($r->proposalsubmissiondate)."</td>";
         echo "<td>".format_date($r->fundingselectiondate)."</td>";
@@ -259,7 +269,8 @@ if(mysql_num_rows($q)) {
 }
 else if (count($_POST['thanked'])) {
 	foreach($_POST['thanked'] AS $t) {
-		mysql_query("UPDATE fundraising_donations SET thanked='yes' WHERE id='$t'");
+		$stmt = $pdo->prepare("UPDATE fundraising_donations SET thanked='yes' WHERE id='$t'");
+    $stmt->execute();
 	}
 }
  

admin/fundraising_campaigns.php

@@ -23,7 +23,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("fundraising_common.inc.php");
 
 switch($_GET['action']){
@@ -34,31 +34,22 @@ switch($_GET['action']){
 
    case "modify":
     echo "<div id=\"campaignaccordion\" style=\"width: 780px;\">\n";
-    $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+    $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
-    while($r=mysql_fetch_object($q)) {
+   $q->execute();
-        echo "<h3 id=\"campaigntitle_{$r->id}\"><a href=\"#\">".htmlspecialchars($r->name)."</a></h3>\n";
+    while($r=$q->fetch(PDO::FETCH_OBJ)) {
+        echo "<h3><a href=\"#\">".htmlspecialchars($r->name)."</a></h3>\n";
         echo "<div id=\"campaign_{$r->id}\">\n";
-        echo "<table>\n";
         echo "<form id=\"campaigninfo_{$r->id}\" method=\"post\" action=\"{$_SERVER['PHP_SELF']}\" onsubmit=\"return campaigninfo_save($r->id)\">\n";
         echo "<input type=\"hidden\" name=\"campaign_id\" value=\"{$r->id}\" />\n";
+        echo "<table>\n";
         display_campaign_form($r);
         ?>
         <tr><td colspan="6" style="text-align: center;">
         <br />
         <input type="submit" value="<?=i18n("Save Appeal")?>"></td>
         </tr>
-        </form>
-        <tr><td colspan="6" style="text-align: center;">
-        <br />
-        <?php 
-		echo "<form id=\"campaignremove_{$r->id}\" method=\"post\" action=\"{$_SERVER['PHP_SELF']}\" onsubmit=\"return campaigninfo_remove($r->id)\">\n";
-        	echo "<input type=\"hidden\" name=\"campaign_id\" value=\"{$r->id}\" />\n";
-	?>
-        <br />
-                <input type="submit" value="<?=i18n("Delete Appeal")?>"></td>
-            </form>
-	</td></tr>
         </table>
+        </form>
         </div>
     <?
     }
@@ -101,15 +92,17 @@ switch($_GET['action']){
  </tr>
  </thead>
 <?
- $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}'");
+ $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}'");
+$q->execute();
+ while($r=$q->fetch(PDO::FETCH_OBJ)) {
 
- while($r=mysql_fetch_object($q)) {
+    $goalq=$pdo->prepare("SELECT * FROM fundraising_goals WHERE goal='{$r->fundraising_goal}' AND fiscalyear='{$config['FISCALYEAR']}'");
-
+    $goalq->execute();
-    $goalq=mysql_query("SELECT * FROM fundraising_goals WHERE goal='{$r->fundraising_goal}' AND fiscalyear='{$config['FISCALYEAR']}'");
+    $goalr=$goalq->fetch(PDO::FETCH_OBJ);
-    $goalr=mysql_fetch_object($goalq);
+    $recq=$pdo->prepare("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_campaigns_id='$r->id' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
-    $recq=mysql_query("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_campaigns_id='$r->id' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
+    $recq->execute();
-    echo mysql_error();
+    echo $pdo->errorInfo();
-    $recr=mysql_fetch_object($recq);
+    $recr=$recq->fetch(PDO::FETCH_OBJ);
     $received=$recr->received;
     if($r->target)
         $percent=round($received/$r->target*100,1);
@@ -143,8 +136,9 @@ switch($_GET['action']){
         exit;
     }
     $id=intval($_GET['id']);
-    $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$id'");
+    $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$id'");
-    $campaign=mysql_fetch_object($q);
+    $q->execute();
+    $campaign=$q->fetch(PDO::FETCH_OBJ);
     echo "<h3>$campaign->name</h3>\n";
     ?>
     <div id="campaign_tabs">
@@ -174,14 +168,15 @@ switch($_GET['action']){
 
    case "manage_tab_overview":
          $campaign_id=intval($_GET['id']);
-         $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
+         $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
-
+        $q->execute();
-         if($r=mysql_fetch_object($q)) {
+         if($r=$q->fetch(PDO::FETCH_OBJ)) {
 
 			$goalr=getGoal($r->fundraising_goal);
-            $recq=mysql_query("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_campaigns_id='$r->id' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
+            $recq=$pdo->prepare("SELECT SUM(value) AS received FROM fundraising_donations WHERE fundraising_campaigns_id='$r->id' AND fiscalyear='{$config['FISCALYEAR']}' AND status='received'");
-            echo mysql_error();
+            $recq->execute();
-            $recr=mysql_fetch_object($recq);
+            echo $pdo->errorInfo();
+            $recr=recq->fetch(PDO::FETCH_OBJ);
             $received=$recr->received;
             if($r->target)
                 $percent=round($received/$r->target*100,1);
@@ -212,8 +207,9 @@ switch($_GET['action']){
 
    case "manage_tab_donations":
          $campaign_id=intval($_GET['id']);
-         $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
+         $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
-         if($campaign=mysql_fetch_object($q)) {
+        $q->execute();
+         if($campaign=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<table class=\"tableview\">";
 			echo "<thead>";
 			echo "<tr>";
@@ -225,12 +221,13 @@ switch($_GET['action']){
 			echo "</tr>";
 			echo "</thead>\n";
 
-			$q=mysql_query("SELECT * FROM fundraising_donations WHERE fundraising_campaigns_id='$campaign_id'
+			$q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE fundraising_campaigns_id='$campaign_id'
 			AND status='received' ORDER BY datereceived DESC");
-			while($r=mysql_fetch_object($q)) {
+			while($r=$q->fetch(PDO::FETCH_OBJ)) {
 				$goal=getGoal($r->fundraising_goal);
-				$sq=mysql_query("SELECT * FROM sponsors WHERE id='{$r->sponsors_id}'");
+				$sq=$pdo->prepare("SELECT * FROM sponsors WHERE id='{$r->sponsors_id}'");
-				$sponsor=mysql_fetch_object($sq);
+                $sq->execute();
+				$sponsor=$sq->fetch(PDO::FETCH_OBJ);
 				echo "<tr><td>".format_date($r->datereceived)."</td>\n";
 				echo "    <td>".$sponsor->organization."</td>\n";
 				echo "    <td>".$goal->name."</td>\n";
@@ -260,8 +257,9 @@ switch($_GET['action']){
 				"mentor"=>"Mentor (not implemented)",
 				);
          $campaign_id=intval($_GET['id']);
-         $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
+         $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
-		 $campaign=mysql_fetch_object($q);
+		 $q->execute();
+         $campaign=$q->fetch(PDO::FETCH_OBJ);
 		 if($campaign->filterparameters) {
 			echo "<h4>".i18n("User List")."</h4>\n";
 			$params=unserialize($campaign->filterparameters);
@@ -308,8 +306,9 @@ switch($_GET['action']){
 			echo "<br />";
 			echo "<form id=\"prospectremoveform\" onsubmit=\"return removeselectedprospects()\">\n";
 			echo "<input type=\"hidden\" name=\"fundraising_campaigns_id\" value=\"$campaign_id\" />\n";
-			 $q=mysql_query("SELECT * FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$campaign_id'");
+			 $q=$pdo->prepare("SELECT * FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$campaign_id'");
-			 while($r=mysql_fetch_object($q)) {
+			 $q->execute();
+             while($r=$q->fetch(PDO::FETCH_OBJ)) {
 				 $u=user_load_by_uid($r->users_uid);
 				 //hopefully this never returns false, but who knows..
 				 if($u) {
@@ -359,8 +358,9 @@ switch($_GET['action']){
         </td></tr>
         <tr><td><?=i18n("Donation Level")?>:</td><td>
             <?
-            $q=mysql_query("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY min");
+            $q=$pdo->prepare("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY min");
-            while($r=mysql_fetch_object($q)) {
+           $q->execute();
+            while($r=$q->fetch(PDO::FETCH_OBJ)) {
                 echo "<label><input onchange=\"return prospect_search()\" disabled=\"disabled\" type=\"checkbox\" name=\"donationlevel[]\" value=\"$r->level\" >".i18n($r->level)." (".format_money($r->min,false)." - ".format_money($r->max,false).")</label><br />\n";
             }
 			echo "(disabled until the logic requirements can be established)";
@@ -408,9 +408,9 @@ switch($_GET['action']){
 
    case "manage_tab_communications":
          $campaign_id=intval($_GET['id']);
-         $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
+         $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE id='$campaign_id' AND fiscalyear='{$config['FISCALYEAR']}'");
-
+            $q->execute();
-         if($r=mysql_fetch_object($q)) {
+         if($r=$q->fetch(PDO::FETCH_OBJ)) {
 
          }
 		 $communications=array("initial"=>"Initial Communication",
@@ -419,8 +419,9 @@ switch($_GET['action']){
 		 foreach($communications as $key=>$name) {
 					echo "<h4>".i18n($name)."</h4>\n";
 			//check if they have one in the emails database
-			$q=mysql_query("SELECT * FROM emails WHERE fundraising_campaigns_id='$campaign_id' AND val='$key'");
+			$q=$pdo->prepare("SELECT * FROM emails WHERE fundraising_campaigns_id='$campaign_id' AND val='$key'");
-			if($email=mysql_fetch_object($q)) {
+			$q->execute();
+            if($email=$q->fetch(PDO::FETCH_OBJ)) {
 				echo "<div style=\"float: right; margin-right: 15px;\">";
 				echo "<a title=\"Edit\" href=\"#\" onclick=\"return opencommunicationeditor(null,$email->id,$campaign_id)\"><img src=\"".$config['SFIABDIRECTORY']."/images/16/edit.".$config['icon_extension']."\" border=0></a>";
 				echo "&nbsp;&nbsp;";
@@ -439,7 +440,7 @@ switch($_GET['action']){
 					echo "<input type=\"button\" onclick=\"return opensendemaildialog($campaign_id,$email->id)\" value=\"".i18n("Send as email")."\" />";
 					echo "<br />\n";
 					if($email->lastsent) {
-						list($date,$time)=explode(" ",$email->lastsent);
+						list($date,$time)=split(" ",$email->lastsent);
 						echo i18n("Last Sent");
 						echo "<br />".format_date($date);
 						echo "<br />".format_time($time);
@@ -469,15 +470,18 @@ switch($_GET['action']){
 		if(is_array($_POST['prospectremovefromlist'])) {
 			$uidlist=implode(",",$_POST['prospectremovefromlist']);
 			$query="DELETE FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$campaignid' AND users_uid IN ($uidlist)";
-			mysql_query($query);
+			$stmt = $pdo->prepare($query);
-			echo mysql_error();
+            $stmt->execute();
+			echo $pdo->errorInfo();
 		}
 		//if theres nobody left in the list we need to reset the filter params as well
-		$q=mysql_query("SELECT COUNT(*) AS num FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$campaignid'");
+		$q=$pdo->prepare("SELECT COUNT(*) AS num FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$campaignid'");
-		$r=mysql_fetch_object($q);
+		$q->execute();
+        $r=$q->fetch(PDO::FETCH_OBJ);
 		if($r->num==0) {
-			mysql_query("UPDATE fundraising_campaigns SET filterparameters=NULL WHERE id='$campaignid'");
+			$stmt = $pdo->prepare("UPDATE fundraising_campaigns SET filterparameters=NULL WHERE id='$campaignid'");
-		}
+            $stmt->execute();
+        }
 
 		happy_("Selected users removed from list");
 	exit;
@@ -485,53 +489,30 @@ switch($_GET['action']){
 
 	case "prospect_removeall":
 		$campaignid=intval($_POST['fundraising_campaigns_id']);
-		mysql_query("DELETE FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$campaignid'");
+		$stmt = $pdo->prepare("DELETE FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$campaignid'");
-		mysql_query("UPDATE fundraising_campaigns SET filterparameters=NULL WHERE id='$campaignid'");
+		$stmt->execute();
-		happy_("All users removed from list");
+        $stmt = $pdo->prepare("UPDATE fundraising_campaigns SET filterparameters=NULL WHERE id='$campaignid'");
+		$stmt->execute();
+        happy_("All users removed from list");
 	exit;
 	break;
 
 	case "communication_remove":
 		$emails_id=$_POST['id'];
 		//check if its been sent, if so, it cannot be deleted, sorry!
-		$q=mysql_query("SELECT * FROM emails WHERE id='$emails_id'");
+		$q=$pdo->prepare("SELECT * FROM emails WHERE id='$emails_id'");
-		$e=mysql_fetch_object($q);
+        $q->execute();
+		$e=$q->fetch(PDO::FETCH_OBJ);
 		if($e->lastsent) {
 			error_("Cannot remove an email that has already been sent");
 		}
 		else {
-			mysql_query("DELETE FROM emails WHERE id='$emails_id'");
+			$stmt = $pdo->prepare("DELETE FROM emails WHERE id='$emails_id'");
+            $stmt->execute();
 			happy_("Communicaton removed");
 		}
-	exit;
-	break;
 
-	case "campaign_remove":
-		$campaign_id = $_POST['campaign_id'];
-		if(is_numeric($campaign_id)) {
-			mysql_query("DELETE FROM fundraising_campaigns WHERE 
-				(SELECT COUNT(*) FROM fundraising_donations WHERE fundraising_campaigns_id = $campaign_id) = 0 AND 
-				(SELECT count(*) FROM emails WHERE fundraising_campaigns_id = $campaign_id) = 0 AND
-				id = $campaign_id");
-			if(mysql_affected_rows() == 0) {
-				error_("Cannot delete campaign. It is in use.");
-			} else {
-				mysql_query("DELETE FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id = $campaign_id");
-				mysql_query("DELETE FROM fundraising_donations WHERE fundraising_campaigns_id = $campaign_id");
-				mysql_query("DELETE FROM fundraising_donor_logs WHERE fundraising_campaigns_id = $campaign_id");
-				mysql_query("DELETE FROM emailqueue WHERE fundraising_campaigns_id = $campaign_id");
-				mysql_query("DELETE FROM emails WHERE fundraising_campaigns_id = $campaign_id");
-				happy_("Campaign removed");
-				echo "<script type=\"text/javascript\">";
-				echo "  $('#campaigntitle_$campaign_id').remove();";
-                        	echo "  $('#campaign_$campaign_id').remove();";
-				echo "</script>";
-			}
-		} else {
-			error_("Invalid Campaign ID");
-		}
 
-	exit;
 	break;
 
 }
@@ -546,22 +527,23 @@ function save_campaign_info(){
 
 	if(!$_GET['id']) {
 		$query = "INSERT INTO fundraising_campaigns (name,fiscalyear) VALUES (
-            '".mysql_real_escape_string(stripslashes($_POST['name']))."','{$config['FISCALYEAR']}')";
+            '".stripslashes($_POST['name'])."','{$config['FISCALYEAR']}')";
-        mysql_query($query);
+        $stmt = $pdo->prepare($query);
-		$id = mysql_insert_id();
+        $stmt->execute();
+		$id = $pdo->lastInsertId();
         happy_("Appeal Created");
 	}else{
 		$id = $_GET["id"];
         happy_("Appeal Saved");
     }
-    mysql_query("UPDATE fundraising_campaigns SET 
+    $stmt = $pdo->prepare("UPDATE fundraising_campaigns SET 
-       name='".mysql_real_escape_string(stripslashes($_POST['name']))."',
+       name='".stripslashes($_POST['name'])."',
-       `type`='".mysql_real_escape_string($_POST['type'])."',
+       `type`='".$_POST['type']."',
-       startdate='".mysql_real_escape_string($startdate)."',
+       startdate='".$startdate."',
-       followupdate='".mysql_real_escape_string($_POST['followupdate'])."',
+       followupdate='".$_POST['followupdate']."',
-       enddate='".mysql_real_escape_string($_POST['enddate'])."',
+       enddate='".$_POST['enddate']."',
-       target='".mysql_real_escape_string($_POST['target'])."',
+       target='".$_POST['target']."',
-       fundraising_goal='".mysql_real_escape_string($_POST['fundraising_goal'])."'
+       fundraising_goal='".$_POST['fundraising_goal']."'
        WHERE id='$id'");
 }
 
@@ -649,11 +631,6 @@ function campaigninfo_save(id) {
 	return false;
 }
 
-function campaigninfo_remove(id) {
-	$("#debug").load("<?$_SERVER['PHP_SELF']?>?action=campaign_remove", $("#campaignremove_"+id).serializeArray());
-	return false;
-}
-
 function update_tab_overview() {
 		$("#campaign_tab_overview").load("<?$_SERVER['PHP_SELF']?>?action=manage_tab_overview&id="+currentcampaignid);
 }
@@ -807,10 +784,11 @@ function display_campaign_form($r=null) {
 			<td><?=i18n("Target")?></td><td>$<input type="text" id="target" name="target" size="10" value="<?=$r->target?>" /></td>
 			<td><?=i18n("Default Purpose")?></td><td colspan="3">
             <?
-            $fgq=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+            $fgq=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+            $fgq->execute();
             echo "<select name=\"fundraising_goal\">";
             echo "<option value=\"\">".i18n("Choose Default Purpose")."</option>\n";
-            while($fgr=mysql_fetch_object($fgq)) {
+            while($fgr=$fgq->fetch(PDO::FETCH_OBJ)) {
                 if($r->fundraising_goal==$fgr->goal) $sel="selected=\"selected\""; else $sel="";
                 echo "<option $sel value=\"$fgr->goal\">".i18n($fgr->name)."</option>\n";
             }

admin/fundraising_campaigns_prospecting.php

@@ -23,15 +23,17 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("fundraising_common.inc.php");
 
     $userslist=array();
     $otherlist=array();
 
 if($_POST['donortype']=="organization") {
-    $q=mysql_query("SELECT id, organization AS name, address, address2, city, province_code, postalcode FROM sponsors ORDER BY name");
+    $q=$pdo->prepare("SELECT id, organization AS name, address, address2, city, province_code, postalcode FROM sponsors ORDER BY name");
-    echo mysql_error();
+   
+	$q->execute();
+	echo $pdo->errorInfo();
 
     if(!$_POST['contacttype'])
         $contacttype=array("primary","secondary");
@@ -39,7 +41,7 @@ if($_POST['donortype']=="organization") {
         $contacttype=$_POST['contacttype'];
 
     $primary="";
-    while($r=mysql_fetch_object($q)) {
+    while($r=$q->fetch(PDO::FETCH_OBJ)) {
         foreach($contacttype AS $ct) {
             switch($ct) {
                 case "primary":
@@ -49,7 +51,7 @@ if($_POST['donortype']=="organization") {
                     $primary="no";
                     break;
             }
-			$cq = mysql_query("SELECT *,MAX(year) FROM users LEFT JOIN users_sponsor ON users_sponsor.users_id=users.id
+			$cq = $pdo->prepare("SELECT *,MAX(year) FROM users LEFT JOIN users_sponsor ON users_sponsor.users_id=users.id
 			WHERE 
 			sponsors_id='" . $r->id . "' 
 			AND `primary`='$primary' 
@@ -58,9 +60,10 @@ if($_POST['donortype']=="organization") {
 			HAVING deleted='no' 
 			ORDER BY users_sponsor.primary DESC,lastname,firstname
 			");
+			$cq->execute();
 
-            echo mysql_error();
+            echo $pdo->errorInfo();
-            while($cr=mysql_fetch_object($cq)) {
+            while($cr=m$cq->fetch(PDO::FETCH_OBJ)) {
                 if(!$userslist[$cr->uid])
                     $userslist[$cr->uid]=user_load($cr->users_id);
             }
@@ -76,9 +79,10 @@ else if($_POST['donortype']=="individual") {
 
     foreach($individual_type AS $t) {
 		$query="SELECT *,MAX(year) FROM users WHERE types LIKE '%$t%' GROUP BY uid HAVING deleted='no' ORDER BY lastname,firstname";
-		$q=mysql_query($query);
+		$q=$pdo->prepare($query);
-		echo mysql_error();
+		$q->execute();
-		while($r=mysql_fetch_object($q)) {
+		echo $pdo->errorInfo();
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			if(!$userslist[$r->uid])
 				$userslist[$r->uid]=user_load_by_uid($r->uid);
         }
@@ -140,8 +144,9 @@ $thisyearlist=$userslist;
 
 	foreach($neverlist AS $uid=>$u) {
 		if($u['sponsors_id']) {
-			$q=mysql_query("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}'");
+			$q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}'");
-			if(mysql_num_rows($q)) {
+			$q->execute();
+			if($q->rowCount()) {
 		//		echo "removing $uid because they have donated in the past <br />";
 				unset($neverlist[$uid]);
 			}
@@ -154,8 +159,9 @@ $thisyearlist=$userslist;
 	
 	foreach($pastlist AS $uid=>$u) {
 		if($u['sponsors_id']) {
-			$q=mysql_query("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}'");
+			$q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}'");
-			if(!mysql_num_rows($q)) {
+			$q->execute();
+			if(!$q->rowCount()) {
 		//		echo "removing $uid because they have NOT donated in the past <br />";
 				unset($pastlist[$uid]);
 			}
@@ -171,8 +177,9 @@ $thisyearlist=$userslist;
 
 	foreach($lastyearlist AS $uid=>$u) {
 		if($u['sponsors_id']) {
-			$q=mysql_query("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}' AND fiscalyear='$lastyear'");
+			$q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}' AND fiscalyear='$lastyear'");
-			if(!mysql_num_rows($q)) {
+			$q->execute();
+			if(!$q->rowCount()) {
 		//		echo "removing $uid because they have NOT donated last year <br />";
 				unset($lastyearlist[$uid]);
 			}
@@ -186,8 +193,9 @@ $thisyearlist=$userslist;
 
 	foreach($thisyearlist AS $uid=>$u) {
 		if($u['sponsors_id']) {
-			$q=mysql_query("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}' AND fiscalyear='{$config['FISCALYEAR']}'");
+			$q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE status='received' AND sponsors_id='{$u['sponsors_id']}' AND fiscalyear='{$config['FISCALYEAR']}'");
-			if(!mysql_num_rows($q)) {
+			$q->execcute();
+			if(!$q->rowCount()) {
 		//		echo "removing $uid because they have NOT donated this year <br />";
 				unset($thisyearlist[$uid]);
 			}
@@ -218,11 +226,13 @@ if($_GET['generatelist']) {
 	$campaignid=$_POST['fundraising_campaigns_id'];
 	$params=serialize($_POST);
 	echo "params=$params";
-	mysql_query("UPDATE fundraising_campaigns SET filterparameters='{$params}' WHERE id='$campaignid'");
+	$stmt = $pdo->prepare("UPDATE fundraising_campaigns SET filterparameters='{$params}' WHERE id='$campaignid'");
+	$stmt->execute();
 	$uids=array_keys($userslist);
 	foreach($uids AS $u) {
-		mysql_query("INSERT INTO fundraising_campaigns_users_link (fundraising_campaigns_id, users_uid) VALUES ('$campaignid','$u')");
+		$stmt = $pdo->prepare("INSERT INTO fundraising_campaigns_users_link (fundraising_campaigns_id, users_uid) VALUES ('$campaignid','$u')");
-	}
+	$stmt->execute();}
+
 	echo "List created";
 }
 else {

admin/fundraising_common.inc.php

@@ -1,10 +1,12 @@
 <?
 $campaign_types=array("Mail","Email","Phone","Personal Visit","Event","Other");
+$salutations=array("Mr.","Mrs.","Ms","Dr.","Professor");
 
 function getGoal($goal) {
 	global $config;
-	$q=mysql_query("SELECT * FROM fundraising_goals WHERE goal='$goal' AND fiscalyear='{$config['FISCALYEAR']}' LIMIT 1");
+	$q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE goal='$goal' AND fiscalyear='{$config['FISCALYEAR']}' LIMIT 1");
-	return mysql_fetch_object($q);
+	$q->execute();
-}
+	return $q->rowCount();
+
 
 ?>

admin/fundraising_goals_handler.inc.php

@@ -2,14 +2,17 @@
 if($_POST['action']=="funddelete" && $_POST['delete']) {
 	//first lookup all the sponsorships inside the fund
 	$id=intval($_POST['delete']);
-	$q=mysql_query("SELECT * FROM fundraising_goals WHERE id='$id' AND year='".$config['FISCALYEAR']."'");
+	$q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE id='$id' AND year='".$config['FISCALYEAR']."'");
-	$f=mysql_fetch_object($q);
+	$q->execute();
+	$f=$q->fetch(PDO::FETCH_OBJ);
 	//hold yer horses, no deleting system funds!
 	if($f) {
 		if($f->system=="no") {
-			mysql_query("DELETE FROM fundraising_donations WHERE fundraising_goal='".mysql_real_escape_string($f->type)."' AND fiscalyear='".$config['FISCALYEAR']."'");
+			$stmt = $pdo->prepare("DELETE FROM fundraising_donations WHERE fundraising_goal='".$f->type."' AND fiscalyear='".$config['FISCALYEAR']."'");
-			mysql_query("DELETE FROM fundraising_goals WHERE id='$id'");
+			$stmt->execute();
-			if(mysql_affected_rows())
+			$stmt = $pdo->prepare("DELETE FROM fundraising_goals WHERE id='$id'");
+			$stmt->execute();
+			if($pdo->rowCount())
 				happy_("Successfully removed fund %1",array($f->name));
 		}
 		else {
@@ -21,26 +24,31 @@ if($_POST['action']=="funddelete" && $_POST['delete']) {
 if($_POST['action']=="fundedit" || $_POST['action']=="fundadd") {
 	$fundraising_id=intval($_POST['fundraising_id']);
 	if($fundraising_id) {
-		$q=mysql_query("SELECT * FROM fundraising_goals WHERE id='$fundraising_id'");
+		$q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE id='$fundraising_id'");
-		$f=mysql_fetch_object($q);
+		$q->execute();
+		$f=$q->fetch(PDO::FETCH_OBJ);
 		$system=$f->system;
 	}
-	$name=mysql_real_escape_string($_POST['name']);
+	$name=$_POST['name'];
-	$goal=mysql_real_escape_string($_POST['goal']);
+	$goal=$_POST['goal'];
-	$description=mysql_real_escape_string($_POST['description']);
+	$description=$_POST['description'];
 	$budget=intval($_POST['budget']);
 }
 
 if($_POST['action']=="fundedit") {
 	if( ($system=="yes" && $budget) || ($system=="no" && $budget && $goal && $name) ) {
 		if($system=="yes") {
-			mysql_query("UPDATE fundraising SET budget='$budget', description='$description' WHERE id='$fundraising_id'");
+			$stmt = $pdo->prepare("UPDATE fundraising SET budget='$budget', description='$description' WHERE id='$fundraising_id'");
+		$stmt->execute();
 		}
+
 		else {
-			mysql_query("UPDATE fundraising SET budget='$budget', description='$description', goal='$goal', name='$name' WHERE id='$fundraising_id'");
+			$stmt = $pdo->prepare("UPDATE fundraising SET budget='$budget', description='$description', goal='$goal', name='$name' WHERE id='$fundraising_id'");
+		$stmt->execute();
 		}
-		if(mysql_error())
+
-			error_("MySQL Error: %1",array(mysql_error()));
+		if($pdo->errorInfo())
+			error_("MySQL Error: %1",array($pdo->errorInfo()));
 		else
 			happy_("Saved fund changes");
 	}
@@ -52,13 +60,14 @@ if($_POST['action']=="fundedit") {
 }
 if($_POST['action']=="fundadd") {
 	if( $goal && $type && $name) {
-		mysql_query("INSERT INTO fundraising_goals (goal,name,description,system,budget,fiscalyear) VALUES ('$goal','$name','$description','no','$budget','{$config['FISCALYEAR']}')");
+		$stmt = $pdo->prepare("INSERT INTO fundraising_goals (goal,name,description,system,budget,fiscalyear) VALUES ('$goal','$name','$description','no','$budget','{$config['FISCALYEAR']}')");
+		$stmt->execute();
 		happy_("Added new fund");
 	}
 	else
 		error_("Required fields were missing, please try again");
-	if(mysql_error())
+	if($pdo->errorInfo())
-		error_("MySQL Error: %1",array(mysql_error()));
+		error_("MySQL Error: %1",array($pdo->errorInfo()));
     exit;
 }
 

admin/fundraising_main.inc.php

@@ -0,0 +1,90 @@
+<?
+if($_GET['action']=="fundraisingmain") {
+
+//this table is eventually going to be massive, and probably not in a tableview format, it'll show goals as well as all ongoing fund pledges, probabilities, etc as well as over/under, etc, all prettily colour coded.. basically a good overview of the total fundraising status of the fair.
+ $q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY system DESC,goal");
+ $q->execute();
+ echo "<table class=\"fundraisingtable\">";
+
+ while($r=$q->fetch(PDO::FETCH_OBJ)) {
+	 echo "<tr>";
+	 echo "<th><a title=\"".i18n("Edit fund details")."\" onclick=\"return popup_fund_editor('fundraising_types.php?id=$r->id')\" href=\"#\"><img border=\"0\" src=\"".$config['SFIABDIRECTORY']."/images/16/edit.".$config['icon_extension']."\"></a>";
+	 if($r->system=="no") {
+		//echo "<a title=\"".i18n("Remove Fund")."\" onclick=\"return confirmClick('Are you sure you want to remove this fund and all sponsorships inside it?')\" href=\"fundraising.php?action=funddelete&delete=$r->id\">";
+        echo "<img style=\"cursor:pointer\" onclick=\"return delete_fund($r->id)\" border=\"0\" src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\">";
+       // echo "</a>";
+	 }
+
+	 echo "</th>\n";
+	 echo "<th colspan=\"5\">".i18n($r->name)."</th>\n";
+	 echo "<th style=\"text-align: right\"><nobr>".format_money($r->budget)."</nobr></th>\n";
+ 	 echo "</tr>\n";
+
+	if($r->type=="general") 
+		$orsql.="OR fundraising_type IS NULL";
+
+	$typetotal=0;
+	$typeprobtotal=0;
+	$sq=$pdo->prepare("
+            SELECT fundraising_donations.id, sponsors.organization AS name, fundraising_donations.value, fundraising_donations.status, fundraising_donations.probability
+		 FROM fundraising_donations
+		 JOIN sponsors ON fundraising_donations.sponsors_id=sponsors.id
+		  WHERE (fundraising_donations.fundraising_goal='$r->goal' $orsql) 
+		  AND fundraising_donations.fiscalyear='{$config['FISCALYEAR']}'
+
+          UNION
+
+        SELECT fundraising_donations.id, CONCAT(users.firstname,' ',users.lastname) AS name, fundraising_donations.value, fundraising_donations.status, fundraising_donations.probability
+		 FROM fundraising_donations
+		 JOIN users ON fundraising_donations.users_uid=users.uid
+		  WHERE (fundraising_donations.fundraising_goal='$r->goal' $orsql) 
+		  AND fundraising_donations.fiscalyear='{$config['FISCALYEAR']}'
+
+		  ORDER BY status DESC, probability DESC, name
+            ");
+	 $sq->execute();
+    echo $pdo->errorInfo();
+	while($sr=$sq->fetch(PDO::FETCH_OBJ)) {
+		echo "<tr id=\"sponsorships_$sr->id\" class=\"fundraising{$sr->status}\">";
+		echo "<td>";
+        echo "<img style=\"cursor:pointer;\" onclick=\"delete_sponsorship($sr->id)\" border=\"0\" src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\">";
+		echo "</td>";
+		echo "<td style=\"cursor: pointer;\" onclick=\"popup_sponsorship_editor('fundraising_sponsorship.php?id=$sr->id&fundraising_type=$r->type')\">";
+        echo "$sr->name</td>\n";
+		echo "<td>$sr->status</td>";
+		echo "<td>";
+		if($sr->status=="pending") {
+			echo "$sr->probability%";
+			echo "</td>";
+			echo "<td><nobr>".format_money($sr->value)."</nobr></td>";
+		}
+		else
+			echo "</td><td></td>\n";
+
+		$probval=$sr->probability/100*$sr->value; 
+		echo "<td style=\"text-align: right\"><nobr>".format_money($probval)."</nobr></td>";
+		echo "<td></td>\n";
+		echo "</tr>\n";
+		$typeprobtotal+=$probval;
+		$typetotal+=$sr->value;
+	}
+	 echo "<tr>";
+	 echo "<td><a onclick=\"return popup_sponsorship_editor('fundraising_sponsorship.php?fundraising_type=$r->type')\" href=\"#\">add</a></td>";
+	 echo "<td colspan=\"3\" style=\"text-align: right; font-weight: bold;\">".i18n("%1 Total",array($r->name),array("Fundraising type total, eg) Award Sponsorship Total"))."</td>\n";
+	 echo "<td style=\"font-weight: bold; text-align: right;\"><nobr>".format_money($typetotal)."</nobr></td>\n";
+	 echo "<td style=\"font-weight: bold; text-align: right;\"><nobr>".format_money($typeprobtotal)."</nobr></td>\n";
+	$typediff=$typeprobtotal-$r->goal;
+	 echo "<td style=\"font-weight: bold; text-align: right;\"><nobr>".format_money($typediff)."</nobr></td>\n";
+ 	 echo "</tr>\n";
+
+	$totalgoal+=$r->goal;
+	$totaldiff+=$typediff;
+	echo "<tr><td colspan=\"7\">&nbsp;</td></tr>\n";
+ }
+ echo "<tr>";
+ echo "<td colspan=\"2\"><a onclick=\"return popup_fund_editor('fundraising_types.php')\" href=\"#\">add fund type</a></td>";
+ echo "<td colspan=\"4\" style=\"font-weight: bold; text-align: right;\">".i18n("Total Net Position")."</td><td style=\"text-align: right; font-weight: bold;\">".format_money($totaldiff)."</td></tr>\n";
+ echo "</table>\n";
+ exit;
+}
+

admin/fundraising_reports.php

@@ -23,7 +23,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("fundraising_common.inc.php");
 
 send_header("Fundraising Reports",
@@ -52,8 +52,9 @@ $(document).ready( function(){
   <select name="fundraising_campaigns_id">
    <option value="">All appeals</option>
    <?
-   $q=mysql_query("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+   $q=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
-   while($r=mysql_fetch_object($q)) {
+   $q->execute();
+   while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	   echo "<option value=\"$r->id\">$r->name</option>\n";
    }
    ?>
@@ -82,8 +83,9 @@ $(document).ready( function(){
   <select name="goal">
    <option value="">All purposes</option>
    <?
-   $q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+   $q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
-   while($r=mysql_fetch_object($q)) {
+   $q->execute();
+   while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	   echo "<option value=\"$r->goal\">$r->name</option>\n";
    }
    ?>

admin/fundraising_reports_std.php

@@ -23,7 +23,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("fundraising_common.inc.php");
  require_once("../lpdf.php");
  require_once("../lcsv.php");
@@ -41,7 +41,7 @@
 			 } else if($type=="pdf") {
 				$rep=new lpdf(	i18n($config['fairname']),
 						i18n("List of Prospects By Appeal"),
-						$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+						$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 						);
 				$rep->newPage();
 				$rep->setFontSize(8);
@@ -51,9 +51,10 @@
 				 $sql.=" AND id='".intval($_GET['fundraising_campaigns_id'])."'";
 			 }
 			 $sql.=" ORDER BY name";
-			 $q=mysql_query($sql);
+			 $q=$pdo->prepare($sql);
-			 echo mysql_error();
+			 $q->execute();
-			 while($r=mysql_fetch_object($q)) {
+			 echo $pdo->errorInfo();
+			 while($r=$q->fetch(PDO::FETCH_OBJ)) {
 				 $rep->heading($r->name);
 				 $table=array();
 				 $table['header']=array("Name","Contact","Phone","Address","$ appeal","$ this year","$ last year","%chg");
@@ -63,8 +64,9 @@
 				$thisyear=$config['FISCALYEAR'];
 				$lastyear=$config['FISCALYEAR']-1;
 
-				 $pq=mysql_query("SELECT * FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$r->id'");
+				 $pq=$pdo->prepare("SELECT * FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$r->id'");
-				 while($pr=mysql_fetch_object($pq)) {
+				 $pq->execute();
+				 while($pr=$pq->fetch(PDO::FETCH_OBJ)) {
 					 $u=user_load_by_uid($pr->users_uid);
 					 //hopefully this never returns false, but who knows..
 					 if($u) {
@@ -75,14 +77,17 @@
 						//gah i dont know what the heck to do here
 
 						if($u['sponsors_id']) {
-							$cq=mysql_query("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='{$u['sponsors_id']}' AND fundraising_campaigns_id='$r->id' AND status='received' AND fiscalyear='$thisyear'");
+							$cq=$pdo->prepare("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='{$u['sponsors_id']}' AND fundraising_campaigns_id='$r->id' AND status='received' AND fiscalyear='$thisyear'");
-							$cr=mysql_fetch_object($cq);
+							$cq->execute();
+							$cr=$cq->fetch(PDO::FETCH_OBJ);
 							$thisappeal=$cr->total;
-							$cq=mysql_query("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='{$u['sponsors_id']}' AND status='received' AND fiscalyear='$thisyear'");
+							$cq=$pdo->prepare("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='{$u['sponsors_id']}' AND status='received' AND fiscalyear='$thisyear'");
-							$cr=mysql_fetch_object($cq);
+							$cq->execute();
+							$cr=$cq->fetch(PDO::FETCH_OBJ);
 							$thisyeartotal=$cr->total;
-							$cq=mysql_query("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='{$u['sponsors_id']}' AND status='received' AND fiscalyear='$lastyear'");
+							$cq=$pdo->prepare("SELECT SUM(value) AS total FROM fundraising_donations WHERE sponsors_id='{$u['sponsors_id']}' AND status='received' AND fiscalyear='$lastyear'");
-							$cr=mysql_fetch_object($cq);
+							$cq->execute();
+							$cr=$cq->fetch(PDO::FETCH_OBJ);
 							$lastyeartotal=$cr->total;
 							if($lastyeartotal)
 								$change=round(($thisyeartotal-$lastyeartotal)/$lastyeartotal*100);
@@ -125,20 +130,21 @@
 			 } else if($type=="pdf") {
 				$rep=new lpdf(	i18n($config['fairname']),
 						i18n("Results of Appeal by Purpose"),
-						$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+						$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 						);
 				$rep->newPage();
 				$rep->setFontSize(8);
 			 }
 			 $sql="SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ";
 			 if($_GET['goal']) {
-				 $sql.=" AND goal='".mysql_real_escape_string($_GET['goal'])."'";
+				 $sql.=" AND goal='".$_GET['goal']."'";
 			 }
 			 $sql.=" ORDER BY name";
-			 $q=mysql_query($sql);
+			 $q=$pdo->prepare($sql);
-			 echo mysql_error();
+			 $q->execute();
+			 echo $pdo->errorInfo();
 
-			 while($r=mysql_fetch_object($q)) {
+			 while($r=$q->fetch(PDO::FETCH_OBJ)) {
 				 $rep->heading($r->name)." (".$r->budget.")";
 
 				 $table=array();
@@ -146,8 +152,9 @@
 				 $table['widths']=array(1.5,0.5,0.5,0.75,0.9,0.9,0.9,0.5);
 				 $table['dataalign']=array("left","right","right","center","center","center","center","right");
 
-				 $cq=mysql_query("SELECT * FROM fundraising_campaigns WHERE fundraising_goal='$r->goal' AND fiscalyear='{$config['FISCALYEAR']}'");
+				 $cq=$pdo->prepare("SELECT * FROM fundraising_campaigns WHERE fundraising_goal='$r->goal' AND fiscalyear='{$config['FISCALYEAR']}'");
-				 while($cr=mysql_fetch_object($cq)) {
+				 $cq->execute();
+				 while($cr=$cq->fetch(PDO::FETCH_OBJ)) {
 					 $table['data'][]=array(
 						$cr->name,
 						$cr->target,

admin/fundraising_setup.php

@@ -24,43 +24,50 @@
  require("../common.inc.php");
  require_once("../user.inc.php");
 
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  //first, insert any default fundraising donor levels
- $q=mysql_query("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='".$config['FISCALYEAR']."'");
+ $q=$pdo->prepare("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='".$config['FISCALYEAR']."'");
- if(!mysql_num_rows($q)) {
+ $q->execute();
-     $q=mysql_query("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='-1'");
+ if(!$q->rowCount()) {
-     while($r=mysql_fetch_object($q)) {
+     $q=$pdo->prepare("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='-1'");
-         mysql_query("INSERT INTO fundraising_donor_levels (`level`,`min`,`max`,`description`,`fiscalyear`) VALUES (
+     $q->execute();
-            '".mysql_real_escape_string($r->level)."',
+     while($r=$q->fetch(PDO::FETCH_OBJ)) {
-            '".mysql_real_escape_string($r->min)."',
+         $pdo->prepare("INSERT INTO fundraising_donor_levels (`level`,`min`,`max`,`description`,`fiscalyear`) VALUES (
-            '".mysql_real_escape_string($r->max)."',
+            '".$r->level."',
-            '".mysql_real_escape_string($r->description)."',
+            '".$r->min."',
-            '".$config['FISCALYEAR']."')");
+            '".$r->max."',
+            '".$r->description."',
+            '".$config['FISCALYEAR'].")')");
+        $pdo->execute();
      }
  }
 
  //first, insert any default fundraising goals
- $q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='".$config['FISCALYEAR']."'");
+ $q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='".$config['FISCALYEAR']."'");
- if(!mysql_num_rows($q)) {
+ $q->execute();
-     $q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='-1'");
+ if(!$q->rowCount()) {
-     while($r=mysql_fetch_object($q)) {
+     $q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='-1'");
-         mysql_query("INSERT INTO fundraising_goals (`goal`,`name`,`description`,`system`,`budget`,`fiscalyear`) VALUES (
+     $q->execute();
-            '".mysql_real_escape_string(stripslashes($r->goal))."',
+     while($r=$q->fetch(PDO::FETCH_OBJ)) {
-            '".mysql_real_escape_string(stripslashes($r->name))."',
+         $stmt = pdo->prepare("INSERT INTO fundraising_goals (`goal`,`name`,`description`,`system`,`budget`,`fiscalyear`) VALUES (
-            '".mysql_real_escape_string(stripslashes($r->description))."',
+            '".stripslashes($r->goal)."',
-            '".mysql_real_escape_string($r->system)."',
+            '".stripslashes($r->name)."',
-            '".mysql_real_escape_string($r->budget)."',
+            '".stripslashes($r->description)."',
+            '".$r->system."',
+            '".$r->budget."',
             '".$config['FISCALYEAR']."')");
+        $stmt->execute();
      }
  }
 
 
  switch($_GET['gettab']) {
 	case "levels": 
-		$q=mysql_query("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY max");
+		$q=$pdo->prepare("SELECT * FROM fundraising_donor_levels WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY max");
-		echo "<div id=\"levelaccordion\" style=\"width: 75%;\">\n";
+		$q->execute();
-		while($r=mysql_fetch_object($q)) {
+        echo "<div id=\"levelaccordion\" style=\"width: 75%;\">\n";
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<h3><a href=\"#\">$r->level (".format_money($r->min,false)." to ".format_money($r->max,false).")</a></h3>\n";
 			echo "<div id=\"level_$r->id\">\n";
             echo "<form id=\"level_form_$r->id\" onsubmit=\"return level_save($r->id)\">\n";
@@ -112,9 +119,10 @@
 	break;
 
 	case "goals": 
-		$q=mysql_query("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
+		$q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name");
-		echo "<div id=\"goalaccordion\" style=\"width: 75%;\">\n";
+		$q->execute();
-		while($r=mysql_fetch_object($q)) {
+        echo "<div id=\"goalaccordion\" style=\"width: 75%;\">\n";
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<h3><a href=\"#\">$r->name (".format_money($r->budget,false).") Deadline: ".format_date($r->deadline)."</a></h3>\n";
 			echo "<div id=\"goal_$r->id\">\n";
             echo "<form id=\"goal_form_$r->id\" onsubmit=\"return goal_save($r->id)\">\n";
@@ -175,7 +183,7 @@
         echo $config['FISCALYEAR'];
         echo "</td></tr>\n";
         echo "<tr><td>".i18n("Fiscal Year End")."</td><td>";
-        list($month,$day)=explode("-",$config['fiscal_yearend']);
+        list($month,$day)=split("-",$config['fiscal_yearend']);
         emit_month_selector("fiscalendmonth",$month);
         emit_day_selector("fiscalendday",$day);
         echo "</td></tr>\n";
@@ -210,29 +218,33 @@
            }
 
            if($id) {
-                mysql_query("UPDATE fundraising_donor_levels SET
+                $stmt = $pdo->prepare("UPDATE fundraising_donor_levels SET
-                    min='".mysql_real_escape_string($_POST['min'])."',
+                    min='".$_POST['min']."',
-                    max='".mysql_real_escape_string($_POST['max'])."',
+                    max='".$_POST['max']."',
-                    level='".mysql_real_escape_string(stripslashes($_POST['level']))."',
+                    level='".stripslashes($_POST['level'])."',
-                    description='".mysql_real_escape_string(stripslashes($_POST['description']))."'
+                    description='".stripslashes($_POST['description'])."'
                     WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'
                     ");
+                $stmt->execute();
                 happy_("Level Saved");
+
             }
             else {
-                mysql_query("INSERT INTO fundraising_donor_levels (`level`,`min`,`max`,`description`,`fiscalyear`) VALUES (
+                $stmt = $pdo->prepare("INSERT INTO fundraising_donor_levels (`level`,`min`,`max`,`description`,`fiscalyear`) VALUES (
-                '".mysql_real_escape_string($_POST['level'])."',
+                '".$_POST['level']."',
-                '".mysql_real_escape_string($_POST['min'])."',
+                '".$_POST['min']."',
-                '".mysql_real_escape_string($_POST['max'])."',
+                '".$_POST['max']."',
-                '".mysql_real_escape_string($_POST['description'])."',
+                '".$_POST['description']."',
                 '{$config['FISCALYEAR']}')");
+                $stmt->execute();
                 happy_("Level Created");
             }
         exit;
         break;
         case "level_delete":
            $id=$_POST['id'];
-           mysql_query("DELETE FROM fundraising_donor_levels WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'");
+           $stmt = $pdo->prepare("DELETE FROM fundraising_donor_levels WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'");
+           $stmt->execute();
            happy_("Level Deleted");
        exit;
        break;
@@ -244,32 +256,35 @@
                 exit;
            }
            if($id) {
-                mysql_query("UPDATE fundraising_goals SET
+                $stmt = $pdo->prepare("UPDATE fundraising_goals SET
-                    budget='".mysql_real_escape_string($_POST['budget'])."',
+                    budget='".$_POST['budget']."',
-                    deadline='".mysql_real_escape_string($_POST['deadline'])."',
+                    deadline='".$_POST['deadline']."',
-                    name='".mysql_real_escape_string(stripslashes($_POST['name']))."',
+                    name='".stripslashes($_POST['name'])."',
-                    description='".mysql_real_escape_string(stripslashes($_POST['description']))."'
+                    description='".stripslashes($_POST['description'])."'
                     WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'
                     ");
+                $stmt->execute();
                 happy_("Purpose Saved");
             }
             else {
                 $goal=strtolower($_POST['name']);
                 $goal=ereg_replace("[^a-z]","",$goal);
-                $q=mysql_query("SELECT * FROM fundraising_goals WHERE goal='$goal' AND fiscalyear='{$config['FISCALYEAR']}'");
+                $q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE goal='$goal' AND fiscalyear='{$config['FISCALYEAR']}'");
-                echo mysql_error();
+                $q->execute();
-                if(mysql_num_rows($q)) {
+                echo $pdo->errorInfo();
+                if($q->rowCount()) {
                     error_("The automatically generated purpose key (%1) generated from (%2) is not unique.  Please try a different Purpose Name",array($goal,$_POST['name']));
                     exit;
                 }
 
-                mysql_query("INSERT INTO fundraising_goals (`goal`,`name`,`budget`,`deadline`,`description`,`fiscalyear`) VALUES (
+                $stmt = $pdo->prepare("INSERT INTO fundraising_goals (`goal`,`name`,`budget`,`deadline`,`description`,`fiscalyear`) VALUES (
-                '".mysql_real_escape_string($goal)."',
+                '".$goal."',
-                '".mysql_real_escape_string($_POST['name'])."',
+                '".$_POST['name']."',
-                '".mysql_real_escape_string($_POST['budget'])."',
+                '".$_POST['budget']."',
-                '".mysql_real_escape_string($_POST['deadline'])."',
+                '".$_POST['deadline']."',
-                '".mysql_real_escape_string($_POST['description'])."',
+                '".$_POST['description']."',
                 '{$config['FISCALYEAR']}')");
+                $stmt->execute();
                 happy_("Purpose Created");
             }
         exit;
@@ -277,8 +292,9 @@
         case "goal_delete":
            $id=$_POST['id'];
            //they cant delete system ones
-           $q=mysql_query("SELECT * FROM fundraising_goals WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'");
+           $q=$pdo->prepare("SELECT * FROM fundraising_goals WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'");
-           if(!$r=mysql_fetch_object($q)) {
+           $q->execute();
+           if(!$r=$q->fetch(PDO::FETCH_OBJ)) {
                error_("Invalid goal to delete");
                exit;
            }
@@ -286,22 +302,30 @@
                error_("Fundraising goals created automatically and used by the system cannot be deleted");
                exit;
            }
-           $q=mysql_query("SELECT * FROM fundraising_donations WHERE fundraising_goal='$r->goal' AND fiscalyear='{$config['FISCALYEAR']}'");
+           $q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE fundraising_goal='$r->goal' AND fiscalyear='{$config['FISCALYEAR']}'");
-           if(mysql_num_rows($q)) {
+           $q->execute();
+           if($q->rowCount()) {
                error_("This goal already has donations assigned to it, it cannot be deleted");
                exit;
            }
 
-           mysql_query("DELETE FROM fundraising_goals WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'");
+           $stmt = $pdo->prepare("DELETE FROM fundraising_goals WHERE id='$id' AND fiscalyear='{$config['FISCALYEAR']}'");
+           $stmt->execute();
            happy_("Purpose Deleted");
        exit;
        break;
 
        case "setup_save":
        $fye=sprintf("%02d-%02d",intval($_POST['fiscalendmonth']),intval($_POST['fiscalendday']));
-       mysql_query("UPDATE config SET val='$fye' WHERE var='fiscal_yearend' AND conferences_id='{$conference['id']}'");
+       
-       mysql_query("UPDATE config SET val='".mysql_real_escape_string($_POST['registeredcharity'])."' WHERE var='registered_charity' AND conferences_id='{$conference['id']}'");
+       $stmt = $pdo->prepare("UPDATE config SET val='$fye' WHERE var='fiscal_yearend' AND year='{$config['FAIRYEAR']}'");
-       mysql_query("UPDATE config SET val='".mysql_real_escape_string($_POST['charitynumber'])."' WHERE var='charity_number' AND conferences_id='{$conference['id']}'");
+       $stmt->execute();
+
+       $stmt = $pdo->prepare("UPDATE config SET val='".$_POST['registeredcharity']."' WHERE var='registered_charity' AND year='{$config['FAIRYEAR']}'");
+       $stmt->execute();
+
+       $stmt = $pdo->prepare("UPDATE config SET val='".$_POST['charitynumber']."' WHERE var='charity_number' AND year='{$config['FAIRYEAR']}'");
+       $stmt->execute();
        happy_("Fundraising module setup saved");
        exit;
        break;

admin/fundraising_sponsorship.php

@@ -0,0 +1,157 @@
+<?
+/* 
+   This file is part of the 'Science Fair In A Box' project
+   SFIAB Website: http://www.sfiab.ca
+
+   Copyright (C) 2008 James Grant <james@lightbox.org>
+
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public
+   License as published by the Free Software Foundation, version 2.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.  If not, write to
+   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+   Boston, MA 02111-1307, USA.
+*/
+?>
+<?
+ require("../common.inc.php");
+ require_once("../user.inc.php");
+
+ user_auth_required('committee', 'admin');
+
+ if($_GET['id']) {
+	 $id=intval($_GET['id']);
+	 $q=$pdo->prepare("SELECT fundraising_donations.*, sponsors.organization FROM fundraising_donations,sponsors WHERE fundraising_donations.id='$id' AND fundraising_donations.sponsors_id=sponsors.id");
+	 $q->execute();
+	 $sponsorship=$q->fetch(PDO::FETCH_OBJ);
+	 $formaction="sponsorshipedit";
+ }
+ else
+ {
+	 $formaction="sponsorshipadd";
+	 $fundraising_type=$_GET['fundraising_type'];
+ }
+?>
+<script type="text/javascript">
+function typechange() { 
+    var t=($("[name=sponsortype]:checked").val());
+    if(t=="organization") {
+        $("#sponsor_type_organization").show();
+        $("#sponsor_type_individual").hide();
+    } else {
+        $("#sponsor_type_organization").hide();
+        $("#sponsor_type_individual").show();
+    }
+
+
+}
+</script>
+<?
+    echo "<form id=\"fundraisingsponsorship\">";
+	echo "<input type=\"hidden\" name=\"action\" value=\"$formaction\">";
+	echo "<input type=\"hidden\" name=\"fundraising_donations_id\" value=\"$id\">";
+	 echo "<table cellspacing=0 cellpadding=0 class=\"tableedit\">";
+
+	if($formaction=="sponsorshipadd") {
+        echo "<tr><th>".i18n("Donor Type")."</th>";
+        echo "<td>";
+         echo "<input onchange=\"typechange()\" type=\"radio\" name=\"sponsortype\" value=\"organization\"> ".i18n("Organization");
+         echo "&nbsp;"; echo "&nbsp;"; echo "&nbsp;";
+         echo "<input onchange=\"typechange()\" type=\"radio\" name=\"sponsortype\" value=\"individual\"> ".i18n("Individual");
+         echo "</td></tr>\n";
+
+         echo "<tr><th>".i18n("Donor")."</th>";
+         echo "<td>";
+
+	 $q=$pdo->prepare("SELECT * FROM sponsors ORDER BY organization");
+	 $q->execute();
+	 echo $pdo->errorInfo();
+     echo "<span id=\"sponsor_type_organization\" style=\"display: none;\">";
+	 echo "<select name=\"sponsors_id\">";
+	 echo "<option value=\"\">".i18n("Choose")."</option>\n";
+	 while($r=$q->fetch(PDO::FETCH_OBJ)) {
+		 if($r->id==$sponsorship->sponsors_id) $sel="selected=\"selected\""; else $sel="";
+		 echo "<option $sel value=\"$r->id\">$r->organization</option>\n";
+	 }
+	 echo "</select>&nbsp;<a href=\"donors.php?action=add\">".i18n("Add")."</a>\n";
+     echo "</span>";
+
+
+	 $q=$pdo->prepare("SELECT users.*, MAX(year) AS year FROM users WHERE (firstname!='' AND lastname!='') GROUP BY uid HAVING deleted='no' ORDER BY lastname,firstname");
+	 $q->execute();
+	 echo $pdo->errorInfo();
+     echo "<span id=\"sponsor_type_individual\" style=\"display: none;\">";
+	 echo "<select name=\"users_uid\">";
+	 echo "<option value=\"\">".i18n("Choose")."</option>\n";
+	 while($r=$q->fetch(PDO::FETCH_OBJ)) {
+		 if($r->uid==$sponsorship->users_uid) $sel="selected=\"selected\""; else $sel="";
+		 echo "<option $sel value=\"$r->uid\">[$r->year][$r->uid] $r->lastname, $r->firstname ($r->email)</option>\n";
+	 }
+     echo "</span>";
+
+
+
+	}
+	else {
+        echo "<tr><th>".i18n("Donor Type")."</th>";
+        echo "<td>";
+        if($sponsorship->sponsors_id) echo i18n("Organization");
+        else echo i18n("Individual");
+        echo "</td></tr>\n";
+
+        echo "<tr><th>".i18n("Donor")."</th>";
+        echo "<td>";
+        echo $sponsorship->organization;
+	}
+	 echo "</td></tr>\n";
+
+	 echo "<tr><th>".i18n("Donation Allocation")."</th>";
+	 echo "<td>";
+	 $q=$pdo->prepare("SELECT * FROM fundraising WHERE year='{$config['FAIRYEAR']}' ORDER BY name");
+	 $q->execute();
+	 echo $pdo->errorInfo();
+	 echo "<select name=\"fundraising_type\">";
+	 echo "<option value=\"\">".i18n("Choose")."</option>\n";
+	 while($r=$q->fetch(PDO::FETCH_OBJ)) {
+		 if($r->type==$sponsorship->fundraising_type || $r->type==$fundraising_type) $sel="selected=\"selected\""; else $sel="";
+		 echo "<option $sel value=\"$r->type\">$r->name</option>\n";
+	 }
+	 echo "</select>\n";
+	 echo "</td></tr>\n";
+	 echo "<tr><th>".i18n("Amount")."</th><td><input type=\"text\" name=\"value\" value=\"$sponsorship->value\"></td></tr>\n";
+
+	 echo "<tr><th>".i18n("Status")."</th>";
+	 echo "<td>";
+	 echo "<select name=\"status\">";
+	 echo "<option value=\"\">".i18n("Choose")."</option>\n";
+	 $statuses=array("pending","confirmed","received");
+	 foreach($statuses AS $status) {
+		 if($sponsorship->status==$status) $sel="selected=\"selected\""; else $sel="";
+		 echo "<option $sel value=\"$status\">".i18n(ucfirst($status))."</option>\n";
+	 }
+	 echo "</select>\n";
+	 echo "</td></tr>\n";
+
+	 echo "<tr><th>".i18n("Probability")."</th>";
+	 echo "<td>";
+	 echo "<select name=\"probability\">";
+	 echo "<option value=\"\">".i18n("Choose")."</option>\n";
+	 $probs=array("25","50","75","90","95","99","100");
+	 foreach($probs AS $prob) {
+		 if($sponsorship->probability==$prob) $sel="selected=\"selected\""; else $sel="";
+		 echo "<option $sel value=\"$prob\">$prob%</option>\n";
+	 }
+	 echo "</select>\n";
+	 echo "</td></tr>\n";
+
+	 echo "</table>\n";
+     echo "</form>\n";
+
+?>

admin/fundraising_sponsorship_handler.inc.php

@@ -1,7 +1,8 @@
 <?
 if($_POST['action']=="sponsorshipdelete") {
-	mysql_query("DELETE FROM fundraising_donations WHERE id='".intval($_POST['delete'])."'");
+	$stmt = $pdo->prepare("DELETE FROM fundraising_donations WHERE id='".intval($_POST['delete'])."'");
-	if(mysql_affected_rows())
+	$stmt->execute();
+	if($pdo->rowCount())
 		happy_("Successfully removed sponsorship");
    exit;
 }
@@ -9,11 +10,11 @@ if($_POST['action']=="sponsorshipdelete") {
 if($_POST['action']=="sponsorshipedit" || $_POST['action']=="sponsorshipadd") {
 	$sponsors_id=intval($_POST['sponsors_id']);
 	$fundraising_donations_id=intval($_POST['fundraising_donations_id']);
-	$fundraising_type=mysql_real_escape_string($_POST['fundraising_type']);
+	$fundraising_type=$_POST['fundraising_type'];
 	
-	$value=mysql_real_escape_string($_POST['value']);
+	$value=$_POST['value'];
-	$status=mysql_real_escape_string($_POST['status']);
+	$status=$_POST['status'];
-	$probability=mysql_real_escape_string($_POST['probability']);
+	$probability=$_POST['probability'];
 
 	if($status=="confirmed" || $status=="received") $probability="100";
 	if($probability==100 && $status=="pending") $status="confirmed";
@@ -22,8 +23,9 @@ if($_POST['action']=="sponsorshipedit" || $_POST['action']=="sponsorshipadd") {
 if($_POST['action']=="sponsorshipedit") {
 
 	if($fundraising_donations_id && $fundraising_type && $value) {
-		$q=mysql_query("SELECT * FROM fundraising_donations WHERE id='$fundraising_donations_id'");
+		$q=$pdo->prepare("SELECT * FROM fundraising_donations WHERE id='$fundraising_donations_id'");
-		$current=mysql_fetch_object($q);
+		$q->execute();
+		$current=$q->fetch(PDO::FETCH_OBJ);
 
 		unset($log);
 		$log=array();
@@ -40,18 +42,18 @@ if($_POST['action']=="sponsorshipedit") {
 			$log[]="Changed sponsorship probability from $current->probability to $probability";
 
 		if(count($log)) {
-			mysql_query("UPDATE fundraising_donations SET fundraising_type='$fundraising_type', value='$value', status='$status', probability='$probability' WHERE id='$fundraising_donations_id'");
+			$stmt = $pdo->prepare("UPDATE fundraising_donations SET fundraising_type='$fundraising_type', value='$value', status='$status', probability='$probability' WHERE id='$fundraising_donations_id'");
-
+			$stmt->execute();
 			foreach($log AS $l) {
-					mysql_query("INSERT INTO fundraising_donor_logs (sponsors_id,dt,users_id,log) VALUES (
+					$stmt = $pdo->prepare("INSERT INTO fundraising_donor_logs (sponsors_id,dt,users_id,log) VALUES (
 						'$current->sponsors_id',
 						NOW(),
 						'".$_SESSION['users_id']."',
-						'".mysql_real_escape_string($l)."')");
+						'".$l."')");
-
+					$stmt->execute();
 			}
-			if(mysql_error())
+			if($pdo->errorInfo())
-				echo error_(mysql_error());
+				echo error_($pdo->errorInfo());
 			else
                 echo happy_("Saved sponsorship changes");
 		}
@@ -65,18 +67,24 @@ if($_POST['action']=="sponsorshipedit") {
 }
 if($_POST['action']=="sponsorshipadd") {
 	if($sponsors_id && $fundraising_type && $value) {
-		mysql_query("INSERT INTO fundraising_donations (sponsors_id,fundraising_type,value,status,probability,fiscalyear) VALUES ('$sponsors_id','$fundraising_type','$value','$status','$probability','{$config['FISCALYEAR']}')");
+		
-		mysql_query("INSERT INTO fundraising_donor_logs (sponsors_id,dt,users_id,log) VALUES (
+		
+		$stmt = $pdo->prepare("INSERT INTO fundraising_donations (sponsors_id,fundraising_type,value,status,probability,fiscalyear) VALUES ('$sponsors_id','$fundraising_type','$value','$status','$probability','{$config['FISCALYEAR']}')");
+		$stmt->execute();
+
+		
+		$stmt = $pdo->prepare("INSERT INTO fundraising_donor_logs (sponsors_id,dt,users_id,log) VALUES (
+		$stmt->execute();
 			'$sponsors_id',
 			NOW(),
 			'".$_SESSION['users_id']."',
-			'".mysql_real_escape_string("Created sponsorship: type=$fundraising_type, value=\$$value, status=$status, probability=$probability%")."')");
+			'"."Created sponsorship: type=$fundraising_type, value=\$$value, status=$status, probability=$probability%")."')";
 		happy_("Added new sponsorship");
 	}
 	else
 		error_("Required fields were missing, please try again");
-	if(mysql_error())
+	if($pdo->errorInfo())
-		error_(mysql_error());
+		error_($pdo->errorInfo());
    exit;
 }
 

admin/fundraising_types.php

@@ -24,13 +24,14 @@
 	require("../common.inc.php");
 	require_once("../user.inc.php");
 
-	user_auth_required('admin');
+	user_auth_required('committee', 'admin');
 
 	if($_GET['id']) {
 		$id=intval($_GET['id']);
-		$q=mysql_query("SELECT * FROM fundraising WHERE id='$id'");
+		$q=$pdo->prepare("SELECT * FROM fundraising WHERE id='$id'");
+		$q->execute();
 	//	echo "<h2>Edit Fund</h2>";
-		$fund=mysql_fetch_object($q);
+		$fund=$q->fetch(PDO::FETCH_OBJ);
 		$formaction="fundedit";
 	}
 	else {

admin/gettranslation.php

@@ -24,15 +24,16 @@
 <?
 include "../common.inc.php";
 require_once("../user.inc.php");
-user_auth_required('admin');
+user_auth_required('committee', 'admin');
 $ret=array();
 foreach($config['languages'] AS $l=>$ln) {
 	if($l==$config['default_language']) continue;
-	$q=mysql_query("SELECT * FROM translations WHERE lang='$l' AND strmd5='".md5($_GET['str'])."'");
+	$q=$pdo->prepare("SELECT * FROM translations WHERE lang='$l' AND strmd5='".md5(iconv("ISO-8859-1","UTF-8",$_GET['str']))."'");
-	if($r=mysql_fetch_object($q))
+	$q->execute();
-	        $ret[$l]=$r->val;
+        if($r=$q->fetch(PDO::FETCH_OBJ))
+        $ret[$l]=iconv("ISO-8859-1","UTF-8",$r->val);
 	else
-        	$ret[$l]="";
+        $ret[$l]="";
 }
 echo json_encode($ret);
 ?>

admin/index.php

@@ -26,121 +26,69 @@
  require_once("../user.inc.php");
  require_once("../committee.inc.php");
 
- user_auth_required('admin');
+
+ user_auth_required('committee','admin');
 
  send_header("Administration",
  	array('Committee Main' => 'committee_main.php'),
 	"administration");
 
- if($conference['type']=='sciencefair') {
-	 echo "<table class=\"adminconfigtable\">";
-	 echo " <tr>";
-	 echo "  <td><a href=\"registration.php\">".theme_icon("participant_registration")."<br />".i18n("Participant Registration")."</a></td>";
-	 echo "  <td><a href=\"committees.php\">".theme_icon("committee_management")."<br />".i18n("Committee Management")."</a></td>";
-	 echo "  <td><a href=\"judges.php\">".theme_icon("judging_management")."<br />".i18n("Judging Management")."</a></td>";
-	 echo "  <td><a href=\"account_list.php\">".theme_icon("account_management")."<br />".i18n("Account Management")."</a></td>";
-	 echo "  <td>";
-	 if($config['volunteer_enable'] == 'yes')
-		echo "<a href=\"volunteers.php\">".theme_icon("volunteer_management")."<br />".i18n("Volunteer Management")."</a>";
-	 else
-		echo theme_icon("volunteer_management")."<br />".i18n("Volunteer Management")."<br /><i>(".i18n("disabled").")</i>";
-	 echo "</td></tr>";
-	 echo "</table>\n";
-	 echo "<hr />";
-	 echo "<table class=\"adminconfigtable\">";
-	 echo " <tr>";
-	 echo "  <td><a href=\"awards.php\">".theme_icon("awards_management")."<br />".i18n("Awards Management")."</a></td>";
-	 echo "  <td><a href=\"schools.php\">".theme_icon("schools_management")."<br />".i18n("Schools Management")."</a></td>";
-	 echo "  <td>";
-	 if($config['tours_enable'] == 'yes')
-		echo "<a href=\"tours.php\">".theme_icon("tour_management")."<br />".i18n("Tour Management")."</a>";
-	 else
-		echo theme_icon("tour_management")."<br />".i18n("Tour Management")."<br /><i>(".i18n("disabled").")</i>";
-	 echo "</td>";
-	 echo "  <td>";
-	 if($config['participant_regfee_items_enable'] == 'yes')
-		echo "<a href=\"regfee_items_manager.php\">".theme_icon("registration_fee_items_management")."<br />".i18n("Registration Fee Items Management")."</a>";
-	 else
-		echo theme_icon("registration_fee_items_management")."<br />".i18n("Registration Fee Items Management")."<br /><i>(".i18n("disabled").")</i>";
-	 echo "</td>";
-	 echo " </tr>\n";
-	 echo " <tr>";
-	 echo "  <td><a href=\"reports.php\">".theme_icon("print/export_reports")."<br />".i18n("Print / Export Reports")."</a></td>";
-	 echo "  <td><a href=\"reports_ceremony.php\">".theme_icon("print_awards_ceremony_scripts")."<br />".i18n("Print Award Ceremony Scripts")."</a></td>";
-	 echo "  <td><a href=\"reports_editor.php\">".theme_icon("report_management")."<br />".i18n("Report Management")."</a></td>";
-	 echo "  <td><a href=\"translations.php\">".theme_icon("translations_management")."<br />".i18n("Translations Management")."</a></td>";
-	 echo "  <td>";
-	 echo "</td>";
-	 echo " </tr>\n";
-	 echo " <tr>";
-	 echo "<td></td><td></td>\n";
-	 echo " </tr>\n";
-	 echo "</table>\n";
-	 echo "<hr />";
-	 echo "<table class=\"adminconfigtable\">";
-	 echo " <tr>";
-	 if($config['score_entry_enable'] == 'yes') {
-		echo "<td><a href=\"judging_score_entry.php\">".theme_icon("judging_score_entry")."<br />".i18n("Judging Score Entry")."</a></td>";
-	 }
-	 echo "  <td><a href=\"winners.php\">".theme_icon("enter_winning_projects")."<br />".i18n("Enter Winning Projects")."</a></td>";
-	 echo "  <td><a href=\"cwsfregister.php\">".theme_icon("one-click_cwsf_registration")."<br />".i18n("One-Click CWSF Registration")."</a></td>";
-	 echo "  <td><a href=\"fair_stats.php\">".theme_icon("fair_stats")."<br />".i18n("Upload Fair Statistics")."</a></td>";
-	 echo "  <td><a href=\"user_list.php?show_types[]=fair\">".theme_icon("sciencefair_management")."<br />".i18n("Feeder/Upstream Fair Management")."</a></td>";
-	 echo " </tr>\n";
-	 echo "</table>\n";
- }
- else {
-	 echo "<table class=\"adminconfigtable\">";
-	 echo " <tr>";
-	 echo "  <td><a href=\"eventsscheduling.php\">".theme_icon("events_management")."<br />".i18n("Events & Scheduling")."</a></td>";
-	 echo "  <td><a href=\"registration.php\">".theme_icon("participant_registration")."<br />".i18n("Participant Registration")."</a></td>";
-	 echo "  <td><a href=\"committees.php\">".theme_icon("committee_management")."<br />".i18n("Committee Management")."</a></td>";
-	 echo "  <td><a href=\"judges.php\">".theme_icon("judging_management")."<br />".i18n("Judging Management")."</a></td>";
-	 echo "  <td>";
-	 if($config['volunteer_enable'] == 'yes')
-		echo "<a href=\"volunteers.php\">".theme_icon("volunteer_management")."<br />".i18n("Volunteer Management")."</a>";
-	 else
-		echo theme_icon("volunteer_management")."<br />".i18n("Volunteer Management")."<br /><i>(".i18n("disabled").")</i>";
-	 echo "</td></tr>";
-	 echo "</table>\n";
-	 echo "<hr />";
-	 echo "<table class=\"adminconfigtable\">";
-	 echo " <tr>";
-	 echo "  <td><a href=\"awards.php\">".theme_icon("awards_management")."<br />".i18n("Awards Management")."</a></td>";
-	 echo "  <td><a href=\"schools.php\">".theme_icon("schools_management")."<br />".i18n("Schools Management")."</a></td>";
-	 echo "  <td>";
-	 if($config['tours_enable'] == 'yes')
-		echo "<a href=\"tours.php\">".theme_icon("tour_management")."<br />".i18n("Tour Management")."</a>";
-	 else
-		echo theme_icon("tour_management")."<br />".i18n("Tour Management")."<br /><i>(".i18n("disabled").")</i>";
-	 echo "</td>";
-	 echo "  <td>";
-	 if($config['participant_regfee_items_enable'] == 'yes')
-		echo "<a href=\"regfee_items_manager.php\">".theme_icon("registration_fee_items_management")."<br />".i18n("Registration Fee Items Management")."</a>";
-	 else
-		echo theme_icon("registration_fee_items_management")."<br />".i18n("Registration Fee Items Management")."<br /><i>(".i18n("disabled").")</i>";
-	 echo "</td>";
-	 echo " </tr>\n";
-	 echo " <tr>";
-	 echo "  <td><a href=\"reports.php\">".theme_icon("print/export_reports")."<br />".i18n("Print / Export Reports")."</a></td>";
-	 echo "  <td><a href=\"reports_ceremony.php\">".theme_icon("print_awards_ceremony_scripts")."<br />".i18n("Print Award Ceremony Scripts")."</a></td>";
-	 echo "  <td><a href=\"reports_editor.php\">".theme_icon("report_management")."<br />".i18n("Report Management")."</a></td>";
-	 echo "  <td><a href=\"translations.php\">".theme_icon("translations_management")."<br />".i18n("Translations Management")."</a></td>";
-	 echo "  <td>";
-	 echo "</td>";
-	 echo " </tr>\n";
-	 echo " <tr>";
-	 echo "<td></td><td></td>\n";
-	 echo " </tr>\n";
-	 echo "</table>\n";
-	 echo "<hr />";
-	 echo "<table class=\"adminconfigtable\">";
-	 echo " <tr>";
-	 echo "  <td><a href=\"winners.php\">".theme_icon("enter_winning_projects")."<br />".i18n("Enter Winners")."</a></td>";
-	 echo " </tr>\n";
-	 echo "</table>\n";
- }
 
+
+ echo "<table class=\"adminconfigtable\">";
+ echo " <tr>";
+ echo "  <td><a href=\"registration.php\">".theme_icon("participant_registration")."<br />".i18n("Participant Registration")."</a></td>";
+ echo "  <td><a href=\"committees.php\">".theme_icon("committee_management")."<br />".i18n("Committee Management")."</a></td>";
+ echo "  <td><a href=\"judges.php\">".theme_icon("judging_management")."<br />".i18n("Judging Management")."</a></td>";
+ echo "  <td>";
+ if($config['volunteer_enable'] == 'yes')
+	echo "<a href=\"volunteers.php\">".theme_icon("volunteer_management")."<br />".i18n("Volunteer Management")."</a>";
+ else
+	echo theme_icon("volunteer_management")."<br />".i18n("Volunteer Management")."<br /><i>(".i18n("disabled").")</i>";
+ echo "</td></tr>";
+ echo "</table>\n";
+ echo "<hr />";
+ echo "<table class=\"adminconfigtable\">";
+ echo " <tr>";
+ echo "  <td><a href=\"awards.php\">".theme_icon("awards_management")."<br />".i18n("Awards Management")."</a></td>";
+ echo "  <td><a href=\"schools.php\">".theme_icon("schools_management")."<br />".i18n("Schools Management")."</a></td>";
+ echo "  <td>";
+ if($config['tours_enable'] == 'yes')
+ 	echo "<a href=\"tours.php\">".theme_icon("tour_management")."<br />".i18n("Tour Management")."</a>";
+ else
+ 	echo theme_icon("tour_management")."<br />".i18n("Tour Management")."<br /><i>(".i18n("disabled").")</i>";
+ echo "</td>";
+ echo "  <td>";
+ if($config['participant_regfee_items_enable'] == 'yes')
+ 	echo "<a href=\"regfee_items_manager.php\">".theme_icon("registration_fee_items_management")."<br />".i18n("Registration Fee Items Management")."</a>";
+ else
+ 	echo theme_icon("registration_fee_items_management")."<br />".i18n("Registration Fee Items Management")."<br /><i>(".i18n("disabled").")</i>";
+ echo "</td>";
+ echo " </tr>\n";
+ echo " <tr>";
+ echo "  <td><a href=\"reports.php\">".theme_icon("print/export_reports")."<br />".i18n("Print / Export Reports")."</a></td>";
+ echo "  <td><a href=\"reports_ceremony.php\">".theme_icon("print_awards_ceremony_scripts")."<br />".i18n("Print Award Ceremony Scripts")."</a></td>";
+ echo "  <td><a href=\"reports_editor.php\">".theme_icon("report_management")."<br />".i18n("Report Management")."</a></td>";
+ echo "  <td><a href=\"translations.php\">".theme_icon("translations_management")."<br />".i18n("Translations Management")."</a></td>";
+ echo "  <td>";
+ echo "</td>";
+ echo " </tr>\n";
+ echo " <tr>";
+ echo "<td></td><td></td>\n";
+ echo " </tr>\n";
+ echo "</table>\n";
+ echo "<hr />";
+ echo "<table class=\"adminconfigtable\">";
+ echo " <tr>";
+ echo "  <td><a href=\"winners.php\">".theme_icon("enter_winning_projects")."<br />".i18n("Enter Winning Projects")."</a></td>";
+ echo "  <td><a href=\"cwsfregister.php\">".theme_icon("one-click_cwsf_registration")."<br />".i18n("One-Click CWSF Registration")."</a></td>";
+ echo "  <td><a href=\"fair_stats.php\">".theme_icon("fair_stats")."<br />".i18n("Upload Fair Statistics")."</a></td>";
+ echo "  <td><a href=\"user_list.php?show_types[]=fair\">".theme_icon("sciencefair_management")."<br />".i18n("Feeder/Upstream Fair Management")."</a></td>";
+if($config['score_entry_enable'] == 'yes') {
+ echo "<td><a href=\"judging_score_entry.php\">".theme_icon("judging_score_entry")."<br />".i18n("Judging Score Entry")."</a></td>";
+ }
+ echo " </tr>\n";
+ echo "</table>\n";
  echo "<hr />";
  echo "<table class=\"adminconfigtable\">";
  echo " <tr>";
@@ -148,7 +96,10 @@
  echo "  <td><a href=\"documents.php\">".theme_icon("internal_document_management")."<br />".i18n("Internal Document Management")."</a></td>";
  echo "  <td><a href=\"cms.php\">".theme_icon("website_content_management")."<br />".i18n("Website Content Management")."</a></td>";
  echo "  <td><a href=\"fundraising.php\">".theme_icon("fundraising")."<br />".i18n("Fundraising")."</a></td>";
- echo "  <td></td>";
+ if($config['score_entry_enable'] == 'yes') {
+ echo "<td><a href=\"../plugins/evaluations/index.php\">".theme_icon("judging_score_entry")."<br />".i18n("Evaluations Plugin")."</a></td>"; 
+ }
+ //echo "  <td><a href=\"../plugins/evaluations/index.php\">Go To Evaluations</a></td>";
  echo " </tr>\n";
  echo "</table>\n";
 

admin/judges.inc.php

@@ -1,24 +1,25 @@
 <?
 function getJudgingTeams()
 {
-	global $config, $conference;
+	global $config;
 
-	$q=mysql_query("SELECT 	judges_teams.id,
+	$q=$pdo->prepare("SELECT 	judges_teams.id,
 				judges_teams.num,
 				judges_teams.name
 			FROM 
 				judges_teams
 			WHERE 
-				judges_teams.conferences_id='".$conference['id']."'
+				judges_teams.year='".$config['FAIRYEAR']."'
 			ORDER BY 
 				num,name
 				");
+	$q->execute();
 
 	$lastteamid=-1;
 	$lastteamnum=-1;
-	echo mysql_error();
+	echo $pdo->errorInfo();
 	$teams=array();
-	while($r=mysql_fetch_object($q))
+	while($r=$q->fetch(PDO::FETCH_OBJS))
 	{
 		$teams[$r->id]['id']=$r->id;
 		$teams[$r->id]['num']=$r->num;
@@ -28,22 +29,24 @@ function getJudgingTeams()
 
 		/* Load timeslots */
 		$rounds = array();
-		$tq = mysql_query("SELECT * FROM judges_teams_timeslots_link
+		$tq = $pdo->prepare("SELECT * FROM judges_teams_timeslots_link
 					LEFT JOIN judges_timeslots ON judges_timeslots.id=judges_teams_timeslots_link.judges_timeslots_id
 					WHERE judges_teams_timeslots_link.judges_teams_id='{$r->id}'");
+		tq->execute();
 		$teams[$r->id]['timeslots'] = array();
 		$teams[$r->id]['rounds'] = array();
-		while($ts = mysql_fetch_assoc($tq)) {
+		while($ts = $tq->fetch(PDO::FETCH_ASSOC)) {
 			$teams[$r->id]['timeslots'][] = $ts;
 			$rounds[$ts['round_id']] = $ts['round_id'];
 		}
 		foreach($rounds as $round_id) {
-			$tq = mysql_query("SELECT * FROM judges_timeslots WHERE id='{$round_id}'");
+			$tq = $pdo->prepare("SELECT * FROM judges_timeslots WHERE id='{$round_id}'");
-			$teams[$r->id]['rounds'][] = mysql_fetch_assoc($tq);
+			$tq->execute();
+			$teams[$r->id]['rounds'][] = $tq->fetch(PDO::FETCH_ASSOC);
 		}
 
 		//get the members for this team
-		$mq=mysql_query("SELECT 	
+		$mq=$pdo->prepare("SELECT 	
 			users.id AS judges_id,
 			users.firstname,
 			users.lastname,
@@ -59,11 +62,12 @@ function getJudgingTeams()
 			captain DESC,
 			lastname,
 			firstname");
-		echo mysql_error();
+		$mq->execute();
+		echo $pdo->errorInfo();
 
 		
         $teamlangs=array();
-		while($mr=mysql_fetch_object($mq))
+		while($mr=$mq->fetch(PDO::FETCH_OBJ))
 		{
 			$u = user_load($mr->judges_id, false);
 			$judgelangs = join('/', $u['languages']);
@@ -84,14 +88,15 @@ function getJudgingTeams()
         $teams[$r->id]['languages_members']=$teamlangs;
 
 		//we also need to add all the languages that the team must JUDGE to the teams languages.
-		$lq=mysql_query("SELECT projects.language
+		$lq=$pdo->prepare("SELECT projects.language
 			FROM judges_teams_timeslots_projects_link 
 			LEFT JOIN projects ON judges_teams_timeslots_projects_link.projects_id=projects.id
-			WHERE judges_teams_timeslots_projects_link.conferences_id='{$conference['id']}' AND
+			WHERE judges_teams_timeslots_projects_link.year='{$config['FAIRYEAR']}' AND
-			judges_teams_id='$r->id' ");
+			judges_teams_id='$r->id' AND language!='' ");
-		echo mysql_error();
+		$lq->execute();
+		echo $pdo->errorInfo();
 		$projectlangs=array();
-		while($lr=mysql_fetch_object($lq)) {
+		while($lr=$lq->fetch(PDO::FETCH_OBJ)) {
 			if(!in_array($lr->language,$projectlangs))
 				$projectlangs[]=$lr->language;
 			if(!in_array($lr->language,$teamlangs))
@@ -101,7 +106,7 @@ function getJudgingTeams()
         $teams[$r->id]['languages']=$teamlangs;
 
 		//get the awards for this team
-		$aq=mysql_query("SELECT award_awards.id,
+		$aq=$pdo->prepare("SELECT award_awards.id,
 					award_awards.name,
 					award_awards.criteria,
 					award_awards.award_types_id,
@@ -114,11 +119,12 @@ function getJudgingTeams()
 					judges_teams_awards_link.award_awards_id=award_awards.id
 					AND judges_teams_awards_link.judges_teams_id='$r->id'
 					AND award_awards.award_types_id=award_types.id
-					AND award_types.conferences_id='{$conference['id']}'
+					AND award_types.year='{$config['FAIRYEAR']}'
 				ORDER BY
 					name
 				");
-		while($ar=mysql_fetch_object($aq))
+			$aq->execute();
+		while($ar=$aq->fetch(PDO::FETCH_OBJ))
 		{
 			$teams[$r->id]['awards'][]=array(
 					"id"=>$ar->id,
@@ -136,31 +142,32 @@ function getJudgingTeam($teamid)
 {
 	global $config;
 
-	$q=mysql_query("SELECT 	judges_teams.id,
+	$q=$pdo->prepare("SELECT 	judges_teams.id,
 				judges_teams.num,
 				judges_teams.name
 				
 			FROM 
 				judges_teams
 			WHERE 
-				judges_teams.conferences_id='".$conference['id']."' AND
+				judges_teams.year='".$config['FAIRYEAR']."' AND
 				judges_teams.id='$teamid'
 			ORDER BY 
 				num,
 				name
 				");
+	$q->execute();
 
 	$team=array();
 
 	$first=true;
-	while($r=mysql_fetch_object($q))
+	while($r=$q->fetch(PDO::FETCH_OBJS))
 	{
 		$team['id']=$r->id;
 		$team['num']=$r->num;
 		$team['name']=$r->name;
 
 		//get the members for this team
-		$mq=mysql_query("SELECT 	
+		$mq=$pdo->prepare("SELECT 	
 			users.id AS judges_id,
 			users.firstname,
 			users.lastname,
@@ -176,10 +183,11 @@ function getJudgingTeam($teamid)
 			captain DESC,
 			lastname,
 			firstname");
-		echo mysql_error();
+		$mq->execute();
+		echo $pdo->errorInfo();
 
 		
-		while($mr=mysql_fetch_object($mq))
+		while($mr=$mq->fetch(PDO::FETCH_OBJ))
 		{
 			$team['members'][]=array(
 				"id"=>$mr->judges_id,
@@ -191,7 +199,7 @@ function getJudgingTeam($teamid)
 
 
 		//get the awards for this team
-		$aq=mysql_query("SELECT award_awards.id,
+		$aq=$pdo->prepare("SELECT award_awards.id,
 					award_awards.name,
 					award_awards.award_types_id,
 					award_types.type AS award_type
@@ -203,11 +211,12 @@ function getJudgingTeam($teamid)
 					judges_teams_awards_link.award_awards_id=award_awards.id
 					AND judges_teams_awards_link.judges_teams_id='$r->id'
 					AND award_awards.award_types_id=award_types.id
-					AND award_types.conferences_id='{$conference['id']}'
+					AND award_types.year='{$config['FAIRYEAR']}'
 				ORDER BY
 					name
 				");
-		while($ar=mysql_fetch_object($aq))
+		$aq->execute();
+		while($ar=$aq->fetch(PDO::OBJ))
 		{
 			$team['awards'][]=array(
 					"id"=>$ar->id,
@@ -250,14 +259,13 @@ function judges_load_all()
 
 	$ret = array();
 
-	$r = mysql_query("
+	$query = "SELECT id FROM users WHERE types LIKE '%judge%' 
-		SELECT users.id FROM users JOIN user_roles ur ON ur.users_id = users.id
+				AND year='{$config['FAIRYEAR']}'
-		JOIN roles ON roles.id = ur.roles_id WHERE roles.type = 'judge'
+				AND deleted='no'
-		AND conferences_id='{$conference['id']}'
+				ORDER BY lastname, firstname";
-		AND deleted='no'
+	$r = $pdo->prepare($query);
-		ORDER BY lastname, firstname
+	$r->execute();
-	");
+	while($i = $r->fetch(PDO::FETCH_ASSOC)) {
-	while($i = mysql_fetch_assoc($r)) {
 		$u = user_load($i['id']);
 		if($u['judge_complete'] == 'no') continue;
 		if($u['judge_active'] == 'no') continue;

admin/judges.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  send_header("Judges", 
  		array('Committee Main' => 'committee_main.php',

admin/judges_info.php

@@ -29,7 +29,7 @@
 
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
 $preferencechoices=array(
 	-2=>"Very Low",
@@ -43,8 +43,8 @@ $preferencechoices=array(
 $id = intval($_GET['id']);
 $judgeinfo = user_load($id);
 
-echo '<div style="text-align:center; padding: 5px;">';
 send_popup_header("Judge Information");
+echo '<div style="text-align:center; padding: 5px;">';
 
  if($id < 1) {
 	echo error(i18n("No Judge ID passed to Judges Info"));
@@ -105,9 +105,10 @@ send_popup_header("Judge Information");
 // get their availability
 $availabilityText = "";
 if($config['judges_availability_enable'] == 'yes'){
-	$q = mysql_query("SELECT * FROM judges_availability WHERE users_id=\"{$judgeinfo['id']}\" ORDER BY `start`");
+	$q = $pdo->prepare("SELECT * FROM judges_availability WHERE users_id=\"{$judgeinfo['id']}\" ORDER BY `start`");
+	$q->execute();
 	$sel = array();
-	while($r=mysql_fetch_object($q)) {
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		$st = substr($r->start, 0, 5);
 		$end = substr($r->end, 0, 5);
 		$availabilityText .= "<li>$st - $end</li>";
@@ -121,7 +122,8 @@ if($config['judges_availability_enable'] == 'yes'){
 echo '<div style="text-align:left">';
 
 // is their info complete?
-$completeText = $judgeinfo['complete']=="yes" ? "Yes" : "No";
+$completeText = $judgeinfo['judge_complete']=="yes" ? "Yes" : "No";
+$activeText = $judgeinfo['judge_active']=="yes" ? "Yes" : "No";
 
 // find out if they've signed up for judging any special awards
 $specialAwardsText = "";
@@ -130,8 +132,9 @@ if($judgeinfo['special_award_only'] == "yes"){
 		. " JOIN users ON jss.users_id = users.id"
 		. " JOIN award_awards aa ON aa.id = jss.award_awards_id"
 		. " WHERE users.id=" . $id;
-	$results = mysql_query($query);
+	$results = $pdo->prepare($query);
-	while($record = mysql_fetch_array($results)){
+	$results.execute();
+	while($record = $results.fetch()){
 		$awardList[] = $record['awardname'];
 	}
 	$specialAwardsText .= implode(', ', $awardList);
@@ -141,10 +144,11 @@ if($judgeinfo['special_award_only'] == "yes"){
 }
 
 // get their preference for age category
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='{$conference['id']}'");
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='{$config['FAIRYEAR']}'");
+$q->execute();
 
-$catPreferenceText =  mysql_error() . "<ul>";
+$catPreferenceText =  $pdo->errorInfo() . "<ul>";
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$p = intval($judgeinfo['cat_prefs'][$r->id]);
 	$catPreferenceText .= "<li><em>" . i18n($r->category)."</em>: {$preferencechoices[$p]}</li>";
 }
@@ -156,7 +160,10 @@ $catPreferenceText .= "</ul>";
 	<tr><td>
 		<ul>
 
-			<li><strong><?="Complete for {$conference['name']}";?>: </strong>
+			<li><strong><?="Active for {$config['FAIRYEAR']}";?>: </strong>
+			<?=$activeText;?></li>
+
+			<li><strong><?="Complete for {$config['FAIRYEAR']}";?>: </strong>
 			<?=$completeText;?></li>
 
 			<li><strong><?=i18n("Special awards");?>: </strong>
@@ -182,9 +189,10 @@ $catPreferenceText .= "</ul>";
 <?php
 
 //grab the list of divisions, because the last fields of the table will be the sub-divisions 
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conference['id']}' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='{$config['FAIRYEAR']}' ORDER BY id");
+$q->execute();
 $divs=array();
-while($r=mysql_fetch_object($q))
+while($r=$q->fetch(PDO::FETCH_OBJ))
 {
 	$divs[]=$r->id;
 	$divnames[$r->id]=$r->division;
@@ -197,10 +205,11 @@ foreach($divs as $div)
 	echo " <td>$p/5</td>";
 
 	echo "<td>";
-	$subq=mysql_query("SELECT * FROM projectsubdivisions WHERE 
+	$subq=$pdo->prepare("SELECT * FROM projectsubdivisions WHERE 
-				projectdivisions_id='$div' AND conferences_id='{$conference['id']}' ORDER BY subdivision");
+				projectdivisions_id='$div' AND year='{$config['FAIRYEAR']}' ORDER BY subdivision");
+	$subq->execute();
 	$sd = array();
-	while($subr=mysql_fetch_object($subq)) {
+	while($subr=$subq->fetch(PDO::FETCH_OBJ)) {
 		if($u['div_prefs_sub'][$subr->id] == 1) {
 			$sd[] = $subdivr->subdivision;
 		}
@@ -238,7 +247,7 @@ echo "<tr>\n";
 echo " <th valign=\"top\" align=\"right\" colspan=\"2\">".i18n("Time Availability").":</th><td colspan=\"2\">";
 $q = mysql_query("SELECT * FROM judges_availability WHERE users_id=\"{$judgeinfo['id']}\" ORDER BY `start`");
 $sel = array();
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$st = substr($r->start, 0, 5);
 	$end = substr($r->end, 0, 5);
 	echo "$st - $end<br />";

admin/judges_invite.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  include "judges.inc.php";
 
  send_header("Invite Judges",
@@ -35,15 +35,17 @@
  echo "<br />";
  if($_POST['action']=="invite" && $_POST['email'])
  {
- 	$q=mysql_query("SELECT id FROM judges WHERE email='".$_POST['email']."'");
+ 	$q=$pdo->prepare("SELECT id FROM judges WHERE email='".$_POST['email']."'");
-	if(mysql_num_rows($q))
+	$q->execute();
+	if($q->rowCount())
 	{
 		echo error(i18n("A judge already exists with that email address"));
 	}
 	else
 	{
 		$pass=generatePassword();
-		mysql_query("INSERT INTO judges (email,password) VALUES ('".mysql_escape_string(stripslashes($_POST['email']))."','$pass')");
+		$pdo->prepare("INSERT INTO judges (email,password) VALUES ('".stripslashes($_POST['email']))."','$pass')";
+		$pdo->execute();
 		email_send("new_judge_invite",stripslashes($_POST['email']),array("FAIRNAME"=>$config['fairname']),array("FAIRNAME"=>$config['fairname'],"EMAIL"=>stripslashes($_POST['email']),"PASSWORD"=>$pass));
 
 		echo happy(i18n("%1 has been invited to be a judge",array($_POST['email'])));

admin/judges_jdiv.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  include "judges.inc.php";
 
  send_header("Judging Division Groupings",
@@ -56,15 +56,17 @@ function newbuttonclicked(jdivs)
 
 	$div = array();
 	$divshort = array();
-	$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='".$conference['id']."' ORDER BY id");
+	$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-	while($r=mysql_fetch_object($q)) {
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		$divshort[$r->id]=$r->division_shortform;
 		$div[$r->id]=$r->division;
 	}
 
 	$cat = array();
-	$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='".$conference['id']."' ORDER BY id");
+	$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-	while($r=mysql_fetch_object($q)) {
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		$cat[$r->id]=$r->category;
 	}
 
@@ -72,9 +74,10 @@ function newbuttonclicked(jdivs)
 	$ckeys = array_keys($cat);
 
 	if($config['filterdivisionbycategory']=="yes") {
-		$q=mysql_query("SELECT * FROM projectcategoriesdivisions_link WHERE conferences_id='".$conference['id']."' ORDER BY projectdivisions_id,projectcategories_id");
+		$q=$pdo->prepare("SELECT * FROM projectcategoriesdivisions_link WHERE year='".$config['FAIRYEAR']."' ORDER BY projectdivisions_id,projectcategories_id");
+		$q->execute();
 		$divcat=array();
-		while($r=mysql_fetch_object($q)) {
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			$divcat[]=array("c"=>$r->projectcategories_id,"d"=>$r->projectdivisions_id);
 		}
 
@@ -89,22 +92,24 @@ function newbuttonclicked(jdivs)
 	}
 	
 	$langr = array();
-	$q=mysql_query("SELECT * FROM languages WHERE active='Y'");
+	$q=$pdo->prepare("SELECT * FROM languages WHERE active='Y'");
-	while($r=mysql_fetch_object($q)) {
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		$langr[$r->lang] = $r->langname;
 	}
 
 
 function get_all_divs()
 {
-	global $config, $conference;
+	global $config;
 	global $divshort, $div,$cat, $langr;
 	global $divcat;
 
 	$cdlcheck = array();
 	$cdl = array();
-	$q=mysql_query("SELECT * FROM judges_jdiv");
+	$q=$pdo->prepare("SELECT * FROM judges_jdiv");
-	while($r=mysql_fetch_object($q)) {
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		$cdl[$r->id]['id'] = $r->id;
 		$cdl[$r->id]['jdiv'] = $r->jdiv_id;
 		$cdl[$r->id]['div'] = $r->projectdivisions_id;
@@ -128,13 +133,15 @@ function get_all_divs()
 
 			/* Also, make an entry in the DB, so that this isn't 
 			 * unassigned anymore */
-			mysql_query("INSERT INTO judges_jdiv (id, jdiv_id, projectdivisions_id, projectcategories_id, lang) ".
+			$stmt = $pdo->prepare("INSERT INTO judges_jdiv (id, jdiv_id, projectdivisions_id, projectcategories_id, lang) ".
 					" VALUES('', 0, '$y', '$x', '$z')"); 
-			$q = mysql_query("SELECT id FROM judges_jdiv WHERE ".
+			$stmt->execute();
+			$q = $pdo->prepare("SELECT id FROM judges_jdiv WHERE ".
 					" projectdivisions_id='$y' ".
 					" AND projectcategories_id='$x' ".
 					" AND lang='$z' ");
-			$r = mysql_fetch_object($q);
+			$q->execute();
+			$r = $q->fetch(PDO::FETCH_OBJ);
 
 			$cdl[$r->id]['id'] = $r->id;
 			$cdl[$r->id]['jdiv'] = 0; /* Unassigned */
@@ -153,16 +160,17 @@ function get_all_divs()
 		$x = $cat[$cdl[$id]['cat']];
 		$y = $divshort[$cdl[$id]['div']];
 		$z = $div[$cdl[$id]['div']];
-		$q = mysql_query("SELECT count(projects.id) AS cnt FROM projects,registrations WHERE ".
+		$q = $pdo->prepare("SELECT count(projects.id) AS cnt FROM projects,registrations WHERE ".
 			" projectdivisions_id='{$cdl[$id]['div']}' ".
 			" AND projectcategories_id='{$cdl[$id]['cat']}' ".
 			" AND language='{$cdl[$id]['lang']}' ".
-			" AND registrations.conferences_id='{$conference['id']}'".
+			" AND registrations.year='{$config['FAIRYEAR']}'".
 			" AND projects.registrations_id=registrations.id".
 			" AND (registrations.status='complete' OR registrations.status='paymentpending')");
+		$q->execute();
 
-		$r = mysql_fetch_object($q);
+		$r = $q->fetch(PDO::FETCH_OBJ);
-		echo mysql_error();
+		echo $pdo->errorInfo();
 		$c = $r->cnt;
 
 		$cdl[$id]['name'] = "$x $y ({$cdl[$id]['lang']}) ($c project".($c==1?'':'s').")";
@@ -175,24 +183,28 @@ function get_all_divs()
 	if($_POST['action']=="add" && $_POST['jdiv_id'] && count($_POST['cdllist'])>0)
 	{
 		foreach($_POST['cdllist'] AS $selectedcdl) {
-			$q=mysql_query("UPDATE judges_jdiv SET jdiv_id='{$_POST['jdiv_id']}' WHERE ".
+			$q=$pdo->prepare("UPDATE judges_jdiv SET jdiv_id='{$_POST['jdiv_id']}' WHERE ".
 						" id='$selectedcdl' ");
+			$q->execute();
 		}
 		echo happy(i18n("Judging Division(s) successfully added"));
 	}
 
 	if($_GET['action']=="del" && $_GET['cdl_id']) {
-		mysql_query("UPDATE judges_jdiv SET jdiv_id=0 WHERE id='{$_GET['cdl_id']}'");
+		$stmt = $pdo->prepare("UPDATE judges_jdiv SET jdiv_id=0 WHERE id='{$_GET['cdl_id']}'");
+		$stmt->execute();
 	}
 
 	if($_GET['action']=="empty" && $_GET['jdiv_id']) {
-		mysql_query("UPDATE judges_jdiv SET jdiv_id=0 WHERE jdiv_id='{$_GET['jdiv_id']}' ");
+		$stmt = $pdo->prepare("UPDATE judges_jdiv SET jdiv_id=0 WHERE jdiv_id='{$_GET['jdiv_id']}' ");
+		$stmt->execute();
 		echo happy(i18n("Emptied all divisions from Judging Division Group %1",array($_GET['jdiv_id'])));
 	}
 
 	if($_GET['action']=="recreate") {
 		//just delete them all, they'll be recreated automagically
-		mysql_query("TRUNCATE TABLE judges_jdiv");
+		$stmt = $pdo->prepare("TRUNCATE TABLE judges_jdiv");
+		$stmt->execute();
 		echo happy(i18n("Recreated all division/category/language options"));
 	}
 

admin/judges_sa.php

@@ -3,8 +3,9 @@
    This file is part of the 'Science Fair In A Box' project
    SFIAB Website: http://www.sfiab.ca
 
-   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
+   Copyright (C) 2005-2008 Sci-Tech Ontario Inc <info@scitechontario.org>
-   Copyright (C) 2005 James Grant <james@lightbox.org>
+   Copyright (C) 2008-2012 Youth Science Ontario <info@youthscienceontario.ca>
+   Copyright (C) 2005-2012 James Grant <james@lightbox.org>
 
    This program is free software; you can redistribute it and/or
    modify it under the terms of the GNU General Public
@@ -28,6 +29,7 @@
  require_once('../projects.inc.php');
  require_once('judges.inc.php');
  require_once('anneal.inc.php');
+
 // INFO ONLY:  Re Windows OS.   I have not found a test that works for both methods of starting this
 // SERVER_ADDR is Always null in Windows OS   IIS server
 // when I launch using judges_sa_launcher_apache.php  I could test using SERVER_NAME
@@ -55,8 +57,9 @@ $round_divisional2 = NULL;
 function set_status($txt)
 {
 	TRACE("Status: $txt\n");
-	mysql_query("UPDATE config SET val='$txt' WHERE 
+	$stmt = $pdo->prepare("UPDATE config SET val='$txt' WHERE 
 			var='judge_scheduler_activity' AND year=0");
+	$stmt->execute();
 }
 
 $set_percent_last_percent = -1;
@@ -66,8 +69,9 @@ function set_percent($n)
 	$p = floor($n);
 	if($p == $set_percent_last_percent) return;
 	TRACE("Progress: $p\%\n");
-	mysql_query("UPDATE config SET val='$p' WHERE 
+	$stmt = $pdo->prepare("UPDATE config SET val='$p' WHERE 
 			var='judge_scheduler_percent' AND year=0");
+	$stmt->execute();
 	$set_percent_last_percent = $p;
 }
 
@@ -114,7 +118,7 @@ function judges_cost_function($annealer, $bucket_id, $ids)
 	if($bucket_id == 0) {
 		/* This is the placeholder for all judges, there's a slight 
 		 * cost for not using a judge  */
-		$cost = count($ids) * 8;
+		$cost = count($ids) * 5;
 //		TRACE("Extra judge team cost=$cost\n");
 		return $cost;
 	}
@@ -145,7 +149,6 @@ function judges_cost_function($annealer, $bucket_id, $ids)
 			$l = $t['cats'][$y];
 			/* Lookup the judge cat pref for this category */
 			$pref = -$j['cat_prefs'][$l] + 2;
-
 			/* $pref = 0 (best match) --- 4 (worst match) */
 			//but wait, if they're "indifferent" then we really dont care, so the cost for it shoudl be 0.
 			if($pref==2) $pref=0;
@@ -167,8 +170,6 @@ function judges_cost_function($annealer, $bucket_id, $ids)
 		//division matching is more important than category matching
 		$cost += 3 * $dpref;
 
-//		TRACE("   div/cat cost=$cost\n");
-
 		/* See if the judge is willing to chair a team */
 		if($j['willing_chair'] == 'yes') $have_chair = true;
 
@@ -207,12 +208,9 @@ function judges_cost_function($annealer, $bucket_id, $ids)
 
 	/* Small penalty for a jteam with very little experience, 
 	 * but only if there's more than 1 person on the team */
-	$exp_cost = 0;
 	if($years_experience_weighted<5 && count($ids)>1) {
-		$exp_cost += (5-$years_experience_weighted)*2;
+		$cost += (5-$years_experience_weighted)*2;
 	}
-	$cost += $exp_cost;
-//	TRACE("Experience cost: $exp_cost\n");
  
 //	TRACE("Team $bucket_id, cost is $cost\n");
 
@@ -340,11 +338,22 @@ function pr_judge(&$jt, $jid)
 	print("(");
 	foreach($jt['cats'] as $c)
 		print("c{$c}={$j['cat_prefs'][$c]} ");
+	echo " / ";
+	foreach($j['cat_prefs'] AS $k=>$v) {
+		print("c{$k}=$v ");
+	}
+	echo ") (";
+
 	foreach($jt['divs'] as $d)
 		print("d{$d}={$j['div_prefs'][$d]} ");
 
+	echo " / ";
+	foreach($j['div_prefs'] AS $k=>$v) {
+		print("d{$k}=$v ");
+	}
+
 	print(")");
-	if($j['willing_chair'] == 'yes') print(" (chair) ");
+	if($j['willing_chair'] == 'yes') print(" chair ");
 
 	print("\n");
 }	
@@ -354,8 +363,9 @@ set_status("Loading Data From Database...");
 TRACE("\n\n");
 $div = array();
 TRACE("Loading Project Divisions...\n");
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='".$conference['id']."' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-while($r=mysql_fetch_object($q))
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ))
 {
 	$divshort[$r->id]=$r->division_shortform;
 	$div[$r->id]=$r->division;
@@ -364,16 +374,17 @@ while($r=mysql_fetch_object($q))
 
 TRACE("Loading Project Age Categories...\n");
 $cat = array();
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='".$conference['id']."' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-while($r=mysql_fetch_object($q)) {
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$cat[$r->id]=$r->category;
 	TRACE("   {$r->id} - {$r->category}\n");
 }
 
 TRACE("Loading Languages...\n");
 $langr = array();
-$q=mysql_query("SELECT * FROM languages WHERE active='Y'");
+dddddddddddddddo->prepare("SELECT * FROM languages WHERE active='Y'");
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$langr[$r->lang] = $r->langname;
 	TRACE("   {$r->lang} - {$r->langname}\n");
 }
@@ -381,17 +392,19 @@ while($r=mysql_fetch_object($q)) {
 TRACE("Loading Judging Round time data...\n");
 $round_special_awards = array();
 $round = array();
-$q = mysql_query("SELECT * FROM judges_timeslots WHERE round_id='0' AND `conferences_id`='{$conference['id']}'");
+$q = $pdo->prepare("SELECT * FROM judges_timeslots WHERE round_id='0' AND `year`='{$config['FAIRYEAR']}'");
+$q->execute();
 /* Loads judges_timeslots.id, .starttime, .endtime, .date, .name */
-while($r = mysql_fetch_assoc($q)) {
+while($r = $q=>fetch(PDO::FETCH_ASSOC)) {
 	TRACE("   id:{$r['id']} type:{$r['type']} name:{$r['name']}\n");
 
-	$qq = mysql_query("SELECT * FROM judges_timeslots WHERE round_id='{$r['id']}'");
+	$qq = $pdo->prepare("SELECT * FROM judges_timeslots WHERE round_id='{$r['id']}'");
-	if(mysql_num_rows($qq) == 0) {
+	$qq->execute();
+	if($qq->rowCount() == 0) {
 		echo "ERROR: Round type:{$r['type']} name:{$r['name']} has no judging timeslots!  Abort.\n";
 		exit;
 	}
-	while($rr = mysql_fetch_assoc($qq)) {
+	while($rr = $qq->fetch(PDO::FETCH_ASSOC)) {
 		TRACE("      Timeslot: {$rr['starttime']}-{$rr['endtime']}\n");
 		$r['timeslots'][] = $rr;
 	}
@@ -409,8 +422,9 @@ if($round_divisional1 == NULL) {
 
 $jdiv = array();
 TRACE("Loading Judging Division Configuration and Projects...\n");
-$q=mysql_query("SELECT * FROM judges_jdiv");
+$q=$pdo->prepare("SELECT * FROM judges_jdiv");
-while($r=mysql_fetch_object($q)) {
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	/* Ignore jdiv 0 (all unassigned div/cats) */
 	if($r->jdiv_id == 0) continue;
 
@@ -427,16 +441,17 @@ foreach($keys as $jdiv_id) {
 		$d = $jdiv[$jdiv_id]['config'][$x];
 		if($x > 0) TRACE("\t- ");
 		TRACE($cat[$d['cat']]." ".$div[$d['div']]." - ".$langr[$d['lang']]);
-		$qp = mysql_query("SELECT projects.* FROM projects, registrations WHERE ".
+		$qp = $pdo->prepare("SELECT projects.* FROM projects, registrations WHERE ".
-					" projects.conferences_id='".$conference['id']."' AND ".
+					" projects.year='".$config['FAIRYEAR']."' AND ".
 					" projectdivisions_id='{$d['div']}' AND ".
 					" projectcategories_id='{$d['cat']}' AND ".
 					" language='{$d['lang']}' AND " .
 					" registrations.id = projects.registrations_id " .
 					getJudgingEligibilityCode()
 				);
+		$qp->execute();
 		$count = 0;
-		while($rp = mysql_fetch_object($qp)) {
+		while($rp = $qp->fetch(PDO::FETCH_OBJ)) {
 			$jdiv[$jdiv_id]['projects'][$rp->id] = array( 
 					'div' => $d['div'],
 					'cat' => $d['cat'],
@@ -455,39 +470,56 @@ foreach($keys as $jdiv_id) {
 
 /* Clean out the judging teams that were autocreated in a previous run */
 TRACE("Deleting autocreated divisional and special award judging teams:");
-$q = mysql_query("SELECT * FROM judges_teams WHERE autocreate_type_id=1 AND conferences_id={$conference['id']}");
+$q = pdo->prepare("SELECT * FROM judges_teams WHERE autocreate_type_id=1 AND year={$config['FAIRYEAR']}");
-while($r = mysql_fetch_object($q)) {
+$q->execute();
+while($r = $q->fetch(PDO::FETCH_OBJ)) {
 	$id = $r->id;
 	print(" $id");
 	/* Clean out the judges_teams_link */
-	mysql_query("DELETE FROM judges_teams_link WHERE judges_teams_id='$id' AND conferences_id={$conference['id']}");
+	
-	print mysql_error();
+	
+	$stmt = $pdo->prepare("DELETE FROM judges_teams_link WHERE judges_teams_id='$id' AND year={$config['FAIRYEAR']}");
+	$stmt->execute();
+	print $pdo->errorInfo();
 	/* Awards */
-	mysql_query("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$id' AND conferences_id={$conference['id']}");
+	
-	print mysql_error();
+	
+	$stmt = $pdo->prepare("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$id' AND year={$config['FAIRYEAR']}");
+	$stmt->execute();
+	print $pdo->errorInfo();
 	/* Timeslots */
-	mysql_query("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$id' AND conferences_id={$conference['id']}");
+	
-	print mysql_error();
+	
+	$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$id' AND year={$config['FAIRYEAR']}");
+	$stmt->execute();
+	print $pdo->errorInfo();
 	/* Timeslots projects */
-	mysql_query("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='$id' AND conferences_id={$conference['id']}");
+	
-	print mysql_error();
+	
+	$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='$id' AND year={$config['FAIRYEAR']}");
+	$stmt->execute();
+	print $pdo->errorInfo();
 }
 echo "\n";
 
 /* Finally, delete all the autocreated judges teams */
-mysql_query("DELETE FROM judges_teams WHERE autocreate_type_id=1 AND conferences_id={$conference['id']}");
+$stmt = $pdo->prepare("DELETE FROM judges_teams WHERE autocreate_type_id=1 AND year={$config['FAIRYEAR']}");
-print mysql_error();
+$stmt->execute();
+print $pdo->errorInfo();
 
 /* Also delete any judges_teams_link that link to teams that dont exist, just 
  * in case */
-$q=mysql_query("SELECT judges_teams_link.id, judges_teams.id AS judges_teams_id 
+$q=$pdo->prepare("SELECT judges_teams_link.id, judges_teams.id AS judges_teams_id 
 			FROM judges_teams_link 
 			LEFT JOIN judges_teams ON judges_teams_link.judges_teams_id=judges_teams.id 
-			WHERE judges_teams_link.conferences_id={$conference['id']}");
+			WHERE judges_teams_link.year={$config['FAIRYEAR']}");
+
+$q->execute();
 $n=0;
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	if(!$r->judges_teams_id) {
-		mysql_query("DELETE FROM judges_teams_link WHERE id='$r->id'");
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_link WHERE id='$r->id'");
+		$stmt->execute();
 		$n++;
 	}
 }
@@ -512,51 +544,54 @@ foreach($judges as &$j) {
 		continue;
 	}
 
-	$q = mysql_query("SELECT users_id FROM judges_teams_link WHERE 
+	$q = $pdo->prepare("SELECT users_id FROM judges_teams_link WHERE 
 				users_id='{$j['id']}'
-				AND conferences_id='{$conference['id']}'");
+				AND year='{$config['FAIRYEAR']}'");
-	if(mysql_num_rows($q) != 0) {
+	$q->execute();
+	if($q->rowCount()!= 0) {
 		TRACE("   {$j['name']} is already on a judging team, skipping.\n");
 		unset($judges[$j['id']]);
 		continue;
 	}
 	if($config['judges_availability_enable']=="yes") {
 		/* Load the judge time availability */
-		$q = mysql_query("SELECT * FROM judges_availability WHERE users_id='{$j['id']}' ORDER BY `start`");
+		$q = $pdo->prepare("SELECT * FROM judges_availability WHERE users_id='{$j['id']}' ORDER BY `start`");
-		if(mysql_num_rows($q) == 0) {
+		if($q->rowCount()== 0) {
 			TRACE("   {$j['name']} hasn't selected any time availability, POTENTIAL BUG (they shouldn't be marked as complete).\n");
 			TRACE("      Ignoring this judge.\n");
 			unset($judges[$j['id']]);
 			continue;
 		}
-		while($r = mysql_fetch_assoc($q)) {
+		$q->execute();
+		while($r = $q=>fetch(PDO::FETCH_ASSOC)) {
 			$j['availability'][] = $r;
 		}
 	}
 
 	/* Load special award preferences */
-	$q = mysql_query("SELECT award_awards.id,award_awards.name FROM 
+	$q = $pdo->prepare("SELECT award_awards.id,award_awards.name FROM 
 				judges_specialaward_sel,award_awards 
 				WHERE
 				award_awards.id=judges_specialaward_sel.award_awards_id
 				AND judges_specialaward_sel.users_id='{$j['id']}'
-				AND award_awards.conferences_id='{$conference['id']}'");
+				AND award_awards.year='{$config['FAIRYEAR']}'");
-	echo mysql_error();
+	$q->execute();
+		echo $pdo->errorInfo();
 
 	if($j['special_award_only'] == 'yes') {
 		TRACE("   {$j['name']} is a special awards only.\n");
 		/* Find their special award id */
-		if(mysql_num_rows($q) == 0) {
+		if($q->rowCount()== 0) {
 			TRACE("      NO special award selected! (removing special award only request)\n");
 			$j['special_award_only'] = 'no';
-//		} else if(mysql_num_rows($q) > 1) {
+//		} else if($q->rowCount()> 1) {
 //			TRACE("      More than ONE special award selected (removing special award only request):\n");
 //			$j['special_award_only'] = 'no';
 		} 
 	}
 
 	$j['special_awards'] = array();
-	while($r = mysql_fetch_object($q)) {
+	while($r = $q->fetch(PDO::FETCH_OBJ)) {
 		if($j['special_award_only'] == 'yes') {
 			TRACE("      {$r->name}\n");
 		}
@@ -583,9 +618,10 @@ if(count($judges)==0) {
 
 /* Load the numbers for any user-defined judge teams that already exist,
  * these numbers will be off-limits for auto-assigning numbers */
-$q = mysql_query("SELECT * FROM judges_teams WHERE conferences_id={$conference['id']}");
+$q = $pdo->prepare("SELECT * FROM judges_teams WHERE year={$config['FAIRYEAR']}");
+$q->execute();
 $used_judges_teams_numbers = array();
-while($i = mysql_fetch_assoc($q)) {
+while($i = $q=>fetch(PDO::FETCH_ASSOC)) {
 	$used_judges_teams_numbers[] = $i['num'];
 }
 echo "The following judge team numbers are already used: \n";
@@ -611,21 +647,23 @@ function next_judges_teams_number()
 function judge_team_create($num, $name)
 {
 	global $config;
-	$name = mysql_escape_string($name);
+	$name = $name;
-	mysql_query("INSERT INTO judges_teams (num,name,autocreate_type_id,conferences_id)
+	$stmt = $pdo->prepare("INSERT INTO judges_teams (num,name,autocreate_type_id,year)
-		VALUES ('$num','$name','1','{$conference['id']}')");
+		VALUES ('$num','$name','1','{$config['FAIRYEAR']}')");
-	$id = mysql_insert_id();
+	$stmt->execute();
+	$id = lastInsertId();
 	return $id;
 }
 
 function judge_team_add_judge($team_id, $users_id)
 {
 	global $config, $judges;
-	mysql_query("INSERT INTO judges_teams_link
+	$stmt = $pdo->prepare("INSERT INTO judges_teams_link
-			 (users_id,judges_teams_id,captain,conferences_id) 
+			 (users_id,judges_teams_id,captain,year) 
 		 VALUES ('$users_id','$team_id','{$judges[$users_id]['willing_chair']}',
-				'{$conferences['id']}')");
+				'{$config['FAIRYEAR']}')");
-	echo mysql_error();
+	$stmt->execute();
+	echo $pdo->errorInfo();
 }
 
 /****************************************************************************
@@ -751,7 +789,7 @@ for($x=1;$x<count($jteam); $x++) {
 	asort($t['cats']);
 	asort($t['divs']);
 
-	print("langs=($langstr)");
+	print("langs=($langstr) ");
 	print("cats=(");
 	$catstr="";
 
@@ -764,7 +802,7 @@ for($x=1;$x<count($jteam); $x++) {
 	            $first=false;
         	}
 	}
-	print(")divs=(");
+	print(") divs=(");
 	$divstr="";
 	if(count($t['divs'])) {
 		$first=true;
@@ -805,26 +843,28 @@ for($x=1;$x<count($jteam); $x++) {
 	$jd = $jdiv[$t['jdiv_id']];
 	for($y=0; $y<count($jd['config']); $y++) {
 		$cfg = $jd['config'][$y];
-		$q=mysql_query("SELECT award_awards.id FROM 
+		$q=$pdo->prepare("SELECT award_awards.id FROM 
 						award_awards,
 						award_awards_projectcategories,
 						award_awards_projectdivisions
 					WHERE 
-						award_awards.conferences_id='{$conference['id']}'
+						award_awards.year='{$config['FAIRYEAR']}'
 						AND award_awards.id=award_awards_projectcategories.award_awards_id
 						AND award_awards.id=award_awards_projectdivisions.award_awards_id
 						AND award_awards_projectcategories.projectcategories_id='{$cfg['cat']}'
 						AND award_awards_projectdivisions.projectdivisions_id='{$cfg['div']}'
 						AND award_awards.award_types_id='1'
 					");
-		if(mysql_num_rows($q)!=1) {
+		$q->execute();
+		if($q->rowCount()!=1) {
 			echo error(i18n("Cannot find award for %1 - %2",array($cat[$cfg['cat']],$div[$cfg['div']])));
 		} else {
-			$r=mysql_fetch_object($q);
+			$r=$q->fetch(PDO::FETCH_OBJ);
-			mysql_query("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,conferences_id) VALUES ('$r->id','$team_id','{$conferences['id']}')");
+			$stmt = $pdo->prepare("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,year) VALUES ('$r->id','$team_id','{$config['FAIRYEAR']}')");
 			/* Add the award ID to the jdiv, if it's not already there */
 			if(!in_array($r->id, $jdiv[$t['jdiv_id']]['award_ids'])) {
 				$jdiv[$t['jdiv_id']]['award_ids'][] = $r->id;
+			$stmt->execute();
 			}
 		}
 	}
@@ -897,7 +937,8 @@ if($round_divisional2 == NULL) {
 
 		/* Assign all the awards in this jdiv */
 		foreach($jd['award_ids'] as $aid) {
-			mysql_query("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,conferences_id) VALUES ('$aid','$team_id','{$conference['id']}')");
+			$stmt = $pdo->prepare("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,year) VALUES ('$aid','$team_id','{$config['FAIRYEAR']}')");
+			$stmt->execute();
 		}
 	}
 
@@ -1015,14 +1056,15 @@ if($config['scheduler_enable_sa_scheduling'] == 'yes') {
 	/* Load special awards */
 	$q = "SELECT award_awards.name,award_awards.id FROM award_awards,award_types
 		WHERE 
-			award_awards.conferences_id='{$conference['id']}'
+			award_awards.year='{$config['FAIRYEAR']}'
 			AND award_types.id=award_awards.award_types_id
 			AND award_awards.schedule_judges='yes'
-			AND award_types.conferences_id='{$conference['id']}'
+			AND award_types.year='{$config['FAIRYEAR']}'
 			AND award_types.type='Special' 
 		";
-	$r = mysql_query($q);
+	$r = $stmt->prepare($q);
-	print(mysql_error());
+	$r->execute();
+	print($pdo->errorInfo());
 	/* sa_jteam for leftover judges, if any */
 	$sa_jteam = array();
 	$sa_jteam[0]['id'] = 0;
@@ -1034,13 +1076,14 @@ if($config['scheduler_enable_sa_scheduling'] == 'yes') {
 
 	$x=1;
 	$required_judges = 0;
-	while($i = mysql_fetch_object($r)) {
+	while($i = $r->fetch(PDO::FETCH_OBJ)) {
 		$projects = getProjectsNominatedForSpecialAward($i->id);
+		$languages = getLanguagesOfProjectsNominatedForSpecialAward($i->id);
 
 		/* Construct an internal team for annealing, and create
 		 * a DB team too */
 		$sa_jteam[$x]['num'] = next_judges_teams_number();
-		$sa_jteam[$x]['id'] = judge_team_create($sa_jteam[$x]['num'], $i->name);
+		$sa_jteam[$x]['id'] = judge_team_create($sa_jteam[$x]['num'], $i->name." (".implode(" ",$languages).")");
 		/* Note, we use $x instead of the ID, because the DB id could be zero. */
 		$sa_jteam[$x]['projects'] = $projects;
 		$sa_jteam[$x]['round'] = NULL;
@@ -1055,8 +1098,9 @@ if($config['scheduler_enable_sa_scheduling'] == 'yes') {
 		$required_judges += $min;
 		
 		/* Link the award to this team */
-		mysql_query("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,conferences_id) 
+		$stmt = $pdo->prepare("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,year) 
-				VALUES ('{$i->id}','{$sa_jteam[$x]['id']}','{$conference['id']}')");
+				VALUES ('{$i->id}','{$sa_jteam[$x]['id']}','{$config['FAIRYEAR']}')");
+		$stmt->execute();
 
 		TRACE("Created Team: {$i->name}, ".count($projects)." projects => $min judges needed (db id:{$sa_jteam[$x]['id']}) \n");
 		$x++;
@@ -1246,17 +1290,19 @@ if($config['scheduler_enable_sa_scheduling'] == 'yes') {
 			print("\n");
 
 			/* Do timeslot and project timeslot assignment */
-			mysql_query("INSERT INTO judges_teams_timeslots_link 
+			$stmt = $pdo->prepare("INSERT INTO judges_teams_timeslots_link 
-							(judges_teams_id,judges_timeslots_id,conferences_id)
+							(judges_teams_id,judges_timeslots_id,year)
-							VALUES ('{$t['id']}', '{$r['timeslots'][0]['id']}', '{$conference['id']}')");
+							VALUES ('{$t['id']}', '{$r['timeslots'][0]['id']}', '{$config['FAIRYEAR']}')")
-			echo mysql_error();
+			$stmt->execute();
+			echo $pdo->errorInfo();
 
 			foreach($t['projects'] as $proj) {
 				$pid = $proj['id'];
-				mysql_query("INSERT INTO judges_teams_timeslots_projects_link 
+				$stmt = $pdo->prepare("INSERT INTO judges_teams_timeslots_projects_link 
-								(judges_teams_id,judges_timeslots_id,projects_id,conferences_id)
+								(judges_teams_id,judges_timeslots_id,projects_id,year)
-								VALUES ('{$t['id']}', '{$r['timeslots'][0]['id']}', '$pid', '{$conference['id']}')");
+								VALUES ('{$t['id']}', '{$r['timeslots'][0]['id']}', '$pid', '{$config['FAIRYEAR']}')");
-				echo mysql_error();
+				$stmt->execute();
+				echo $pdo->errorInfo();
 			}
 			$ids = $a->bucket[$x];
 			foreach($a->bucket[$x] as $jid) {
@@ -1286,13 +1332,14 @@ set_status("Assigning Judging Teams and Projects to Timeslots");
 TRACE("Loading Divisional1 Timeslot Data\n");
 $available_timeslots=array();
 
-$q=mysql_query("SELECT * FROM judges_timeslots WHERE 
+$q=$pdo->prepare("SELECT * FROM judges_timeslots WHERE 
 			round_id='{$round_divisional1['id']}' 
-			AND conferences_id='{$conference['id']}' 
+			AND year='{$config['FAIRYEAR']}' 
 			AND type='timeslot'
 			ORDER BY date,starttime");
+$q->execute();
 $x=0;
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
         $available_timeslots[]=array("id"=>$r->id,
 				"date"=>$r->date,
 				"starttime"=>substr($r->starttime,0,-3),
@@ -1456,17 +1503,19 @@ for($k=0; $k<$keys_count; $k++) {
 			if($jteam_id == 0) continue;
 
 			/* if jteam_id isn't 0, instert it into the db */
-			mysql_query("INSERT INTO judges_teams_timeslots_link ".
+			$stmt = $pdo->prepare("INSERT INTO judges_teams_timeslots_link ".
-				" (judges_teams_id,judges_timeslots_id,conferences_id)".
+				" (judges_teams_id,judges_timeslots_id,year)".
 				" VALUES ('{$jteam[$jteam_id]['team_id']}', ".
 				" '{$available_timeslots[$y]['id']}', ".
-				" '{$conference['id']}')");
+				" '{$config['FAIRYEAR']}')");
+			$stmt->execute();
 														 
-			mysql_query("INSERT INTO judges_teams_timeslots_projects_link ".
+			$stmt = $pdo->prepare("INSERT INTO judges_teams_timeslots_projects_link ".
-				" (judges_teams_id,judges_timeslots_id,projects_id,conferences_id) ".
+				" (judges_teams_id,judges_timeslots_id,projects_id,year) ".
 				" VALUES ('{$jteam[$jteam_id]['team_id']}', ".
 				" '{$available_timeslots[$y]['id']}', ".
-				" '$pid', '{$conference['id']}')");
+				" '$pid', '{$config['FAIRYEAR']}')");
+			$stmt->execute();
 
 		}
 		printf("\n");

admin/judges_sa_launcher.php

@@ -1,6 +1,11 @@
 <?
-require_once('../common.inc.functions.php');
+
-$logPath = get_logpath();
+//make sure logs folder exists, and htaccess it to deny access
+if(!file_exists("../data/logs"))
+	@mkdir("../data/logs");
+
+ if(!file_exists("../data/logs/.htaccess"))
+ 	@file_put_contents("../data/logs/.htaccess","Order Deny,Allow\r\nDeny From All\r\n");
 //   Check which OS we are running
 $pos = strpos(getcwd(),'/');
 if($pos === false)
@@ -15,7 +20,7 @@ if($pos === false)
 	$bat_file = fopen($bat_filename, "w");
 	if($bat_file) {
       	fwrite($bat_file, "ECHO OFF"."\n");
-        fwrite($bat_file, "START /BELOWNORMAL /B php judges_sa.php >$logPath/judge_scheduler_".date("YmdHis").".log 2>&1 &"."\n");
+        fwrite($bat_file, "START /BELOWNORMAL /B php judges_sa.php >../data/logs/judge_scheduler_".date("YmdHis").".log 2>&1 &"."\n");
         fwrite($bat_file, "EXIT"."\n");
   	 	fclose($bat_file);
 	}
@@ -40,14 +45,14 @@ if($pos === false)
 		echo "<a href=\"judges_scheduler_status.php\">Check the Status</a><br />";
 		exit;
 	 // This is the call that works - but it does not return until judges_sa is finished so... I launch it from another window
-		//	exec("php judges_sa.php >$logPath/judge_scheduler_".date("YmdHis").".log 2>&1 &");
+		//	exec("php judges_sa.php >../data/logs/judge_scheduler_".date("YmdHis").".log 2>&1 &");
 	}
 }
 else{
 	// *nix server
 //add PHP_SELF just so when we do a process listing on the server we know which fair its running for
 //the argument does not get used by the script at all
-exec("nice php judges_sa.php {$_SERVER['PHP_SELF']} > $logPath/judge_scheduler_".date("YmdHis").".log 2>&1 &");
+exec("nice php judges_sa.php {$_SERVER['PHP_SELF']} >../data/logs/judge_scheduler_".date("YmdHis").".log 2>&1 &");
 }
 usleep(1500000); // 1.5 second to allow the judges_sa to update the % status to 0% otherwise the status page will think its not running if it gets there too soon
 header("Location: judges_scheduler_status.php");

admin/judges_sa_launcher_apache.php

@@ -1,8 +1,6 @@
 <?php
-require_once('../common.inc.functions.php');
-$logPath = get_logpath();
 //  In Windows OS with Apache server this exec call will start judges_sa.php as a separate process but the call to exec() does not return until the scheduler completes. Note the process runs at normal priority. Status can be checked with judges_scheduler_status.php. This is a temporary solution for Windows / Apache
-exec("php judges_sa.php >$logPath/judge_scheduler_".date("YmdHis").".log 2>&1 &");
+exec("php judges_sa.php >../data/logs/judge_scheduler_".date("YmdHis").".log 2>&1 &");
 exit;
 ?>
 

admin/judges_scheduler_status_output.php

@@ -1,13 +1,15 @@
 <?
 include "../data/config.inc.php";
-mysql_connect($DBHOST,substr($DBUSER,0,16),$DBPASS);
+include "../common.inc.php";
-mysql_select_db($DBNAME);
+
-$q=mysql_query("SELECT val FROM config WHERE year='0' AND var='judge_scheduler_percent'");
+$q=$pdo->prepare("SELECT val FROM config WHERE year='0' AND var='judge_scheduler_percent'");
-$r=mysql_fetch_object($q);
+$q->execute();
+$r=$q->fetch(PDO::FETCH_OBJ);
 $percent=$r->val;
 
-$q=mysql_query("SELECT val FROM config WHERE year='0' AND var='judge_scheduler_activity'");
+$q=$pdo->prepare("SELECT val FROM config WHERE year='0' AND var='judge_scheduler_activity'");
-$r=mysql_fetch_object($q);
+$q->execute();
+$r=$q->fetch(PDO::FETCH_OBJ);
 $status=$r->val;
 
 echo "$percent:$status\n";

admin/judges_schedulerconfig.php

@@ -26,11 +26,11 @@ ogram; see the file COPYING.  If not, write to
  require("../common.inc.php");
  require_once("../user.inc.php");
  require("../config_editor.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("judges.inc.php");
  require("judges_schedulerconfig_check.inc.php");
 
- $action = config_editor_handle_actions("Judge Scheduler", $conference['id'], "var");
+ $action = config_editor_handle_actions("Judge Scheduler", $config['FAIRYEAR'], "var");
  if($action == 'update') {
  	header("Location: judges_schedulerconfig.php");
 	exit;
@@ -43,12 +43,13 @@ ogram; see the file COPYING.  If not, write to
 			'Judges' => 'admin/judges.php')
 				);
 
- config_editor("Judge Scheduler", $conference['id'], "var", $_SERVER['PHP_SELF']);
+ config_editor("Judge Scheduler", $config['FAIRYEAR'], "var", $_SERVER['PHP_SELF']);
  echo "<hr />";
 
  if($_GET['action']=="reset")
  {
- 	mysql_query("UPDATE config SET `val`='-1' WHERE `var`='judge_scheduler_percent' AND `year`=0");
+ 	$stmt = $pdo->prepare("UPDATE config SET `val`='-1' WHERE `var`='judge_scheduler_percent' AND `year`=0");
+	$stmt->execute();
 	$config['judge_scheduler_percent']="-1";
 	echo happy(i18n("Judge scheduler status forcibly reset"));
  }

admin/judges_schedulerconfig_check.inc.php

@@ -2,15 +2,17 @@
 
 function judges_scheduler_check_timeslots()
 {
-	global $conference;
+	global $config;
 
-	$q=mysql_query("SELECT * FROM judges_timeslots WHERE ".
+	$q=$pdo->prepare("SELECT * FROM judges_timeslots WHERE ".
-		" conferences_id='".$conference['id']."'".
+		" year='".$config['FAIRYEAR']."'".
 		" AND `type`='divisional1'" );
-	if(mysql_num_rows($q)) {
+	$q->execute();
-		$round=mysql_fetch_object($q);
+	if($q->rowCount()) {
-		$q=mysql_query("SELECT * FROM judges_timeslots WHERE round_id='$round->id' AND type='timeslot'");
+		$round=$q->fetch(PDO::FETCH_OBJ);
-		return mysql_num_rows($q);
+		$q=$stmt->prepare("SELECT * FROM judges_timeslots WHERE round_id='$round->id' AND type='timeslot'");
+		$q->execute();
+		return $q->rowCount();
 	}
 	else
 		return 0;
@@ -18,16 +20,18 @@ function judges_scheduler_check_timeslots()
 
 function judges_scheduler_check_timeslots_sa()
 {
-	global $conference;
+	global $config;
 	$rows = 0;
 
-	$q=mysql_query("SELECT * FROM judges_timeslots WHERE ".
+	$q=$pdo->prepare("SELECT * FROM judges_timeslots WHERE ".
-		" conferences_id='".$conference['id']."'".
+		" year='".$config['FAIRYEAR']."'".
 		" AND `type`='special'" );
-	if(mysql_num_rows($q)) {
+	$q->execute();
-		while((	$round=mysql_fetch_object($q))) {
+	if($q->rowCount()) {
-			$rq=mysql_query("SELECT * FROM judges_timeslots WHERE round_id='$round->id' AND type='timeslot'");
+		while((	$round=$q->fetch(PDO::FETCH_OBJ))) {
-			$rows += mysql_num_rows($rq);
+			$rq=$pdo->prepare("SELECT * FROM judges_timeslots WHERE round_id='$round->id' AND type='timeslot'");
+			$rq->execute();
+			$rows += $rq->rowCount();
 		}
 	}
 	return $rows;
@@ -35,23 +39,26 @@ function judges_scheduler_check_timeslots_sa()
 
 function judges_scheduler_check_awards()
 {
-	global $config, $conferenece;
+	global $config;
 
-	$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='".$conference['id']."' ORDER BY id");
+	$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-	while($r=mysql_fetch_object($q))
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ))
 		$div[$r->id]=$r->division;
 
-	$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='".$conference['id']."' ORDER BY id");
+	$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-	while($r=mysql_fetch_object($q))
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ))
 		$cat[$r->id]=$r->category;
 
 	$dkeys = array_keys($div);
 	$ckeys = array_keys($cat);
 
 	if($config['filterdivisionbycategory']=="yes") {
-		$q=mysql_query("SELECT * FROM projectcategoriesdivisions_link WHERE conferences_id='".$conference['id']."' ORDER BY projectdivisions_id,projectcategories_id");
+		$q=$pdo->prepare("SELECT * FROM projectcategoriesdivisions_link WHERE year='".$config['FAIRYEAR']."' ORDER BY projectdivisions_id,projectcategories_id");
+		$q->execute();
 		$divcat=array();
-		while($r=mysql_fetch_object($q)) {
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			$divcat[]=array("c"=>$r->projectcategories_id,"d"=>$r->projectdivisions_id);
 		}
 
@@ -70,23 +77,24 @@ function judges_scheduler_check_awards()
 	foreach($divcat AS $dc) {
 		$d=$dc['d'];
 		$c=$dc['c'];
-			$q=mysql_query("SELECT award_awards.id FROM 
+			$q=$pdo->prepare("SELECT award_awards.id FROM 
 							award_awards,
 							award_awards_projectcategories,
 							award_awards_projectdivisions
 						WHERE 
-							award_awards.conferences_id='{$conference['id']}'
+							award_awards.year='{$config['FAIRYEAR']}'
-							AND award_awards_projectcategories.conferences_id='{$conference['id']}'
+							AND award_awards_projectcategories.year='{$config['FAIRYEAR']}'
-							AND award_awards_projectdivisions.conferences_id='{$conference['id']}'
+							AND award_awards_projectdivisions.year='{$config['FAIRYEAR']}'
 							AND award_awards.id=award_awards_projectcategories.award_awards_id
 							AND award_awards.id=award_awards_projectdivisions.award_awards_id
 							AND award_awards_projectcategories.projectcategories_id='$c'
 							AND award_awards_projectdivisions.projectdivisions_id='$d'
 							AND award_awards.award_types_id='1'
 						");
-						echo mysql_error();
+			$q->execute();
-			if(mysql_num_rows($q)!=1) {
+						echo $pdo->errorInfo();
-				$missing_awards[] = "{$cat[$c]} - {$div[$d]} (".i18n("%1 found",array(mysql_num_rows($q))).")";
+			if($q->rowCount()!=1) {
+				$missing_awards[] = "{$cat[$c]} - {$div[$d]} (".i18n("%1 found",array($q->rowCount())).")";
 			}
 	}
 	return $missing_awards;
@@ -95,8 +103,11 @@ function judges_scheduler_check_awards()
 
 function judges_scheduler_check_jdivs()
 {
-	$q=mysql_query("SELECT DISTINCT jdiv_id FROM judges_jdiv ");
+	global $config;
-	$rows = mysql_num_rows($q);
+
+	$q=$pdo->prepare("SELECT DISTINCT jdiv_id FROM judges_jdiv ");
+	$q->execute();
+	$rows = $q->rowCount();
 
 	return $rows;
 }
@@ -104,12 +115,13 @@ function judges_scheduler_check_jdivs()
 
 function judges_scheduler_check_judges()
 {
-	global $config, $conference;
+	global $config;
 	$ok = 1;
 
 	$jdiv = array();
-	$q=mysql_query("SELECT * FROM judges_jdiv ORDER BY jdiv_id");
+	$q=$pdo->prepare("SELECT * FROM judges_jdiv ORDER BY jdiv_id");
-	while($r=mysql_fetch_object($q)) {
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		/* Ignore any div/cat with jdiv 0 */
 		if($r->jdiv_id == 0) continue;
 
@@ -117,15 +129,16 @@ function judges_scheduler_check_judges()
 		$c = $r->projectcategories_id;
 		$l = $r->lang;
 
-		$qp = mysql_query("SELECT COUNT(projects.id) as cnt FROM projects, registrations WHERE ".
+		$qp = $pdo->prepare("SELECT COUNT(projects.id) as cnt FROM projects, registrations WHERE ".
-						" projects.conferences_id='".$conference['id']."' AND ".
+						" projects.year='".$config['FAIRYEAR']."' AND ".
 						" projectdivisions_id='$d' AND ".
 						" projectcategories_id='$c' AND ".
 						" language='$l' AND " .
 						" registrations.id = projects.registrations_id " .
 						getJudgingEligibilityCode()
 				);
-		$qr = mysql_fetch_object($qp);
+		$qp->execute();
+		$qr = $qp->fetch(PDO::FETCH_OBJ);
 		
 		$jdiv[$r->jdiv_id]['num_projects']['total'] += $qr->cnt;
 		$jdiv[$r->jdiv_id]['num_projects'][$l] += $qr->cnt;
@@ -167,7 +180,7 @@ function judges_scheduler_check_judges()
 			}
 
 			echo "<tr><td>Judging Division Group $jdiv_id</td>";
-			echo "<td align=\"center\">$c</td>";
+			echo "<td align=\"center\">{$jd['num_projects']['total']}</td>";
 			$langstr="";
 			foreach($config['languages'] AS $lkey=>$lname) {
 				$clang=($jd['num_projects'][$lkey]?$jd['num_projects'][$lkey]:0);
@@ -206,7 +219,7 @@ function judges_scheduler_check_judges()
 	echo "<br />";
 	echo "<br />";
 
-/*	$jq=mysql_query("SELECT COUNT(judges.id) AS num FROM judges,judges_years WHERE complete='yes' AND deleted='no' AND judges_years.conferences_id='{$conference['id']}' AND judges_years.judges_id=judges.id");
+/*	$jq=mysql_query("SELECT COUNT(judges.id) AS num FROM judges,judges_years WHERE complete='yes' AND deleted='no' AND judges_years.year='{$config['FAIRYEAR']}' AND judges_years.judges_id=judges.id");
 	$jr=mysql_fetch_object($jq);
 	$currentjudges=$jr->num;*/
 	/* FIXME: this his highly inefficient :), but won't be done very often */

admin/judges_teams.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  include "judges.inc.php";
 
 	if($_GET['edit']) $edit=$_GET['edit'];
@@ -35,35 +35,45 @@
 	if($action=="delete" && $_GET['delete'])
 	{
 		//ALSO DELETE: team members, timeslots, projects, awards
-		mysql_query("DELETE FROM judges_teams_link WHERE judges_teams_id='".$_GET['delete']."' AND conferences_id='".$conference['id']."'");
+		
-		mysql_query("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='".$_GET['delete']."' AND conferences_id='".$conference['id']."'");
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_link WHERE judges_teams_id='".$_GET['delete']."' AND year='".$config['FAIRYEAR']."'");
-		mysql_query("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='".$_GET['delete']."' AND conferences_id='".$conference['id']."'");
+		$stmt->execute();
-		mysql_query("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='".$_GET['delete']."' AND conferences_id='".$conference['id']."'");
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='".$_GET['delete']."' AND year='".$config['FAIRYEAR']."'");
-		mysql_query("DELETE FROM judges_teams WHERE id='".$_GET['delete']."' AND conferences_id='".$conference['id']."'");
+		$stmt->execute();
-		message_push(happy(i18n("Judge team successfully removed, and all of its corresponding members, timeslots, projects and awards unlinked from team")));
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='".$_GET['delete']."' AND year='".$config['FAIRYEAR']."'");
+		$stmt->execute();
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='".$_GET['delete']."' AND year='".$config['FAIRYEAR']."'");
+		$stmt->execute();
+		$stmt = $pdo->prepare("DELETE FROM judges_teams WHERE id='".$_GET['delete']."' AND year='".$config['FAIRYEAR']."'");
+		$stmt->execute();message_push(happy(i18n("Judge team successfully removed, and all of its corresponding members, timeslots, projects and awards unlinked from team")));
 	}
 
 	if($action=="deletealldivisional")
 	{
-		$q2=mysql_query("SELECT *
+		$q2=$pdo->prepare("SELECT *
 				FROM 	
 					judges_teams
 				WHERE 
-					conferences_id='".$conference['id']."'
+					year='".$config['FAIRYEAR']."'
 					AND autocreate_type_id='1'
 					");
-					echo mysql_error();
+					echo $pdo->errorInfo();
 		$numdeleted=0;
-		while($r2=mysql_fetch_object($q2))
+		while($r2=$q2->fetch(PDO::FETCH_OBJ))
 		{
 			//okay now we can start deleting things! whew!
 			//first delete any linkings to the team
-			mysql_query("DELETE FROM judges_teams_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			
-			mysql_query("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
-			mysql_query("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt->execute();
-			mysql_query("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
-			mysql_query("DELETE FROM judges_teams WHERE id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt->execute();
-			$numdeleted++;
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
+			$stmt->execute();
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
+			$stmt->execute();
+			$stmt = $pdo->prepare("DELETE FROM judges_teams WHERE id='$r2->id' AND year='".$config['FAIRYEAR']."'");
+			$stmt->execute();$numdeleted++;
 		}
 		if($numdeleted)
 			message_push(happy(i18n("Successfully deleted %1 auto-created divisional team(s)",array($numdeleted))));
@@ -73,22 +83,28 @@
 	
 	if($action=="deleteall")
 	{
-		$q2=mysql_query("SELECT *
+		$q2=$pdo->prepare("SELECT *
 				FROM 	judges_teams
 				WHERE 
-					conferences_id='".$conference['id']."'
+					year='".$config['FAIRYEAR']."'
 					");
+		$q2->execute();
 		$numdeleted=0;
-		while($r2=mysql_fetch_object($q2))
+		while($r2=$Q2->FETCH(PDO::FETCH_OBJ))
 		{
 			//okay now we can start deleting things! whew!
 			//first delete any linkings to the team
-			mysql_query("DELETE FROM judges_teams_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			
-			mysql_query("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
-			mysql_query("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt->execute();
-			mysql_query("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
-			mysql_query("DELETE FROM judges_teams WHERE id='$r2->id' AND conferences_id='".$conference['id']."'");
+			$stmt->execute();
-			$numdeleted++;
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_projects_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
+			$stmt->execute();
+			$stmt = $pdo->prepare("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$r2->id' AND year='".$config['FAIRYEAR']."'");
+			$stmt->execute();
+			$stmt = $pdo->prepare("DELETE FROM judges_teams WHERE id='$r2->id' AND year='".$config['FAIRYEAR']."'");
+			$stmt->execute();$numdeleted++;
 		}
 		if($numdeleted)
 			message_push(happy(i18n("Successfully deleted %1 team(s)",array($numdeleted))));
@@ -102,11 +118,12 @@
 		//but when we're done, if we're "assign" then go back to edit that team
 		//if we're save, then go back to the team list
 		$err=false;
-		$q=mysql_query("UPDATE judges_teams SET num='".$_POST['team_num']."', name='".mysql_escape_string(stripslashes($_POST['team_name']))."' WHERE id='$edit'");
+		$q=$pdo->prepare("UPDATE judges_teams SET num='".$_POST['team_num']."', name='".(stripslashes($_POST['team_name']))."' WHERE id='$edit'");
-		if(mysql_error())
+		$q->execute();
+		if($pdo->errorInfo())
 		{
 			$err=true;
-			message_push(error(mysql_error()));
+			message_push(error($pdo->errorInfo()));
 		}
 
 		if($_POST['award'])
@@ -116,13 +133,14 @@
 			//the judges wouldnt know which projects to judge for which award.  This doesnt apply for divisions
 			//because the category/division is obvious based on project numbesr.  A divisional judge team could easily
 			//be assigned to do all of Comp Sci - Junior, Intermediate and Senior without any problems.
-			$q=mysql_query("SELECT award_types.type FROM award_awards, award_types WHERE award_awards.award_types_id=award_types.id AND award_awards.id='".$_POST['award']."'");
+			$q=$pdo->prepare("SELECT award_types.type FROM award_awards, award_types WHERE award_awards.award_types_id=award_types.id AND award_awards.id='".$_POST['award']."'");
-			$aw=mysql_fetch_object($q);
+			$q->execute();
+			$aw=$q->fetch(PDO::FETCHH_OBJ);
 
 			$addaward=true;
 			if($aw->type=="Special")
 			{
-				$q=mysql_query("SELECT COUNT(*) AS num FROM 
+				$q=$pdo->prepare("SELECT COUNT(*) AS num FROM 
 							judges_teams_awards_link,
 							award_awards,
 							award_types
@@ -132,7 +150,8 @@
 							AND award_awards.award_types_id=award_types.id
 							AND award_types.type='Special'
 						");
-				$r=mysql_fetch_object($q);
+				$q->exxecute();
+				$r=$q->fetch(PDO::FETCHH_OBJ);
 				echo "special awards: $r->num";
 				if($r->num)
 				{
@@ -148,7 +167,8 @@
 			if($addaward)
 			{
 				//link up the award
-				mysql_query("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,conferences_id) VALUES ('".$_POST['award']."','$edit','".$conference['id']."')");
+				$stmt = $pdo->prepare("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,year) VALUES ('".$_POST['award']."','$edit','".$config['FAIRYEAR']."')");
+				$stmt->execute();
 				message_push(happy(i18n("Award assigned to team")));
 			}
 		}
@@ -171,7 +191,8 @@
 
 	if($action=="unassign")
 	{
-		mysql_query("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$edit' AND award_awards_id='".$_GET['unassign']."' AND conferences_id='".$conference['id']."'");
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_awards_link WHERE judges_teams_id='$edit' AND award_awards_id='".$_GET['unassign']."' AND year='".$config['FAIRYEAR']."'");
+		$stmt->execute();
 		message_push(happy(i18n("Award unassigned from judge team")));
 		//keep editing the same team
 		$action="edit";
@@ -180,8 +201,9 @@
 	if($action=="createall")
 	{
 		//first make sure we dont have any non-divisional award teams (dont want people hitting refresh and adding all the teams twice
-		$q=mysql_query("SELECT COUNT(*) AS c FROM judges_teams WHERE autocreate_type_id!='1' AND conferences_id='".$conference['id']."'");
+		$q=$pdo->prepare("SELECT COUNT(*) AS c FROM judges_teams WHERE autocreate_type_id!='1' AND year='".$config['FAIRYEAR']."'");
-		$r=mysql_fetch_object($q);
+		$q->execute();
+		$r=$q->fetch(PDO::FETCHH_OBJ);
 		if($r->c)
 		{
 			message_push(error(i18n("Cannot 'Create All' teams when any divisional teams currently exist.  Try deleting all existing non-divisional teams first.")));
@@ -189,7 +211,7 @@
 		else
 		{
 			//grab all the awards
-			$q=mysql_query("SELECT 
+			$q=$pdo->prepare("SELECT 
 						award_awards.*, 
 						award_types.type AS award_type, 
 						award_types.order AS award_types_order 
@@ -198,24 +220,40 @@
 						award_types 
 					WHERE 	
 						award_awards.award_types_id=award_types.id 
-						AND award_awards.conferences_id='".$conference['id']."' 
+						AND award_awards.year='".$config['FAIRYEAR']."' 
-						AND award_types.conferences_id='".$conference['id']."' 
+						AND award_types.year='".$config['FAIRYEAR']."' 
 						AND award_types_id!='1'
 					ORDER BY 
 						award_types_order, 
 						award_awards.order,
 						name");
-			$num=1;
+			$q->execute();
-			while($r=mysql_fetch_object($q))
+
-			{
+			//startat
+			$q2=$pdo->prepare("SELECT MAX(num) AS lastnum FROM judges_teams WHERE year='{$config['FAIRYEAR']}'");
+			$q2->execute();
+			$r2=$q2->fetch(PDO::FETCH_OBJ);
+			if($r2->lastnum)
+				$num=$r2->lastnum+1;
+			else
+				$num=1;
+
+			while($r=$q->fetch(PDO::FETCHH_OBJ)) {
 //				print_r($r);
-				$name=mysql_escape_string("($r->award_type) $r->name");
+				$name="($r->award_type) $r->name";
-				mysql_query("INSERT INTO judges_teams(num,name,autocreate_type_id,conferences_id) VALUES ('$num','$name','$r->award_types_id','".$conference['id']."')");
+				$stmt = $pdo->prepare("INSERT INTO judges_teams(num,name,autocreate_type_id,year) VALUES ('$num','$name','$r->award_types_id','".$config['FAIRYEAR']."')");
-				echo mysql_error();
+				$stmt->execute();
-				$team_id=mysql_insert_id();
+				echo $pdo->errorInfo();
-				//now link the new team to the award
+				$team_id=$pdo->lastInsertId();
-				mysql_query("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,conferences_id) VALUES ('$r->id','$team_id','".$conference['id']."')");
+				if($team_id) {
-				message_push(happy(i18n("Created team #%1: %2",array($num,$name))));
+					//now link the new team to the award
+					$stmt = $pdo->prepare("INSERT INTO judges_teams_awards_link (award_awards_id,judges_teams_id,year) VALUES ('$r->id','$team_id','".$config['FAIRYEAR']."')");
+					$stmt->execute();
+					message_push(happy(i18n("Created team #%1: %2",array($num,$name))));
+				}
+				else {
+					message_push(error(i18n("Error creating team #%1: %2",array($num,$name))));
+				}
 				$num++;
 			}
 		}
@@ -223,9 +261,10 @@
 
 	if($action=="add" && $_GET['num'])
 	{
-		mysql_query("INSERT INTO judges_teams(num,conferences_id) VALUES ('".$_GET['num']."','".$conference['id']."')");
+		$stmt = $pdo->prepare("INSERT INTO judges_teams(num,year) VALUES ('".$_GET['num']."','".$config['FAIRYEAR']."')");
-		echo mysql_error();
+		$stmt->execute();
-		$edit=mysql_insert_id();
+		echo $pdo->errorInfo();
+		$edit=$pdo->lastInsertId();
 		$action="edit";
 	}
 
@@ -301,9 +340,9 @@ function addclicked()
 					award_awards, 
 					award_types
 				WHERE 
-					award_awards.conferences_id='".$conference['id']."'
+					award_awards.year='".$config['FAIRYEAR']."'
 					AND award_types.id=award_awards.award_types_id
-					AND award_types.conferences_id='{$conference['id']}'
+					AND award_types.year='{$config['FAIRYEAR']}'
 				ORDER BY 
 					award_type_order,
 					name
@@ -323,23 +362,24 @@ function addclicked()
 					)
 					LEFT JOIN judges_teams_awards_link ON award_awards.id = judges_teams_awards_link.award_awards_id
 				WHERE 
-					award_awards.conferences_id='".$conference['id']."' AND 
+					award_awards.year='".$config['FAIRYEAR']."' AND 
 					judges_teams_awards_link.award_awards_id IS NULL
 					AND award_types.id=award_awards.award_types_id
-					AND award_types.conferences_id='{$conference['id']}'
+					AND award_types.year='{$config['FAIRYEAR']}'
 				ORDER BY 
 					award_type_order,
 					name";
 		}
 
 		echo "<tr><td colspan=2>";
-		$q=mysql_query($querystr);
+		$q=$pdo->prepare($querystr);
+		$q->execute();
 
-		echo mysql_error();
+		echo $pdo->errorInfo();
 		echo "<select name=\"award\">";
 		echo "<option value=\"\">".i18n("Choose award to assign to team")."</option>\n";
 
-		while($r=mysql_fetch_object($q))
+		while($r=$q->fetch(PDO::FETCHH_OBJ))
 		{
 			echo "<option value=\"$r->id\">($r->award_type) $r->name</option>\n";
 		}
@@ -365,15 +405,7 @@ function addclicked()
 		echo "<br />";
 
 		$teams=getJudgingTeams();
-		//print_r($teams);
+		if(count($teams)) {
-
-		if(!count($teams))
-		{
-			echo "<a href=\"judges_teams.php?action=createall\">".i18n("Automatically create one new team for every non-divisional award")."</a><br />";
-			echo "<a href=\"judges_teams.php?action=add&num=1\">".i18n("Manually add individual team")."</a><br />";
-		}
-		else
-		{
 			//grab an array of all the current team numbers
 			foreach($teams AS $team)
 				$teamnumbers[$team['num']]=1;
@@ -384,12 +416,24 @@ function addclicked()
 			{
 				$newteamnum++;
 			}
+		}
 
+		//print_r($teams);
+
+		echo "<table width=\"95%\">";
+		echo "<tr><td>";
+		$q=$pdo->prepare("SELECT COUNT(*) AS c FROM judges_teams WHERE autocreate_type_id!='1' AND year='".$config['FAIRYEAR']."'");
+		$q->execute();
+		$r=$q->fetch(PDO::FETCH_OBJ);
+		if(!$r->c) {
+			echo "<a href=\"judges_teams.php?action=createall\">".i18n("Automatically create one new team for every non-divisional award")."</a><br />";
+		}
+		echo "<a href=\"judges_teams.php?action=add&num=$newteamnum\">".i18n("Manually add individual team")."</a><br />";
+		echo "</td><td>";
+
+		if(count($teams)) 
+		{
 
-			echo "<table width=\"95%\">";
-			echo "<tr><td>";
-			echo "<a href=\"judges_teams.php?action=add&num=$newteamnum\">Add individual team</a><br />";
-			echo "</td><td>";
 			echo "<a onclick=\"return confirmClick('".i18n("Are you sure you want to delete all teams that are assigned to divisional awards?")."')\" href=\"judges_teams.php?action=deletealldivisional\">Delete all teams assigned to divisional awards</a>";
 			echo "<br />";
 			echo "<a onclick=\"return confirmClick('".i18n("Are you sure you want to delete all teams?")."')\" href=\"judges_teams.php?action=deleteall\">Delete all teams</a><br />";
@@ -403,7 +447,7 @@ function addclicked()
 			echo "</tr></thead>";
 			foreach($teams AS $team)
 			{
-				echo "<tr><td>".$team['num']."</td><td>";
+				echo "<tr><td>#".$team['num']."</td><td>";
 				echo $team['name'];
 				echo "</td>";
 
@@ -436,6 +480,9 @@ function addclicked()
 			echo "<script type=\"text/javascript\">$('.summarytable').tablesorter();</script>";
 			echo "<br />";
 		}
+		else {
+			echo "</td></tr></table>";
+		}
 	}
 	send_footer();
 

admin/judges_teams_members.php

@@ -24,7 +24,7 @@
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require_once('judges.inc.php');
 
  send_header("Judging Team Members",
@@ -75,7 +75,7 @@ function showMemberDetails(judgeId){
 function editMember(memberId){
 	if(memberId == undefined) memberId = selectedMemberId;
 	hideMemberDetails();
-	window.open("../user_editor_window.php?id="+memberId,"UserEditor","location=no,menubar=no,directories=no,toolbar=no,width=770,height=500,scrollbars=yes");
+	window.open("user_editor_window.php?id="+memberId,"UserEditor","location=no,menubar=no,directories=no,toolbar=no,width=770,height=500,scrollbars=yes");
 }
 
 function hideMemberDetails(){
@@ -106,13 +106,13 @@ jQuery(document).ready(function(){
 </script>
 <?
 
-	if($_POST['action']=="add" && $_POST['team_num'] && count($_POST['judgelist'])>0)
+	if($_POST['action']=="add" && $_POST['team_num'] && count($_POST['judgelist'])>0) {
-	{
 		//first check if this team exists.
-		$q=mysql_query("SELECT id,name FROM judges_teams WHERE num='".$_POST['team_num']."' AND conferences_id='".$conference['id']."'");
+		$q=$pdo->prepare("SELECT id,name FROM judges_teams WHERE num='".$_POST['team_num']."' AND year='".$config['FAIRYEAR']."'");
-		if(mysql_num_rows($q))
+		$q->execute();
+		if($q->rowCount();)
 		{
-			$r=mysql_fetch_object($q);
+			$r=$q->fetch(PDO::FETCH_OBJ);
 			$team_id=$r->id;
 			$team_name=$r->name;
 
@@ -125,20 +125,19 @@ jQuery(document).ready(function(){
 		}
 		$added=0;
 
-		foreach($_POST['judgelist'] AS $selectedjudge)
+		foreach($_POST['judgelist'] AS $selectedjudge) {
-		{
 			//before we insert them, we need to make sure they dont already belong to this team.  We can not have the same judge assigned to the same team multiple times.
 
-			$q=mysql_query("SELECT * FROM judges_teams_link WHERE users_id='$selectedjudge' AND judges_teams_id='$team_id'");
+			$q=$pdo->prepare("SELECT * FROM judges_teams_link WHERE users_id='$selectedjudge' AND judges_teams_id='$team_id'");
-			if(mysql_num_rows($q))
+			$q->execute();
-			{
+			if($q->rowCount();) {
 				echo notice(i18n("Judge (%1) already belongs to judging team: %2",array($selectedjudge,$team_name)));
 
 			}
-			else
+			else {
-			{
 				//lets make the first one we add a captain, the rest, non-captains :)
-				mysql_query("INSERT INTO judges_teams_link (users_id,judges_teams_id,captain,conferences_id) VALUES ('$selectedjudge','$team_id','$captain','".$conference['id']."')");	
+				$stmt = $pdo->prepare("INSERT INTO judges_teams_link (users_id,judges_teams_id,captain,year) VALUES ('$selectedjudge','$team_id','$captain','".$config['FAIRYEAR']."')");	
+				$stmt->execute();
 				$added++;
 			}
 			//if this is alreayd no, then who cares, but if its the first one that is going into the new team, then
@@ -155,18 +154,20 @@ jQuery(document).ready(function(){
 
 	if($_GET['action']=="del" && $_GET['team_num'] && $_GET['team_id'] && $_GET['users_id'])
 	{
-		mysql_query("DELETE FROM judges_teams_link WHERE users_id='".$_GET['users_id']."' AND judges_teams_id='".$_GET['team_id']."' AND conferences_id='".$conference['id']."'");
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_link WHERE users_id='".$_GET['users_id']."' AND judges_teams_id='".$_GET['team_id']."' AND year='".$config['FAIRYEAR']."'");
+		$stmt->execute();
 		echo happy(i18n("Removed judge from team #%1 (%2)",array($_GET['team_num'],$_GET['team_name'])));
 
 		//if there is still members left in the team, make sure we have a captain still
-		$q=mysql_query("SELECT * FROM judges_teams_link WHERE judges_teams_id='".$_GET['team_id']."' AND conferences_id='".$conference['id']."'");
+		$q = $pdo->prepare("SELECT * FROM judges_teams_link WHERE judges_teams_id='".$_GET['team_id']."' AND year='".$config['FAIRYEAR']."'");
-		if(mysql_num_rows($q))
+		$q->execute();
+		if($q->rowCount();)
 		{
 			//make sure the team still has a captain!
 			//FIXME: this might best come from the "i am willing to be a team captain" question under the judges profile
 			$gotcaptain=false;
 			$first=true;
-			while($r=mysql_fetch_object($q))
+			while($r=$q->fetch(PDO::FETCH_OBJ))
 			{
 				if($first)
 				{
@@ -183,7 +184,8 @@ jQuery(document).ready(function(){
 			if(!$gotcaptain)
 			{
 				//make the first judge the captain
-				mysql_query("UPDATE judges_teams_link SET captain='yes' WHERE judges_teams_id='".$_GET['team_id']."' AND users_id='$firstjudge' AND conferences_id='".$conference['id']."'");	
+				$stmt = $pdo->prepare("UPDATE judges_teams_link SET captain='yes' WHERE judges_teams_id='".$_GET['team_id']."' AND users_id='$firstjudge' AND year='".$config['FAIRYEAR']."'");	
+				$stmt->execute();
 				echo notice(i18n("Team captain was removed. A new team captain has been automatically assigned"));
 			}
 		}
@@ -191,7 +193,8 @@ jQuery(document).ready(function(){
 
 	if($_GET['action']=="empty" && $_GET['team_num'] && $_GET['team_id'])
 	{
-		mysql_query("DELETE FROM judges_teams_link WHERE judges_teams_id='".$_GET['team_id']."' AND conferences_id='".$conference['id']."'");
+		$stmt = $pdo->prepare("DELETE FROM judges_teams_link WHERE judges_teams_id='".$_GET['team_id']."' AND year='".$config['FAIRYEAR']."'");
+		$stmt->execute();
 		echo happy(i18n("Emptied all judges from team #%1 (%2)",array($_GET['team_num'],$_GET['team_name'])));
 	}
 
@@ -201,7 +204,8 @@ jQuery(document).ready(function(){
 		{
 			foreach($_POST['team_names'] AS $team_id=>$team_name)
 			{
-				mysql_query("UPDATE judges_teams SET name='".mysql_escape_string(stripslashes($team_name))."' WHERE id='$team_id'");
+				$stmt = $pdo->prepare("UPDATE judges_teams SET name='".stripslashes($team_name)."' WHERE id='$team_id'");
+				$stmt->execute();
 			}
 			echo happy(i18n("Team names successfully saved"));
 		}
@@ -212,25 +216,85 @@ jQuery(document).ready(function(){
 	{
 
 		//teams can have as many captains as they want, so just add it.
-		mysql_query("UPDATE judges_teams_link SET captain='yes' WHERE judges_teams_id='".$_GET['team_id']."' AND users_id='".$_GET['judge_id']."'");
+		$stmt = $pdo->prepare("UPDATE judges_teams_link SET captain='yes' WHERE judges_teams_id='".$_GET['team_id']."' AND users_id='".$_GET['judge_id']."'");
+		$stmt->execute();
 		echo happy(i18n("Team captain assigned"));
 	}
 
 	if($_GET['action']=="removecaptain")
 	{
 		//teams must always have at least one captain, so if we only have one, and we are trying to remove it, dont let them!
-		$q=mysql_query("SELECT * FROM judges_teams_link WHERE captain='yes' AND judges_teams_id='".$_GET['team_id']."'");
+		$q=$pdo->prepare("SELECT * FROM judges_teams_link WHERE captain='yes' AND judges_teams_id='".$_GET['team_id']."'");
-		if(mysql_num_rows($q)<2)
+		$q->execute();
+		if($q->rowCount();<2)
 		{
 			echo error(i18n("A judge team must always have at least one captain"));
 		}
 		else
 		{
-			mysql_query("UPDATE judges_teams_link SET captain='no' WHERE judges_teams_id='".$_GET['team_id']."' AND users_id='".$_GET['judge_id']."'");
+			$pdo->prepare("UPDATE judges_teams_link SET captain='no' WHERE judges_teams_id='".$_GET['team_id']."' AND users_id='".$_GET['judge_id']."'");
+			$pdo->execute();
 			echo happy(i18n("Team captain removed"));
 		}
 	}
 
+	if($_GET['action']=="autoassignspecial") {
+
+		/* Load all the judges (judge_complete=yes, deleted=no, year=fairyear) */
+		$judgelist = judges_load_all();
+
+		/* Load all the teams */
+		$teams = array();
+		$q = $pdo->prepare("SELECT * FROM judges_teams WHERE year='{$config['FAIRYEAR']}'");
+		$q->execute();
+		while($i = $q->fetch(PDO::FETCH_ASSOC)) {
+			$teams[$i['id']] = $i;
+		}
+
+		/* And the links */
+		$links = array();
+		$q = $pdo->prepare("SELECT * FROM judges_teams_link WHERE year='{$config['FAIRYEAR']}'");
+		$q->execute();
+		while($i = $q->fetch(PDO::FETCH_ASSOC)) {
+			$judgelist[$i['users_id']]['teams_links'][] = $i;
+		}
+
+		$jlist = array();
+
+		/* Remove all judges that have a link */
+		foreach($judgelist as $j) {
+			if(count($j['teams_links']) == 0 && $j['special_award_only']=="yes") 
+				$jlist[] = $j['id'];
+		}
+		echo "We have ".count($jlist)." special awards judges to assign";
+		foreach($jlist AS $jid) {
+			$j=$judgelist[$jid];
+			if(is_array($j['special_award_selected']) && count($j['special_award_selected'])) {
+				//assing them to ALL teams for ALL awards
+				foreach($j['special_award_selected'] AS $awardid) {
+					echo "Looking for a team for award $awardid <br />";
+					//find the award id linked to a team
+					$q=$pdo->prepare("SELECT * FROM judges_teams_awards_link WHERE award_awards_id='{$awardid}' AND year='{$config['FAIRYEAR']}'");
+					$q->execute();
+					if($q->rowCount();) {
+						while($r=$q->fetch(PDO::FETCH_OBJ)) {
+							$stmt = $pdo->prepare("INSERT INTO judges_teams_link (users_id,judges_teams_id,captain,year) VALUES ('$jid','$r->judges_teams_id','yes','{$config['FAIRYEAR']}')");
+							$stmt->execute();
+							echo happy(i18n("%1 %2 to their special award(s) team(s)",array($j['firstname'],$j['lastname'])));
+						}
+					}
+					else {
+						echo error(i18n("%1 %2 not assigned - No team found that is judging award id %1",array($awardid)));
+					}
+				}
+			}
+			else {
+				echo error(i18n("%1 %2 has indicated special awards only, but didnt selected any awards",array($j['firstname'],$j['lastname'])));
+			}
+
+		}
+	}
+
 	if(!$_SESSION['viewstate']['judges_teams_list_show'])
 		$_SESSION['viewstate']['judges_teams_list_show']='unassigned';
 	//now update the judges_teams_list_show viewstate
@@ -272,15 +336,17 @@ jQuery(document).ready(function(){
 
 	/* Load all the teams */
 	$teams = array();
-	$q = mysql_query("SELECT * FROM judges_teams WHERE conferences_id='{$conference['id']}'");
+	$q = $pdo->prepare("SELECT * FROM judges_teams WHERE year='{$config['FAIRYEAR']}'");
-	while($i = mysql_fetch_assoc($q)) {
+	$q->execute();
+	while($i = $q->fetch(PDO::FETCH_ASSOC)) {
 		$teams[$i['id']] = $i;
 	}
 
 	/* And the links */
 	$links = array();
-	$q = mysql_query("SELECT * FROM judges_teams_link WHERE conferences_id='{$conference['id']}'");
+	$q = $pdo->prepare("SELECT * FROM judges_teams_link WHERE year='{$config['FAIRYEAR']}'");
-	while($i = mysql_fetch_assoc($q)) {
+	$q->execute();
+	while($i = $q->fetch(PDO::FETCH_ASSOC)) {
 		$judgelist[$i['users_id']]['teams_links'][] = $i;
 	}
 
@@ -298,17 +364,24 @@ jQuery(document).ready(function(){
 	echo i18n("Listing %1 judges",array(count($jlist)));
 	echo "<br />";
 	echo "</center>";
-	echo mysql_error();
+	echo $pdo->errorInfo();
 	echo "<select name=\"judgelist[]\" onchange=\"switchjudgeinfo()\" multiple=\"multiple\" style=\"width: 250px; height: 600px;\">";
 
 	foreach($jlist as $jid) {
 		$u = &$judgelist[$jid];
-		if($u['firstname'] && $u['lastname'])
+		if($u['firstname'] && $u['lastname']) {
-			echo "<option value=\"$jid\">{$u['firstname']} {$u['lastname']} (" . implode(' ', $u['languages']) . ")</option>\n";
+			if($u['special_award_only']=='yes') {
+				$sp="[sp] ";
+			}
+			else $sp="";
+			echo "<option value=\"$jid\">{$sp}{$u['firstname']} {$u['lastname']} (" . implode(' ', $u['languages']) . ")</option>\n";
+		}
 	}
 	unset($u);
 
 	echo "</select>";
+	echo "<br />";
+	echo "<a href=\"judges_teams_members.php?action=autoassignspecial\">Auto-Assign Special Awards Judges to Special Awards Teams</a>\n";
 	echo "</td>";
 	echo "<td valign=\"top\">";
 
@@ -322,6 +395,7 @@ jQuery(document).ready(function(){
 		echo "<input onclick=\"addbuttonclicked('".$team['num']."')\" type=\"button\" value=\"Add &gt;&gt;\">";
 		echo "</td><td>";
 
+
 		echo "<table width=\"100%\">\n";
 		echo "<tr><th colspan=\"2\" align=\"left\">#".$team['num'].": ";
 		echo $team['name'];
@@ -336,18 +410,40 @@ jQuery(document).ready(function(){
 			foreach($team['members'] AS $member) {
 				$j = &$judgelist[$member['id']];
 				echo "<tr><td>";
+				/*
+				if($team['num']=="89") {
+					echo "<pre>";
+					print_r($team);
+					print_r($j);
+					echo "</pre>";
+				}
+				*/
 
 				$langerr=false;
+				$judgeerr=false;
 				foreach($team['languages'] AS $teamlang) {
-					if(!in_array($teamlang,$j['languages'])) {
+					if(is_array($j['languages'])) {
+						if(!in_array($teamlang,$j['languages'])) {
+							$langerr=true;
+							break;
+						}
+					} else {
 						$langerr=true;
-						break;
 					}
 				}
 
+				if(!$j['id']) {
+					$judgeerr=true;
+				}
+
 				echo "<a onclick=\"return confirmClick('Are you sure you want to remove this judge from this team?')\" href=\"judges_teams_members.php?action=del&team_id=".$team['id']."&team_num=".$team['num']."&users_id=".$member['id']."&team_name=".rawurlencode($team['name'])."\"><img border=0 src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\"></a>";
 				echo "</td><td width=\"100%\">";
-				if($langerr) echo "<span class=\"error\" style=\"width: 100%; display: block;\">";
+				if($langerr || $judgeerr) echo "<span class=\"error\" style=\"width: 100%; display: block;\">";
+				if($judgeerr) {
+					echo "ERROR: this judge is assigned to the team, but they are not an active/complete judge! <br />";
+				}
+
+
 				if($member['captain']=="yes") {
 					echo "<a title=\"Captain - Click to remove captain status\" href=\"judges_teams_members.php?action=removecaptain&team_id=".$team['id']."&judge_id=".$member['id']."\">";
 					echo "<img border=0 src=\"".$config['SFIABDIRECTORY']."/images/16/bookmark.".$config['icon_extension']."\">";
@@ -366,7 +462,7 @@ jQuery(document).ready(function(){
 					$l = is_array($j['languages']) ? join(' ',$j['languages']) : '';
 
 				echo "</a>&nbsp;<span style=\"font-size: 1.0em;\">($l)</span>\n";
-				if($langerr) echo "</span>\n";
+				if($langerr || $judgeerr) echo "</span>\n";
 				echo "</td></tr>";
 			}
 
@@ -394,7 +490,7 @@ jQuery(document).ready(function(){
 	echo "</td></tr>";
 	echo "</table>";
 	echo "</form>";
-	echo '<div id="infodiv" style="background-color: #DDF; border:solid;'
+	echo '<div id="infodiv" style="font-size: 1.2em; background-color: #DDF; border:solid;'
 		. ' border-width:1px;'
 		. ' border-color: #000;'
 		. ' position:absolute;'

admin/judges_teams_projects.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("judges.inc.php");
  require("../projects.inc.php");
 
@@ -79,7 +79,8 @@ if($_GET['judges_projects_list_eligible'])
 
 if($_GET['action']=="delete" && $_GET['delete'] && $_GET['edit'])
 {
-	mysql_query("DELETE FROM judges_teams_timeslots_projects_link WHERE id='".$_GET['delete']."'");
+	$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_projects_link WHERE id='".$_GET['delete']."'");
+	$stmt->execute();
 	echo happy(i18n("Judging team project successfully removed"));
 	$action="edit";
 }
@@ -87,12 +88,14 @@ if($_GET['action']=="delete" && $_GET['delete'] && $_GET['edit'])
 
 if($_POST['action']=="assign" && $_POST['edit'] && $_POST['timeslot'] && $_POST['project_id'])
 {
-	mysql_query("INSERT INTO judges_teams_timeslots_projects_link (judges_teams_id,judges_timeslots_id,projects_id,conferences_id) VALUES ('".$_POST['edit']."','".$_POST['timeslot']."','".$_POST['project_id']."','".$conference['id']."')");
+	$stmt = $pdo->prepare("INSERT INTO judges_teams_timeslots_projects_link (judges_teams_id,judges_timeslots_id,projects_id,year) VALUES ('".$_POST['edit']."','".$_POST['timeslot']."','".$_POST['project_id']."','".$config['FAIRYEAR']."')");
+	$stmt->execute();
 	echo happy(i18n("Project assigned to team timeslot"));
 }
 
-$q=mysql_query("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE conferences_id='".$conference['id']."'");
+$q=$pdo->prepare("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE year='".$config['FAIRYEAR']."'");
-if(mysql_num_rows($q)>1)
+$q->execute();
+if($q-rowCount()>1)
 	$show_date=true;
 else
 	$show_date=false;
@@ -150,7 +153,7 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 	echo $awardlist;
 
 	//get the timeslots that this team has.
-	$q=mysql_query("SELECT 
+	$q=$pdo->prepare("SELECT 
 				judges_timeslots.id,
 				judges_timeslots.date,
 				judges_timeslots.starttime,
@@ -166,9 +169,10 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 			ORDER BY
 				date,starttime
 			");
+	$q->execute();
 
 
-	$numslots=mysql_num_rows($q);
+	$numslots=$q-rowCount();
 	if($numslots)
 	{
 
@@ -212,7 +216,7 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 					projectnumber is not null 
 					" . getJudgingEligibilityCode(). " AND
 					projects.registrations_id=registrations.id AND
-					projects.conferences_id='".$conference['id']."'
+					projects.year='".$config['FAIRYEAR']."'
 				ORDER BY
 					projectnumber";
 		}
@@ -232,12 +236,13 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 					" . getJudgingEligibilityCode(). " AND
 					projects.registrations_id=registrations.id AND
 					judges_teams_timeslots_projects_link.projects_id IS NULL AND
-					projects.conferences_id='".$conference['id']."'
+					projects.year='".$config['FAIRYEAR']."'
 				ORDER BY
 					projectnumber";
 		}
-		$pq=mysql_query($querystr);
+		$pq=$pdo->($querystr);
-		echo mysql_error();
+		$pq->execute();
+		echo $pdo->errorInfo();
 	
 		$eligibleprojects=getProjectsEligibleOrNominatedForAwards($award_ids);
 //		echo nl2br(print_r($eligibleprojects,true));
@@ -248,7 +253,7 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 		$numprojects=0;
 		echo "<select name=\"project_id\">";
 		echo "<option value=\"\">".i18n("Choose Project to Assign to Timeslot")."</option>\n";
-		while($pr=mysql_fetch_object($pq)) {
+		while($pr=$pq->fetch(PDO::FETCH_OBJ)) {
 			if($_SESSION['viewstate']['judges_projects_list_eligible']=='true') {
 				if(in_array($pr->projectnumber,$eligibleprojectsnumbers)) {
 					echo "<option value=\"$pr->id\">$pr->projectnumber - $pr->title</option>\n";
@@ -276,7 +281,7 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 		echo "</tr>";
 
 
-		while($r=mysql_fetch_object($q)) {
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<tr><td>";
 
 			echo "<nobr>";
@@ -288,7 +293,7 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 			echo "</nobr>";
 			echo "</td><td>";
 			
-			$projq=mysql_query("SELECT
+			$projq=$pdo->prepare("SELECT
 						judges_teams_timeslots_projects_link.id AS link_id,
 						projects.projectnumber,
 						projects.id,
@@ -300,13 +305,14 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 						judges_teams_timeslots_projects_link.judges_timeslots_id='$r->id' AND
 						judges_teams_timeslots_projects_link.judges_teams_id='".$team['id']."' AND
 						judges_teams_timeslots_projects_link.projects_id=projects.id AND
-						judges_teams_timeslots_projects_link.conferences_id='".$conference['id']."'
+						judges_teams_timeslots_projects_link.year='".$config['FAIRYEAR']."'
 					ORDER BY
 						projectnumber
 					");
+			$projq->execute();
 
-		echo mysql_Error();
+		echo $pdo->errorInfo();
-			while($proj=mysql_fetch_object($projq)) {
+			while($proj=$projq->fetch(PDO::FETCH_OBJ)) {
 				echo "<a onclick=\"return confirmClick('Are you sure you want to remove this project from this team timeslot?')\" href=\"judges_teams_projects.php?action=delete&delete=".$proj->link_id."&edit=".$team['id']."\"><img border=0 src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\"></a>";
 				echo "$proj->projectnumber - $proj->title <br />";
 
@@ -361,7 +367,7 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 		echo "</td>";
 		echo "<td>";
 		//get the timeslots that this team has.
-		$q=mysql_query("SELECT 
+		$q=$pdo->prepare("SELECT 
 					judges_timeslots.id,
 					judges_timeslots.date,
 					judges_timeslots.starttime,
@@ -377,13 +383,14 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 				ORDER BY
 					date,starttime
 				");
-		$numslots=mysql_num_rows($q);
+		$q->execute();
+		$numslots=$q-rowCount();
 
 		echo "<a href=\"judges_teams_projects.php?action=edit&edit=".$team['id']."\">".i18n("Edit team project assignments")."</a>";
 
 		echo "<table class=\"tableview\" style=\"margin-left: 0px; width: 100%; font-size: 1.0em;\">";
 
-		while($r=mysql_fetch_object($q)) {
+		while($r=$q->fetch(PDO::FETCH_OBJ)) {
 			echo "<tr><td width=\"100\" align=\"center\">";
 
 			echo "<nobr>";
@@ -395,7 +402,7 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 			echo "</nobr>";
 			echo "</td><td>";
 
-			$projq=mysql_query("SELECT
+			$projq=$pdo->prepare("SELECT
 					projects.projectnumber,
 					projects.id,
 					projects.title,
@@ -407,19 +414,20 @@ if( ($action=="edit" || $action=="assign" ) && $edit)
 					judges_teams_timeslots_projects_link.judges_timeslots_id='$r->id' AND
 					judges_teams_timeslots_projects_link.judges_teams_id='".$team['id']."' AND
 					judges_teams_timeslots_projects_link.projects_id=projects.id AND
-					judges_teams_timeslots_projects_link.conferences_id='".$conference['id']."'
+					judges_teams_timeslots_projects_link.year='".$config['FAIRYEAR']."'
 				ORDER BY
 					projectnumber
 				");
+			$projq->execute();
 
-			echo mysql_error();
+			echo $pdo->errorInfo();
-			while($proj=mysql_fetch_object($projq)) {
+			while($proj=$projq->fetch(PDO::FETCH_OBJ)) {
                 if(!in_array($proj->language,$team['languages_members'])) 
                     echo "<span class=\"error\">";
 
 				echo "$proj->projectnumber - $proj->title ($proj->language)";
 
-                if(!in_array($proj->language,$team['languages'])) 
+                if(!in_array($proj->language,$team['languages_members'])) 
                     echo "</span>\n";
                 echo "<br />";
 			}

admin/judges_teams_timeslots.php

@@ -24,7 +24,7 @@
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require_once('judges.inc.php');
 
  $round_str = array('timeslot' => 'Judging Timeslot',
@@ -40,13 +40,15 @@
 
  if($action == 'delete' && array_key_exists('delete', $_GET)) {
 	$id = intval($_GET['delete']);
- 	mysql_query("DELETE FROM judges_teams_timeslots_link WHERE id='$id'");
+ 	$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_link WHERE id='$id'");
+	$stmt->execute();
 	message_push(happy(i18n("Judging team timeslot successfully removed")));
  }
 
  if($action == 'empty' && array_key_exists('empty',$_GET)) {
 	$id = intval($_GET['empty']);
- 	mysql_query("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$id'");
+ 	$stmt = $pdo->prepare("DELETE FROM judges_teams_timeslots_link WHERE judges_teams_id='$id'");
+	$stmt->execute();
 	message_push(happy(i18n("Judging team timeslots successfully removed")));
  }
 
@@ -56,9 +58,9 @@
 	if(count($_POST['teams']) && count($_POST['timeslots'])) {
 		foreach($_POST['teams'] AS $tm) {
 			foreach($_POST['timeslots'] AS $ts) {
-				mysql_query("INSERT INTO judges_teams_timeslots_link (judges_teams_id,judges_timeslots_id,conferences_id) 
+				$stmt = $pdo->prepare("INSERT INTO judges_teams_timeslots_link (judges_teams_id,judges_timeslots_id,year) 
-						VALUES ('$tm','$ts','{$conference['id']}')");
+						VALUES ('$tm','$ts','{$config['FAIRYEAR']}')");
-
+				$stmt->execute();
 			}
 		}
 		message_push(happy(i18n("%1 Timeslots assigned to %2 teams",array(count($_POST['timeslots']),count($_POST['teams'])))));
@@ -126,8 +128,9 @@ function checkinvert(what)
 	echo "<a href=\"\" onclick=\"return checkinvert('timeslots')\">invert selection</a>";
 
 
-	$q=mysql_query("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE conferences_id='".$conference['id']."'");
+	$q=$pdo->prepare("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE year='".$config['FAIRYEAR']."'");
-	if(mysql_num_rows($q)>1)
+	$q->execute();
+	if($q->rowCount()>1)
 		$show_date=true;
 	else
 		$show_date=false;
@@ -140,16 +143,18 @@ function checkinvert(what)
 	echo "<th>".i18n("End Time")."</th>";
 	echo "</tr>\n";
 	
-	$q=mysql_query("SELECT * FROM judges_timeslots 
+	$q=$pdo->prepare("SELECT * FROM judges_timeslots 
-			WHERE conferences_id='{$conference['id']}' 
+			WHERE year='{$config['FAIRYEAR']}' 
 			AND round_id='0' ORDER BY date,starttime");
-	while($r=mysql_fetch_object($q)) {
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		echo "<tr>";
 		$span = $show_date ? 4 : 3;
 		echo "<td colspan=\"$span\">{$r->name} (".$round_str[$r->type].")</td>";
-		$qq = mysql_query("SELECT * FROM judges_timeslots 
+		$qq = $pdo->prepare("SELECT * FROM judges_timeslots 
 					WHERE round_id='{$r->id}' ORDER BY date,starttime");
-		while($rr = mysql_fetch_object($qq)) {
+		$qq->execute();
+		while($rr = $qq->fetch(PDO::FETCH_OBJ)) {
 			echo "<tr>";
 			echo "<td><input type=\"checkbox\" name=\"timeslots[]\" value=\"{$rr->id}\" /></td>";
 			if($show_date)	echo "<td>".format_date($r->date)."</td>";
@@ -202,7 +207,7 @@ function checkinvert(what)
 		echo "</td>";
 		echo "<td>";
 		//get the timeslots that this team has.
-		$q=mysql_query("SELECT 
+		$q=$pdo->prepare("SELECT 
 					judges_teams_timeslots_link.id,
 					judges_timeslots.date,
 					judges_timeslots.starttime,
@@ -218,9 +223,10 @@ function checkinvert(what)
 				ORDER BY
 					date,starttime
 				");
-		$numslots=mysql_num_rows($q);
+		$q->execute();
+		$numslots=$q->rowCount();
 
-		while($r=mysql_fetch_object($q))
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 		{
 			echo "<nobr>";
 			if($show_date)

admin/judges_timeslots.php

@@ -24,7 +24,7 @@
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  $round_str = array('timeslot' => 'Judging Timeslot',
  					'divisional1' => 'Divisional Round 1',
@@ -76,21 +76,23 @@
 		message_push(error(i18n('Invalid type specified')));
 	}
 
-	$name = mysql_escape_string(stripslashes($_POST['name']));
+	$name = stripslashes($_POST['name']);
 
 	if($save == true) {
 		if($round_id == 0) {
 			/* New entry */
-			mysql_query("INSERT INTO judges_timeslots (round_id,conferences_id) VALUES('0','{$conference['id']}')");
+			$stmt = $pdo->prepare("INSERT INTO judges_timeslots (round_id,year) VALUES('0','{$config['FAIRYEAR']}')");
-			$round_id = mysql_insert_id();
+			$stmt->execute();
+			$round_id = $pdo->lastInsertId();
 		}
 
-		mysql_query("UPDATE judges_timeslots SET `date`='$date', 
+		$stmt = $pdo->prepare("UPDATE judges_timeslots SET `date`='$date', 
 								starttime='$starttime', endtime='$endtime',
 								`name`='$name',
 								`type`='$type' WHERE id='$round_id'");
+		$stmt->execute();
 
-		echo mysql_error();
+		echo $pdo->errorInfo();
 		message_push(happy(i18n("Round successfully saved")));
 		$action = '';
 	}
@@ -98,14 +100,20 @@
  }
 
  if($action == 'deleteround') {
- 	mysql_query("DELETE FROM judges_timeslots WHERE id='$round_id'");
+ 	
+	$stmt = $pdo->prepare("DELETE FROM judges_timeslots WHERE id='$round_id'");
+	$stmt->execute();
 	/* Also delete all timeslots */
- 	mysql_query("DELETE FROM judges_timeslots WHERE round_id='$round_id'");
+ 	
+	$stmt = $pdo->prepare("DELETE FROM judges_timeslots WHERE round_id='$round_id'");
+	$stmt->execute();
 	message_push(happy(i18n("Round successfully removed")));
 	$action = '';
  }
  if($action == 'deletetimeslot') {
- 	mysql_query("DELETE FROM judges_timeslots WHERE id='$timeslot_id'");
+ 	
+	$stmt = $pdo->prepare("DELETE FROM judges_timeslots WHERE id='$timeslot_id'");
+	$stmt->execute();
 	message_push(happy(i18n("Timeslot successfully removed")));
 	$action = '';
  } 
@@ -113,8 +121,9 @@
  if($action == 'savetimeslot') {
 	$save = true;
 
-	$q = mysql_query("SELECT * FROM judges_timeslots WHERE id='$round_id'");
+	$q = $pdo->prepare("SELECT * FROM judges_timeslots WHERE id='$round_id'");
-	$round_data = mysql_fetch_assoc($q);
+	$q->execute();
+	$round_data = $q->fetch(PDO::FETCH_ASSOC);
 
 	$date = $round_data['date'];
 
@@ -135,15 +144,17 @@
 	if($save == true) {
 		if($timeslot_id == 0) {
 			/* New entry */
-			mysql_query("INSERT INTO judges_timeslots (round_id,date,type,conferences_id) VALUES('$round_id',
+			$stmt = $pdo->prepare("INSERT INTO judges_timeslots (round_id,date,type,year) VALUES('$round_id',
-								'$date','timeslot','{$conference['id']}')");
+								'$date','timeslot','{$config['FAIRYEAR']}')");
-			$timeslot_id = mysql_insert_id();
+			$stmt->execute();
+			$timeslot_id = $pdo->lastInsertId();
 		}
 
-		mysql_query("UPDATE judges_timeslots SET starttime='$starttime', endtime='$endtime'
+		$stmt = $pdo->prepare("UPDATE judges_timeslots SET starttime='$starttime', endtime='$endtime'
 								WHERE id='$timeslot_id'");
+		$stmt->execute();
 
-		echo mysql_error();
+		echo $pdo->errorInfo();
 		message_push(happy(i18n("Timeslot successfully saved")));
 		$action = '';
 	}
@@ -158,8 +169,9 @@
 
 	if(array_key_exists('starttime_hour', $_POST) && array_key_exists('starttime_minute',$_POST) && $addnum && $duration) {
 	    	
-		$q = mysql_query("SELECT * FROM judges_timeslots WHERE id='$round_id'");
+		$q = $pdo->prepare("SELECT * FROM judges_timeslots WHERE id='$round_id'");
-		$round_data = mysql_fetch_assoc($q);
+		$q->execute();
+		$round_data = $q->fetch(PDO::FETCH_ASSOC);
 
 		$date = $round_data['date'];
 
@@ -169,23 +181,25 @@
 		$tt=$duration+$break;
 
 		for($x=0;$x<$addnum;$x++) {
-			$q=mysql_query("SELECT 	DATE_ADD('$date $hr:$min:00', INTERVAL $duration MINUTE) AS endtime, 
+			$q=$pdo->prepare("SELECT 	DATE_ADD('$date $hr:$min:00', INTERVAL $duration MINUTE) AS endtime, 
 						DATE_ADD('$date $hr:$min:00', INTERVAL $tt MINUTE) AS startnext ");
-			echo mysql_error();
+			$q->execute();
-			$r=mysql_fetch_object($q);
+			echo $pdo->errorInfo();
-			list($ed,$et)=explode(" ",$r->endtime);
+			$r=$q->fetch(PDO::FETCH_OBJ);
-			list($nd,$nt)=explode(" ",$r->startnext);
+			list($ed,$et)=split(" ",$r->endtime);
+			list($nd,$nt)=split(" ",$r->startnext);
 
 			$starttime = sprintf("%02d:%02d:00", $hr, $min);
 
-			mysql_query("INSERT INTO judges_timeslots (date,type,round_id,starttime,endtime,conferences_id) VALUES (
+			$stmt = $pdo->prepare("INSERT INTO judges_timeslots (date,type,round_id,starttime,endtime,year) VALUES (
 					'$date','timeslot','{$round_data['id']}',
 					'$starttime', '$et',
-					'{$conference['id']}')");
+					'{$config['FAIRYEAR']}')");
-			echo mysql_error();
+			$stmt->execute();
+			echo $pdo->errorInfo();
 			$date=$nd;
-			list($s_h,$s_m,$s_s)=explode(":",$nt);
+			list($s_h,$s_m,$s_s)=split(":",$nt);
-			list($e_h,$e_m,$e_s)=explode(":",$et);
+			list($e_h,$e_m,$e_s)=split(":",$et);
 			message_push(happy(i18n("Adding timeslot: %1",array("$date $hr:$min - $e_h:$e_m"))));
 			$hr=$s_h;
 			$min=$s_m;
@@ -224,12 +238,13 @@
 		$r['date'] = $config['dates']['fairdate'];
 	} else {
 		echo "<h3>Edit Judging Round</h3>";
-		$q=mysql_query("SELECT * FROM judges_timeslots WHERE id='$round_id'");
+		$q=$pdo->prepare("SELECT * FROM judges_timeslots WHERE id='$round_id'");
-		if(mysql_num_rows($q) != 1) {
+		$q->execute();
+		if($q->rowCount() != 1) {
 		    	echo "UNKNOWN ROUND $round_id";
 			exit;
 		}
-		$r = mysql_fetch_assoc($q);
+		$r = $q->fetch(PDO::FETCH_ASSOC);
 	}
 
 	echo "<table>";
@@ -269,8 +284,9 @@
 	echo "<input type=\"hidden\" name=\"round_id\" value=\"$round_id\">\n";
 	echo "<input type=\"hidden\" name=\"timeslot_id\" value=\"$timeslot_id\">\n";
 
-	$q = mysql_query("SELECT * FROM judges_timeslots WHERE id='$round_id'");
+	$q = $pdo->prepare("SELECT * FROM judges_timeslots WHERE id='$round_id'");
-	$round_data = mysql_fetch_assoc($q);
+		$q->execute();
+	$round_data = $q->fetch(PDO::FETCH_ASSOC);
 
 	if($action == 'addtimeslot') {
 		echo "<h3>Add New Judging Timeslot</h3>";
@@ -278,12 +294,13 @@
 		$r['date'] = $round_data['date'];
 	} else {
 		echo "<h3>Edit Judging Timeslot</h3>";
-		$q=mysql_query("SELECT * FROM judges_timeslots WHERE id='$timeslot_id'");
+		$q=$pdo->prepare("SELECT * FROM judges_timeslots WHERE id='$timeslot_id'");
-		if(mysql_num_rows($q) != 1) {
+		$q->execute();
+		if($q->rowCount() != 1) {
 		    	echo "UNKNOWN ROUND $round_id";
 			exit;
 		}
-		$r = mysql_fetch_assoc($q);
+		$r = $q->fetch(PDO::FETCH_ASSOC);
 	}
 
 	echo "<table>";
@@ -313,8 +330,9 @@
 	echo "<input type=\"hidden\" name=\"round_id\" value=\"$round_id\">\n";
 	echo "<input type=\"hidden\" name=\"timeslot_id\" value=\"$timeslot_id\">\n";
 
-	$q = mysql_query("SELECT * FROM judges_timeslots WHERE id='$round_id'");
+	$q = $pdo->prepare("SELECT * FROM judges_timeslots WHERE id='$round_id'");
-	$round_data = mysql_fetch_assoc($q);
+	$q->execute();
+	$round_data = $q->fetch(PDO::FETCH_ASSOC);
 
 	echo "<table border=\"0\">";
 	echo "<tr><td>".i18n('Round Type').":</td><td>{$round_str[$round_data['type']]}</td></tr>";
@@ -353,11 +371,14 @@
 	echo "<th>".i18n("Actions")."</th>";
 	echo "</tr>";
 
-	$q=mysql_query("SELECT * FROM judges_timeslots WHERE conferences_id='{$conference['id']}' AND `type`!='timeslot' ORDER BY date,starttime");
+	
-	while($r=mysql_fetch_object($q)) {
+	$q=$pdo->prepare("SELECT * FROM judges_timeslots WHERE year='{$config['FAIRYEAR']}' AND `type`!='timeslot' ORDER BY date,starttime");
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		echo "<tr>";
-		$qq = mysql_query("SELECT * FROM judges_timeslots WHERE round_id='{$r->id}' ORDER BY `date`,`starttime`");
+		$qq = $pdo->prepare("SELECT * FROM judges_timeslots WHERE round_id='{$r->id}' ORDER BY `date`,`starttime`");
-		$c = mysql_num_rows($qq) +1;
+		$qq->execute();
+		$c = $qq->rowCount() +1;
 
 		echo "<td rowspan=\"$c\"><b>".format_date($r->date)."</b></td>";
 		echo "<td align=\"center\"><b>".format_time($r->starttime)."</b><br/>";
@@ -376,7 +397,7 @@
 
 		echo "</tr>";
 
-		while($rr = mysql_fetch_object($qq)) {
+		while($rr = $qq->fetch(PDO::FETCH_OBJ)) {
 			echo "<tr>";
 //			echo "<td></td>";
 			echo "<td align=\"right\">".format_time($rr->starttime)."</td>";

admin/judging_score_edit.php

@@ -25,13 +25,14 @@
  require("../common.inc.php");
  require_once("../user.inc.php");
  require_once("judges.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("Judging Score Entry - Update",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php',
 			'Judging Score Entry' => 'admin/judging_score_entry.php')
 				);
 
+ $year=$config['FAIRYEAR'];
  $project_id = NULL;
  if($_GET['projectid']) {
 	 $project_id = $_GET['projectid'];
@@ -44,13 +45,17 @@
                          if($score == 0) {
                                  $score = "NULL";
                          } else {
-                                 $score = mysql_real_escape_string($score);
+                                 $score = $score;
                          }
-		 mysql_query("UPDATE judges_teams_timeslots_projects_link 
+						 if($score >100.00) {
+							$score_error = "*** ERROR **** You entered a value greater than 100.00";							
+						 }
+		 $stmt = $pdo->prepare("UPDATE judges_teams_timeslots_projects_link 
 				 					SET score=" . $score . 
-			          " WHERE judges_teams_id = " . mysql_real_escape_string($_POST["team_" . $curr_team . "_id"]) . 
+			          " WHERE judges_teams_id = " . $_POST["team_" . $curr_team . "_id"] . 
-			          " and projects_id =$project_id and conferences_id={$conference['id']}");
+			          " and projects_id =$project_id and year=$year");
-		 echo mysql_error();
+		$stmt->execute();
+		 echo $pdo->errorInfo();
 		 }
 		 $curr_team--;
 	 }
@@ -59,25 +64,36 @@
   ?>
 <?
 if($project_id) {
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='{$conference['id']} ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projects WHERE projects.id = '".$project_id."'");
-while($r=mysql_fetch_object($q))
+$q->execute();
+$r=$q->fetch(PDO::FETCH_OBJ);
+$project_number = $r->projectnumber;
+$project_title = $r->title;
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='$year' ORDER BY id");
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ))
 	$cats[$r->id]=$r->category;
 
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conference['id']} ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='$year' ORDER BY id");
+$q->execute();
 
 
-	$q=mysql_query("SELECT judges_teams_timeslots_projects_link.judges_teams_id, 
+	$q=$pdo->prepare("SELECT judges_teams_timeslots_projects_link.judges_teams_id, 
 												 score, 
 												 judges_teams.num
 			            FROM judges_teams_timeslots_projects_link, 
 									     judges_teams
 			            WHERE judges_teams_timeslots_projects_link.judges_teams_id = judges_teams.id 
-									     AND projects_id = ".mysql_real_escape_string($project_id)." ORDER BY judges_teams_id"
+									     AND projects_id = ".$project_id." ORDER BY judges_teams_id"
 								);
-	echo mysql_error();
+	$q->execute();
-
+	echo $pdo->errorInfo();
+    echo "Project# ".$project_number."  ".$project_title."<br />";
+	if ($score_error != "") {
+	echo $score_error."<br />";	
+	}
 	echo "<form action=\"judging_score_edit.php\" method=\"post\">";
-	echo "<input type=\"hidden\" name=\"score_count\" value=\"" . mysql_num_rows($q) . "\"/>";
+	echo "<input type=\"hidden\" name=\"score_count\" value=\"" . $q->rowCount() . "\"/>";
 	echo "<input type=\"hidden\" name=\"projectid\" value=\"$project_id\"/>";
 	echo "<table class=\"tableview\">";
 	echo "<tr>";
@@ -88,7 +104,7 @@ $q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conferenc
 	echo "</tr>";
 
 	$i = 1;
-	while($r=mysql_fetch_object($q)) {
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		$team=getJudgingTeam($r->judges_teams_id);
 		$teamNames=array_map("teamMemberToName", $team['members']);
 		echo "<tr>\n";
@@ -107,7 +123,7 @@ $q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conferenc
 		}
 		echo "\n</td>\n";
 		echo "<td style=\"vertical-align: middle; text-align: center\">\n";
-		echo "<input type=\"text\" size=\"3\" maxlength=\"3\" name=\"team_" . $i . "_score\" value=\"$r->score\"/>\n";
+		echo "<input type=\"text\" size=\"5\" maxlength=\"5\" name=\"team_" . $i . "_score\" value=\"$r->score\"/>\n";
 		echo "</td>\n";
 		echo "</tr>\n";
 		$i++;

admin/judging_score_entry.php

@@ -25,10 +25,10 @@
  require("../common.inc.php");
  require_once("../user.inc.php");
  require_once("judges.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
- if($_GET['conferences_id']) $conferences_id=$_GET['conferences_id'];
+ if($_GET['year']) $year=$_GET['year'];
- else $conferences_id=$conference['id'];
+ else $year=$config['FAIRYEAR'];
 
  if($_GET['csv'] == 'yes') {
 	header("Content-type: text/csv");
@@ -42,17 +42,19 @@
  }
  ?>
 <?
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id = '$conferences_id' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='$year' ORDER BY id");
-while($r=mysql_fetch_object($q))
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ))
 	$cats[$r->id]=$r->category;
 
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id = '$conferences_id' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='$year' ORDER BY id");
-while($r=mysql_fetch_object($q))
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ))
 	$divs[$r->id]=$r->division;
 
 $ORDERBY="projects.projectcategories_id, projects.projectdivisions_id, projects.projectnumber";
 
-	$q=mysql_query("SELECT  registrations.id AS reg_id,
+	$q=$pdo->prepare("SELECT  registrations.id AS reg_id,
 				registrations.num AS reg_num,
 				projects.id as projectid,
 				projects.title,
@@ -60,9 +62,6 @@ $ORDERBY="projects.projectcategories_id, projects.projectdivisions_id, projects.
 				projects.projectcategories_id,
 				projects.projectdivisions_id,
 				judges_teams_id as res_team_id,
-				count(score) as score_count,
-				count((SELECT count(*) FROM judges_teams_timeslots_projects_link WHERE 
-					projectid=judges_teams_timeslots_projects_link.projects_id)) as score_total_count,
 				avg(score) as score, 
 				avg(score + (SELECT 70-avg(score) 
 				             FROM judges_teams_timeslots_projects_link 
@@ -73,42 +72,18 @@ $ORDERBY="projects.projectcategories_id, projects.projectdivisions_id, projects.
 				left outer join projects on projects.registrations_id=registrations.id
 				left outer join judges_teams_timeslots_projects_link on projects.id=judges_teams_timeslots_projects_link.projects_id
 			WHERE
-				registrations.conferences_id='$conferences_id' "
+				registrations.year='$year' "
 				. getJudgingEligibilityCode() . " 
 			GROUP BY projectid
 			ORDER BY
 				$ORDERBY
 			");
-		echo mysql_error();
+	$q->execute();
+		echo $pdo->errorInfo();
 	
 	if($_GET['csv'] != 'yes') {
-?>
-<script language="javascript" type="text/javascript">
-$(document).ready(function() { 
-    $("#div-cat-best").click(function() { 
-        // set sorting column and direction, this will sort on the first and third column the column index starts at zero 
-        var sorting = [[2,0],[3,0],[5,1]]; 
-        // sort on the first column 
-        $(".tableview").trigger("sorton",[sorting]); 
-        // return false to stop default link action 
-        return false; 
-    }); 
-    $("#overall-best").click(function() { 
-        // set sorting column and direction, this will sort on the first and third column the column index starts at zero 
-        var sorting = [[5,1]]; 
-        // sort on the first column 
-        $(".tableview").trigger("sorton",[sorting]); 
-        // return false to stop default link action 
-        return false; 
-    }); 
-});
-</script>
-<?php
 		echo "<a href='judging_score_entry.php?csv=yes'>" . i18n("Generate CSV Report") . "</a>\n";
-		echo "<br /><a href='#' id='div-cat-best'>" . i18n("Sort By Best in Division/Category") . "</a>\n";
-		echo "<br /><a href='#' id='overall-best'>" . i18n("Sort By Best Overall") . "</a>\n";
 		echo "<table class=\"tableview\">";
-		echo "<thead>";
 		echo "<tr>";
 		echo  "<th>".i18n("Proj Num")."</th>";
 		echo  "<th>".i18n("Project Title")."</th>";
@@ -116,29 +91,27 @@ $(document).ready(function() {
 		echo  "<th>".i18n("Division")."</th>";
 		echo  "<th>".i18n("Score")."</th>";
 		echo  "<th>".i18n("Normalized Score")."</th>";
-		echo  "<th>".i18n("Judgings")."</th>";
 		echo  "<th>".i18n("Action")."</th>";
 		echo "</tr>";
-		echo "</thead>";
-		echo "<tbody>";
 	} else {
 		echo "Project #\tTitle\tCategory\tDivision\tScore\tNormalized Scores\tJudge Name\tJudges Score\n";
 	}
 
-	while($r=mysql_fetch_object($q))
+	while($r=$q->fetch(PDO::FETCH_OBJ))
 	{
 		if($_GET['csv'] == 'yes') {
 			echo "$r->projectnumber \t $r->title \t" . $cats[$r->projectcategories_id] . "\t" . $divs[$r->projectdivisions_id] . " \t $r->score \t $r->norm_score ";
-			$p=mysql_query("SELECT judges_teams_timeslots_projects_link.judges_teams_id, 
+			$p=$pdo->prepare("SELECT judges_teams_timeslots_projects_link.judges_teams_id, 
 								    				 score, 
 												     judges_teams.num
 			                FROM judges_teams_timeslots_projects_link, 
 									         judges_teams
 			                WHERE judges_teams_timeslots_projects_link.judges_teams_id = judges_teams.id 
-									          AND projects_id = ".mysql_real_escape_string($r->projectid)." ORDER BY judges_teams_id"
+									          AND projects_id = ".$r->projectid." ORDER BY judges_teams_id"
 								);
-	echo mysql_error();
+			$p->execute();
-			while($s=mysql_fetch_object($p)) {
+	echo $pdo->errorInfo();
+			while($s=$p->fetch(PDO::FETCH_OBJ)) {
                                 $team=getJudgingTeam($s->judges_teams_id);
                                 $teamNames=array_map("teamMemberToName", $team['members']);
 				echo "\t " . implode(", ", $teamNames) . " \t $s->score";
@@ -152,18 +125,10 @@ $(document).ready(function() {
 
 			echo "<td>".i18n($cats[$r->projectcategories_id])."</td>\n";
 			echo "<td>".i18n($divs[$r->projectdivisions_id])."</td>\n";
-			echo "<td class='judging_score'>" . number_format($r->score, 2) . "</td>\n";
+			echo "<td>" . number_format($r->score, 2) . "</td>\n";
-			echo "<td class='judging_score'><strong>" . number_format($r->norm_score, 2) . "</strong></td>\n";
+			echo "<td>" . number_format($r->norm_score, 2) . "</td>\n";
-			if ($r->score_count == $r->score_total_count) {
-				echo "<td>";
-			} else if ($r->score_count == 0) {
-				echo "<td class='caution'>";
-			} else {
-				echo "<td class='error'>";
-			}
-			echo number_format($r->score_count, 0) . "/" . number_format($r->score_total_count, 0) . "</td>\n";
 			echo "<td align=\"center\">";
-			if($conferences_id == $conference['id']){
+			if($year==$config['FAIRYEAR']) {
 				echo "<a href=\"judging_score_edit.php?projectid=$r->projectid\">";
 				echo i18n("Edit Scores");
 				echo "</a>";
@@ -173,7 +138,6 @@ $(document).ready(function() {
 		}
 	}
 	if($_GET['csv'] != 'yes') {
-		echo "</tbody>";
 		echo "</table>\n";
 		echo "<br />";
 

admin/locations.php

@@ -1,59 +0,0 @@
-<?
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
-   Copyright (C) 2005 James Grant <james@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?
-require("../common.inc.php");
-require("../tableeditor.class.php");
-require_once("../user.inc.php");
-user_auth_required('admin');
-
-send_header("Event Locations", 
-	array('Committee Main' => 'committee_main.php',
-		'Administration' => 'admin/index.php',
-		'Events & Scheduling' => 'admin/eventsscheduling.php'),
-		"events_scheduling" );
-
-echo "<br />";
-$editor = new TableEditor("locations",
-	array(
-		"name" => "Location Name"
-	),
-	array(
-		"name" => "Location Name"
-	),
-	array(
-		"conferences_id" => $conference['id']
-	)
-
-);
-
-$editor->filterList("conferences_id", $conference['id']);
-$editor->setPrimaryKey("id");
-$editor->setRecordType("Location");
-$editor->setDefaultSortField("name");
-$editor->execute();
-	
-
-send_footer();
-
-?>

admin/project_editor.php

@@ -20,13 +20,19 @@
    the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
    Boston, MA 02111-1307, USA.
 */
+
+// This file was modified Jan of 2014 by Richard Sin
+// Project type has been added and can be toggled by configuration.
+// Feedback box also has been added for flagging purposes
+
 ?>
 <?
 require_once('../common.inc.php');
 require_once('../user.inc.php');
 require_once('../register_participants.inc.php');
 
-$auth_type = user_auth_required(array(), array('fair','admin'));
+$auth_type = user_auth_required(array('fair','committee'), 'admin');
+
 
 $registrations_id=intval($_GET['id']);
 $action = $_GET['action'];
@@ -40,11 +46,14 @@ if($auth_type == 'fair') {
 	} else {
 		/* Make sure they have permission to laod this student, check
 		the master copy of the fairs_id in the project */
-		$q=mysql_query("SELECT * FROM projects WHERE 
+		$q=$pdo>prepare("SELECT * FROM projects WHERE 
 				registrations_id='$registrations_id' 
-				AND conferences_id='{$conference['id']}'
+				AND year='{$config['FAIRYEAR']}'
 				AND fairs_id=$fairs_id");
-		if(mysql_num_rows($q) != 1) {
+
+
+		$q->execute();
+		if($q->rowCount()!= 1) {
 			echo "permission denied.";
 			exit;
 		} 
@@ -55,26 +64,29 @@ if($auth_type == 'fair') {
 
 switch($action) {
 case 'project_load':
-	project_load2();
+	project_load();
 	break;
 case 'project_regenerate_number':
 	/* Save first */
 	project_save();
 
 	/* Now generate */
-	$q=mysql_query("SELECT id FROM projects WHERE registrations_id='{$registrations_id}' AND conferences_id='{$conference['id']}'");
+	$q=$pdo->prepare("SELECT id FROM projects WHERE registrations_id='{$registrations_id}' AND year='{$config['FAIRYEAR']}'");
-	$i=mysql_fetch_assoc($q);
+	$q->execute();
+	$i=$q->fetch(PDO::FETCH_ASSOC);;
 	$id = $i['id'];
 
-	mysql_query("UPDATE projects SET projectnumber=NULL,projectsort=NULL,
+	$pdo->prepare("UPDATE projects SET projectnumber=NULL,projectsort=NULL,
 				projectnumber_seq='0',projectsort_seq='0'
 				WHERE id='$id'");
-	echo mysql_error();
+	$pdo->execute();
+	echo $pdo->errorInfo();
  	list($pn,$ps,$pns,$pss) = generateProjectNumber($registrations_id);
 //	print("Generated Project Number [$pn]");
-	mysql_query("UPDATE projects SET projectnumber='$pn',projectsort='$ps',
+	$pdo->prepare("UPDATE projects SET projectnumber='$pn',projectsort='$ps',
 				projectnumber_seq='$pns',projectsort_seq='$pss'
 				WHERE id='$id'");
+	$pdo->execute();
 	happy_("Generated and Saved Project Number: $pn");
 	break;
 
@@ -89,11 +101,12 @@ exit;
 
 function project_save()
 {
-	global $registrations_id, $config, $conference;
+	global $registrations_id, $config;
 
 	//first, lets make sure this project really does belong to them
-	$q=mysql_query("SELECT * FROM projects WHERE registrations_id='{$registrations_id}' AND conferences_id='{$conference['id']}'");
+	$q=$pdo->prepare("SELECT * FROM projects WHERE registrations_id='{$registrations_id}' AND year='{$config['FAIRYEAR']}'");
-	$projectinfo=mysql_fetch_object($q);
+	$q->execute();
+	$projectinfo = $q->fetch(PDO::FETCH_OBJ);
 	if(!projectinfo) {
 		echo error(i18n("Invalid project to update"));
 	}
@@ -105,64 +118,104 @@ function project_save()
 	else
 		$summarycountok=1;
 
+	//check if it is flagged then update it
+
+	if(empty($_POST['feedback'])) {
+		$stmt = $pdo->prepare("UPDATE projects SET ".
+			"flagged='0'".
+			"WHERE id='".intval($_POST['id'])."'");
+		$stmt->execute();
+	} else {
+		$stmt = $pdo->prepare("UPDATE projects SET ".
+			"flagged='1'".
+			"WHERE id='".intval($_POST['id'])."'");
+		$stmt->execute();
+	}
+	echo $pdo->errorInfo();
+	happy_("Flagging process successfully updated");
+	
 	if($config['participant_project_title_charmax'] && strlen(stripslashes($_POST['title']))>$config['participant_project_title_charmax']) {  //0 for no limit, eg 255 database field limit 
 		$title=substr(stripslashes($_POST['title']),0,$config['participant_project_title_charmax']);
 		error_("Project title truncated to %1 characters",array($config['participant_project_title_charmax']));
 	} else
 		$title=stripslashes($_POST['title']);
 
-	mysql_query("UPDATE projects SET ".
+	$stmt = $pdo->prepare("UPDATE projects SET ".
-			"title='".mysql_escape_string($title)."', ".
+			"title='".iconv("UTF-8","ISO-8859-1//TRANSLIT",$title)."', ".
-			"projectdivisions_id='".intval($_POST['projectdivisions_id'])."', ".
+			"projectdivisions_id='".intval($_POST['projectdivisions_id']."', ".
-			"language='".mysql_escape_string(stripslashes($_POST['language']))."', ".
+			"projecttype='".stripslashes($_POST['projecttype'])."', ".
-			"req_table='".mysql_escape_string(stripslashes($_POST['req_table']))."', ".
+			"language='".stripslashes($_POST['language'])."', ".
-			"req_electricity='".mysql_escape_string(stripslashes($_POST['req_electricity']))."', ".
+			"req_table='".stripslashes($_POST['req_table'])."', ".
-			"req_special='".mysql_escape_string(stripslashes($_POST['req_special']))."', ".
+			"req_electricity='".stripslashes($_POST['req_electricity'])."', ".
-			"summary='".mysql_escape_string(stripslashes($_POST['summary']))."', ".
+			"req_special='".iconv("UTF-8","ISO-8859-1//TRANSLIT",stripslashes($_POST['req_special']))."', ".
+			"human_participants='".stripslashes($_POST['human_participants'])."', ".
+			"animal_participants='".stripslashes($_POST['animal_participants'])."', ".
+			"summary='".iconv("UTF-8","ISO-8859-1//TRANSLIT",stripslashes($_POST['summary']))."', ".
 			"summarycountok='$summarycountok',".
-			"projectsort='".mysql_escape_string(stripslashes($_POST['projectsort']))."'".
+			"feedback='".iconv("UTF-8","ISO-8859-1//TRANSLIT",stripslashes($_POST['feedback']))."', ".
-			"WHERE id='".intval($_POST['id'])."'");
+			"projectsort='".stripslashes($_POST['projectsort'])."'".
-			echo mysql_error();
+			"WHERE id='".intval($_POST['id']))."'");
-	happy_('Project Information Saved');
+			echo $pdo->errorInfo();
+	happy_("Project information successfully updated");
 
 	//check if they changed the project number
 	if($_POST['projectnumber']!=$projectinfo->projectnumber) {
 		//check if hte new one is available
-		$q=mysql_query("SELECT * FROM projects WHERE conferences_id='".$conference['id']."' AND projectnumber='".$_POST['projectnumber']."'");
+		$q=$pdo->prepare("SELECT * FROM projects WHERE year='".$config['FAIRYEAR']."' AND projectnumber='".$_POST['projectnumber']."'");
-		if(mysql_num_rows($q)) {
+		$q->execute();
+		if($q->rowCount()) {
 			error_("Could not change project number.  %1 is already in use",array($_POST['projectnumber']));
 		} else {
-			mysql_query("UPDATE projects SET
+			$stmt = $pdo->prepare("UPDATE projects SET
 					projectnumber='".$_POST['projectnumber']."'
 					WHERE id='".$_POST['id']."'");
+			$stmt->execute();
 			happy_("Project number successfully changed to %1",array($_POST['projectnumber']));
 		}
 	}
 }
 
 
-function project_load2()
+function project_load()
 {
-	global $registrations_id, $config, $conference;
+	global $registrations_id, $config;
+	//now lets find out their MAX grade, so we can pre-set the Age Category
+	$q=$pdo->prepare("SELECT MAX(grade) AS maxgrade FROM students WHERE registrations_id='".$registrations_id."'");
+	$q->execute();
+	$gradeinfo=$q->fetch(PDO::FETCH_OBJ);
+
+	//now lets grab all the age categories, so we can choose one based on the max grade
+	$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
+	$q->execute();
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
+		//save these in an array, just incase we need them later (FIXME: remove this array if we dont need it)
+		$agecategories[$r->id]['category']=$r->category;
+		$agecategories[$r->id]['mingrade']=$r->mingrade;
+		$agecategories[$r->id]['maxgrade']=$r->maxgrade;
+
+		if($gradeinfo->maxgrade >= $r->mingrade && $gradeinfo->maxgrade <= $r->maxgrade)
+			$projectcategories_id=$r->id;
+	}
 
-	$projectcategories_id=getProjectCategory($registrations_id);
 	//now select their project info
-	$q=mysql_query("SELECT * FROM projects WHERE registrations_id='".$registrations_id."' AND conferences_id='".$conference['id']."'");
+	$q=$pdo->prepare("SELECT * FROM projects WHERE registrations_id='".$registrations_id."' AND year='".$config['FAIRYEAR']."'");
 	//check if it exists, if we didnt find any record, lets insert one
-	$projectinfo=mysql_fetch_object($q);
+	$q->execute();
-
+	$projectinfo=$q->fetch(PDO::FETCH_OBJ);
-	$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='".$conference['id']."' ORDER BY id");
+	if(!$projectinfo) {
-	while($r=mysql_fetch_object($q)) {
+		$stmt = $pdo->prepare("INSERT INTO projects (registrations_id,projectcategories_id,year) VALUES ('".$registrations_id."','$projectcategories_id','".$config['FAIRYEAR']."')"); 
-		//save these in an array, so we can use them below
+		//and then pull it back out
-	   $agecategories[$r->id]['category']=$r->category;
+		$stmt->execute();
-	   $agecategories[$r->id]['mingrade']=$r->mingrade;
+		$q=$pdo->prepare("SELECT * FROM projects WHERE registrations_id='".$registrations_id."' AND year='".$config['FAIRYEAR']."'");
-	   $agecategories[$r->id]['maxgrade']=$r->maxgrade;
+		$q->execute();
+		$projectinfo=$q->fetch(PDO::FETCH_OBJ);
 	}
 
 	//make sure that if they changed their grade on the student page, we update their projectcategories_id accordingly
 	if($projectcategories_id && $projectinfo->projectcategories_id!=$projectcategories_id) {
 		echo notice(i18n("Age category changed, updating to %1",array($agecategories[$projectcategories_id]['category'])));
-		mysql_query("UPDATE projects SET projectcategories_id='$projectcategories_id' WHERE id='$projectinfo->id'");
+		$stmt = $pdo->prepare("UPDATE projects SET projectcategories_id='$projectcategories_id' WHERE id='$projectinfo->id'");
+		$stmt->execute();
 	}
 
 	//output the current status
@@ -199,7 +252,7 @@ function countwords()
 	<input type="hidden" name="id" value="<?=$projectinfo->id?>">
 	<table>
 	<tr>	<td><?=i18n("Project Title")?>: </td>
-		<td><input type="text" name="title" size="50" value="<?=htmlspecialchars($projectinfo->title)?>" /><?=REQUIREDFIELD?>
+		<td><input type="text" name="title" size="50" value="<?=htmlspecialchars($projectinfo->title,null,"ISO8859-1")?>" /><?=REQUIREDFIELD?>
 <?
 	if($config['participant_project_title_charmax'])
 		echo i18n("(Max %1 characters)",array($config['participant_project_title_charmax']));
@@ -212,8 +265,33 @@ function countwords()
 		</td>
 	</tr><tr>
 		<td><?=i18n("Project Sort")?>: </td>
-		<td><input type="text" name="projectsort" size="10" value="<?=$projectinfo->projectsort?>" /></td>
+		<td><input type="text" name="projectsort" size="10" value="<?=$projectinfo->projectsort?>" /></td></tr>
-	</tr><tr>
+
+<?
+if($config['project_type'] == 'yes'){
+ $q=$pdo->prepare("SELECT * FROM projecttypes ORDER BY type");
+ $q->execute();
+ echo "<tr><td>".i18n("Project Type").": </td><td>";
+ echo "<select name=\"projecttype\">\n";
+ echo "<option value=\"\">".i18n("Select a project type")."</option>\n";
+ //FIXME: need to fix the loading glitch
+ while($r=$q->fetch(PDO::FETCH_OBJ))
+ {	
+ 	if($r->type == $projectinfo->projecttype)
+	{
+		$sel="selected=\"selected\"";
+	}
+	else 
+	{
+		$sel="";
+	}
+	echo "<option $sel value=\"$r->type\">".htmlspecialchars(i18n($r->type),null,"ISO8859-1")."</option>\n";
+	
+ }
+ echo "</select>".REQUIREDFIELD."</td></tr>";
+}
+?>
+	<tr>
 		<td><?=i18n("Age Category")?>: </td>
 		<td><?=i18n($agecategories[$projectcategories_id]['category'])?> (<?=i18n("Grades %1-%2",array($agecategories[$projectcategories_id]['mingrade'],$agecategories[$projectcategories_id]['maxgrade']))?>)</td>
 	</tr><tr>
@@ -222,17 +300,19 @@ function countwords()
 <?
 	//###### Feature Specific - filtering divisions by category
 	if($config['filterdivisionbycategory']=="yes"){
-		$q=mysql_query("SELECT projectdivisions.* FROM projectdivisions,projectcategoriesdivisions_link WHERE projectdivisions.id=projectdivisions_id AND projectcategories_id=".$projectcategories_id." AND projectdivisions.conferences_id='".$conference['id']."' AND projectcategoriesdivisions_link.conferences_id='".$conference['id']."' ORDER BY division"); 
+		$q=$pdo->prepare("SELECT projectdivisions.* FROM projectdivisions,projectcategoriesdivisions_link WHERE projectdivisions.id=projectdivisions_id AND projectcategories_id=".$projectcategories_id." AND projectdivisions.year='".$config['FAIRYEAR']."' AND projectcategoriesdivisions_link.year='".$config['FAIRYEAR']."' ORDER BY division"); 
-		echo mysql_error();
+		$q->execute();
+		echo $pdo->errorInfo();
 	//###
 	} else
-		$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='".$conference['id']."' ORDER BY division");
+		$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY division");
+$q->execute();
 
 	echo "<select name=\"projectdivisions_id\">";
 	echo "<option value=\"\">".i18n("Select a division")."</option>\n";
-	while($r=mysql_fetch_object($q)) {
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 		if($r->id == $projectinfo->projectdivisions_id) $sel="selected=\"selected\""; else $sel="";
-		echo "<option $sel value=\"$r->id\">".htmlspecialchars(i18n($r->division))."</option>\n";
+		echo "<option $sel value=\"$r->id\">".htmlspecialchars(i18n($r->division),null,"ISO8859-1")."</option>\n";
 	}
 	echo "</select>".REQUIREDFIELD;
 
@@ -311,9 +391,36 @@ function countwords()
 
 	echo "</table>";
 
+
+	if($config['ethics_questions']=="yes")
+		// If we have set ethics questions to yes then ask the ethics questions!
+		{
+	 echo "<tr><td>".i18n("Ethics Questions").":</td><td>";
+	 	echo "<table>";
+	 	echo "<tr>";
+		echo " <td>".i18n("My project involves human participants").REQUIREDFIELD."</td>";
+		if($projectinfo->human_participants=="yes") $check="checked=\"checked\""; else $check="";
+		echo " <td><input $check type=\"radio\" name=\"human_participants\" value=\"yes\" />Yes</td>";
+		echo " <td width=\"20\">&nbsp;</td>";
+		if($projectinfo->human_participants=="no") $check="checked=\"checked\""; else $check="";
+		echo " <td><input $check type=\"radio\" name=\"human_participants\" value=\"no\" />No</td>";
+		echo "</tr>";
+
+
+		echo "<tr>";
+		echo " <td>".i18n("My project involves animals").REQUIREDFIELD."</td>";
+		if($projectinfo->animal_participants=="yes") $check="checked=\"checked\""; else $check="";
+		echo " <td><input $check type=\"radio\" name=\"animal_participants\" value=\"yes\" />Yes</td>";
+		echo " <td width=\"20\">&nbsp;</td>";
+		if($projectinfo->animal_participants=="no") $check="checked=\"checked\""; else $check="";
+		echo " <td><input $check type=\"radio\" name=\"animal_participants\" value=\"no\" />No</td>";
+		echo "</tr>";
+		echo "</table>";
+
+	}
 	echo "</td></tr>";
 
-	echo "<tr><td>".i18n("Summary").": </td><td><textarea onchange='countwords()' onkeypress='countwords()' cols=\"60\" rows=\"12\" id=\"summary\" name=\"summary\">".htmlspecialchars($projectinfo->summary)."</textarea>".REQUIREDFIELD."<br />";
+	echo "<tr><td>".i18n("Summary").": </td><td><textarea onchange='countwords()' onkeypress='countwords()' cols=\"60\" rows=\"12\" id=\"summary\" name=\"summary\">".htmlspecialchars($projectinfo->summary,null,"ISO8859-1")."</textarea>".REQUIREDFIELD."<br />";
 
 	$summarywords=preg_split("/[\s,]+/",$projectinfo->summary);
 	$summarywordcount=count($summarywords);
@@ -326,6 +433,8 @@ function countwords()
 	echo i18n("%1 words maximum",array($config['participant_project_summary_wordmax']));
 	echo "</div>";
 
+	echo"<tr><td>".i18n("Feedback").": </td><td><textarea cols=\"60\" rows=\"4\" id=\"feedback\" name=\"feedback\">".htmlspecialchars($projectinfo->feedback,null,"ISO8859-1")."</textarea><br />";
+
 ?>
 	</td></tr>
 	</table>

admin/regfee_items_manager.php

@@ -25,7 +25,7 @@
  require("../tableeditor.class.php");
  require_once("../user.inc.php");
 
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("Registration Fee Items Manager",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php'),
@@ -38,7 +38,7 @@
 				'cost' => 'Cost',
 				'per' => 'Cost Per',
 			), null,
-			array('conference' => $conference['name'])
+			array('year' => $config['FAIRYEAR'])
 			);
 
  $editor->setPrimaryKey("id");
@@ -48,7 +48,7 @@
 					array('key' => 'project', 'val' => "Project") 
 			              )  );
  $editor->setFieldInputType("per", 'select');
- $editor->filterList('conference',$conference['name']);
+ $editor->filterList('year',$config['FAIRYEAR']);
  
  $editor->execute();
 

admin/registration.php

@@ -23,15 +23,16 @@
 ?>
 <?
  require("../common.inc.php");
+ include"../config/signaturepage_or_permissionform.php";
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("Participant Registration",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php'),
             "participant_registration"
 			);
  echo "<br />";
- echo "<a href=\"registration_receivedforms.php\">".i18n("Input Received Signature Forms")."</a> <br />";
+ echo "<a href=\"registration_receivedforms.php\">".i18n("Input Received $plural_participationform")."</a> <br />";
  echo "<a href=\"registration_list.php\">".i18n("Registration List and Student/Project Editor")."</a> <br />";
  echo "<a href=\"registration_stats.php\">".i18n("Registration Statistics")."</a> <br />";
  echo "<a href=\"registration_webconsent.php\">".i18n("Website Consent")."</a> <br />";

admin/registration_list.php

@@ -20,56 +20,80 @@
    the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
    Boston, MA 02111-1307, USA.
 */
+
+// This file was modified Jan of 2014 by Richard Sin
+// Flagging has been added to monitor projects with concern.
+
 ?>
 <?
  require_once('../common.inc.php');
  require_once('../user.inc.php');
 
-$auth_type = user_auth_required(array(), array('fair', 'admin'));
+$auth_type = user_auth_required(array('fair','committee'), 'admin');
 
 //require_once('../register_participants.inc.php');
 
- if($_GET['conference_id']) $conference_id=intval($_GET['conference_id']);
+ if($_GET['year']) $year=$_GET['year'];
- else $conference_id=$conference['id'];
+ else $year=$config['FAIRYEAR'];
 
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='{$conference['id']}' ORDER BY id");
+ $q = $pdo->prepare("SELECT * FROM projectcategories WHERE year='$year' ORDER BY id");
-while($r=mysql_fetch_object($q))
+ $q->execute();
+
+while($r=$q->fetch(PDO::FETCH_OBJ))
 	$cats[$r->id]=$r->category;
 
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='{$conference['id']}' ORDER BY id");
+$q = $pdo->prepare("SELECT * FROM projectdivisions WHERE year='$year' ORDER BY id");
-while($r=mysql_fetch_object($q))
+$q->execute();
+
+while($q->fetch(PDO::FETCH_OBJ))
 	$divs[$r->id]=$r->division;
 
 $action=$_GET['action'];
 switch($action) {
 case 'load_row':
 	$id = intval($_GET['id']);
-	$q = list_query($conference_id, '', $id);
+	$q = list_query($year, '', $id);
-	$r = mysql_fetch_object($q);
+	$r = $q->fetch(PDO::FETCH_OBJ);
 	print_row($r);
 	exit;
 
 case 'delete':
 	$regid = intval($_GET['id']);
-	$q = mysql_query("SELECT * FROM projects WHERE registrations_id='$regid'");
+	$q = $pdo->prepare("SELECT * FROM projects WHERE registrations_id='$regid'");
-	if(mysql_num_rows($q)) {
+	$q->execute();
-		$p = mysql_fetch_assoc($q);
+	if($q->rowCount()) {
-		mysql_query("DELETE FROM winners WHERE projects_id='{$p['id']}'");
+		$p = $q->fetch(PDO::FETCH_ASSOC);
+		$stmt = $pdo->prepare("DELETE FROM winners WHERE projects_id='{$p['id']}'");
+		$stmt->execute();
 	}
- 	mysql_query("DELETE FROM registrations WHERE id='$regid' AND conferences_id='".$conference['id']."'");
+ 	
-	mysql_query("DELETE FROM users WHERE registrations_id='$regid' AND conferences_id='".$conference['id']."'");
+	$stmt = $pdo->prepare("DELETE FROM registrations WHERE id='$regid' AND year='".$config['FAIRYEAR']."'");
-	mysql_query("DELETE FROM projects WHERE registrations_id='$regid' AND conferences_id='".$conference['id']."'");
+	$stmt->execute();
-	mysql_query("DELETE FROM safety WHERE registrations_id='$regid' AND conferences_id='".$conference['id']."'");
+
-//	mysql_query("DELETE FROM questions_answers WHERE registrations_id='$regid' AND conferences_id='".$conference['id']."'");
+	$stmt = $pdo->prepare("DELETE FROM students WHERE registrations_id='$regid' AND year='".$config['FAIRYEAR']."'");
-	mysql_query("DELETE FROM mentors WHERE registrations_id='$regid' AND conferences_id='".$conference['id']."'");
+	$stmt->execute();
-	mysql_query("DELETE FROM emergencycontact WHERE registrations_id='$regid' AND conferences_id='".$conference['id']."'");
+
+	$stmt = $pdo->prepare("DELETE FROM projects WHERE registrations_id='$regid' AND year='".$config['FAIRYEAR']."'");
+	$stmt->execute();
+
+	$stmt = $pdo->prepare("DELETE FROM safety WHERE registrations_id='$regid' AND year='".$config['FAIRYEAR']."'");
+	$stmt->execute();
+
+	$stmt = $pdo->prepare("DELETE FROM questions_answers WHERE registrations_id='$regid' AND year='".$config['FAIRYEAR']."'");
+	$stmt->execute();
+
+	$stmt = $pdo->prepare("DELETE FROM mentors WHERE registrations_id='$regid' AND year='".$config['FAIRYEAR']."'");
+	$stmt->execute();
+
+	$stmt = $pdo->prepare("DELETE FROM emergencycontact WHERE registrations_id='$regid' AND year='".$config['FAIRYEAR']."'");
+	$stmt->execute();
 	happy_("Registration and all related data successfully deleted");
 	exit;
 }
 
 if($auth_type == 'committee') {
 	 send_header("Registration Management",
- 		array('Committee Main' => 'committee_main.php',
+	 	array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php',
 			'Participant Registration' => 'admin/registration.php')
 				);
@@ -300,20 +324,19 @@ $(document).ready(function() {
 		selected: -1
 	});
 
-/*
 	$("#newproject").click(function() {
 			popup_editor(-1);
 		}
 	);
-	*/
 });
 </script>
 
+
 <br />
-<table style="width: 500px;">
+<table width="100%">
 <tr><td>
-	<form name="statuschangerform" method="get" action="registration_list.php">
 	<?=i18n("Choose Status")?>:
+	<form name="statuschangerform" method="get" action="registration_list.php">
 	<select name="showstatus" onchange="document.forms.statuschangerform.submit()">
 
 <?
@@ -332,9 +355,7 @@ $(document).ready(function() {
  }
 ?>
 	</select></form></td>
-	<?
+	<td align="right"><button id="newproject"><?=i18n("Create New Project")?></button></td>
-	// echo <td align=\"right\"><button id=\"newproject\">".i18n("Create New Project")."</button></td>\n";
-	?>
 	</tr></table>
 <?
 
@@ -350,28 +371,29 @@ if($showstatus) {
 }
 else $wherestatus="";
 
-$q = list_query($conference_id, $wherestatus, false);
+$q = list_query($year, $wherestatus, false);
 	
 echo "<table id=\"registration_list\" class=\"tableview\">";
 echo "<thead><tr>";
 if($showstatus) $stat="&showstatus=".$showstatus;
 echo  "<th>".i18n("Status")."</th>";
+echo  "<th>".i18n("Email Address")."</th>";
 echo  "<th>".i18n("Reg Num")."</th>";
 echo  "<th>".i18n("Proj Num")."</th>";
 echo  "<th>".i18n("Project Title")."</th>";
 echo  "<th>".i18n("Age Category")."</th>";
 echo  "<th>".i18n("Division")."</th>";
-echo  "<th>".i18n("Participant Details")."</th>";
+echo  "<th>".i18n("School(s)")."</th>";
+echo  "<th>".i18n("Student(s)")."</th>";
+echo  "<th>".i18n("Flagged")."</th>";
 echo  "<th>".i18n("Action")."</th>";
 echo "</tr></thead>";
-echo "<tbody>";
 
-while($r=mysql_fetch_object($q)) {
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	echo "<tr id=\"row_{$r->reg_id}\">";
 	print_row($r);
 	echo "</tr>";
 }
-echo "</tbody>";
 echo "</table>";
 
 
@@ -379,8 +401,8 @@ echo "<br/><br/>The statistics have moved here: <a href=\"registration_stats.php
 
 send_footer();
 
-/* Now some helper fucntions we call more than once */
+/* Now some helper functions we call more than once */
-function list_query($conference_id, $wherestatus, $reg_id)
+function list_query($year, $wherestatus, $reg_id)
 {
 	global $auth_type;
 
@@ -393,25 +415,31 @@ function list_query($conference_id, $wherestatus, $reg_id)
 		$fair = "AND projects.fairs_id='{$_SESSION['fairs_id']}'";
 	}
 
-	$q=mysql_query("SELECT  registrations.id AS reg_id,
+	$q = pdo->prepare("SELECT  registrations.id AS reg_id,
 				registrations.num AS reg_num,
 				registrations.status,
+				registrations.email,
 				projects.title,
 				projects.projectnumber,
 				projects.projectcategories_id,
-				projects.projectdivisions_id
+				projects.projectdivisions_id,
+				projects.feedback,
+				projects.flagged
 			FROM
 				registrations
 				left outer join projects on projects.registrations_id=registrations.id
 			WHERE
 				1
-				AND registrations.conferences_id='$conference_id' 
+				AND registrations.year='$year' 
 				$wherestatus
 				$reg $fair
 			ORDER BY
 				registrations.status DESC, projects.title
 			");
-	echo mysql_error();
+
+	
+
+	echo $pdo->erroInfo();
 	return $q;
 }
 
@@ -419,7 +447,7 @@ function list_query($conference_id, $wherestatus, $reg_id)
 
 function print_row($r)
 {
-	global $cats, $divs, $config, $conference_id, $conference;
+	global $cats, $divs, $config, $year;
 	switch($r->status) {
 	case "new": $status_text="New"; break;
 	case "open": $status_text="Open"; break;
@@ -433,7 +461,7 @@ function print_row($r)
 	$pcl = "style=\"cursor:pointer;\" onclick=\"popup_editor('{$r->reg_id}','project');\"";
 
 	echo "<td $scl>{$status_text}</td>";
-//	echo "<td $scl>{$r->email}</td>";
+	echo "<td $scl>{$r->email}</td>";
 	echo "<td $scl>{$r->reg_num}</td>";
 	$pn = str_replace(' ', '&nbsp;', $r->projectnumber);
 	echo "<td $scl>$pn</td>";
@@ -442,66 +470,58 @@ function print_row($r)
 	echo "<td $scl>".i18n($cats[$r->projectcategories_id])."</td>";
 	echo "<td $scl>".i18n($divs[$r->projectdivisions_id])."</td>";
 
-	echo "<td>";
+	$sq=$pdo->prepare("SELECT students.firstname,
-
+				students.lastname,
-	$sq=mysql_query("SELECT users.firstname,
+				students.id,
-				users.lastname,
-				users.id,
 				schools.school,
 				schools.board,
-				schools.id AS schools_id,
+				schools.id AS schools_id
-				accounts.username,
-				accounts.email,
-				accounts.pendingemail
 			FROM
-				users
+				students,schools
-				JOIN accounts ON users.accounts_id=accounts.id
-				LEFT JOIN schools ON users.schools_id=schools.id
 			WHERE
-				users.registrations_id='$r->reg_id'
+				students.registrations_id='$r->reg_id'
+				AND
+				students.schools_id=schools.id
 			");
-			echo mysql_error();
+	$sq->execute();
+			echo $pdo->errorInfo();
 
 	$studnum=1;
 	$schools="";
 	$students="";
-	$scl = "style=\"cursor:pointer;\" onclick=\"popup_editor('{$r->reg_id}','');\"";
+	while($studentinfo=$sq->fetch(PDO::FETCH_OBJ))
-	//if theres more than 1, we should show some headings between the tables
+	{
-	if(mysql_num_rows($sq)>1) $showheadings=true;
+		$students.="$studentinfo->firstname $studentinfo->lastname<br />";
-
+		$schools.="$studentinfo->school <br />";
-	while($studentinfo=mysql_fetch_object($sq)) {
-		if($studentinfo->email) $e=$studentinfo->email;
-		else if($studentinfo->pendingemail) $e=$studentinfo->pendingemail;
-		else $e="";
-		if($showheadings) 
-			echo "<b>Participant #$studnum</b><br />";
-
-		echo "<table style=\"cursor:pointer; border-collapse: collapse;\" onclick=\"popup_editor('{$r->reg_id}','');\">";
-		echo "<tr><th>Name</th><td>$studentinfo->firstname $studentinfo->lastname</td></tr>\n";
-		echo "<tr><th>Username</th><td>$studentinfo->username</td></tr>\n";
-		if($e && $studentinfo->username!=$e) {
-			echo "<tr><th>Email</th><td>$e</td></tr>\n";
-		}
-		echo "<tr><th>School</th><td>$studentinfo->school</td></tr>\n";
-		echo "</table>\n";
-		$studnum++;
 	}
-	echo "</td>";
 
+	echo "<td $scl>$schools</td>";
+	echo "<td $scl>$students</td>";
 
 	echo "<td align=\"center\"  >";
-	if($conference_id==$conference['id']) {
+	if($r->flagged == false) {
+		echo "<a title=\"".i18n("Not flagged")."\" href=\"#\" onClick=\"popup_editor('{$r->reg_id}','project');\" >";
+		echo "<img src=\"".$config['SFIABDIRECTORY']."/images/16/ok.".$config['icon_extension']."\" border=0>";
+		echo "</a>";
+	}
+	else {
+		echo "<a title=\"".i18n("Flagged")."\" href=\"#\" onClick=\"popup_editor('{$r->reg_id}','project');\" >";
+		echo "<img src=\"".$config['SFIABDIRECTORY']."/images/16/flagged.".$config['icon_extension']."\" border=0>";
+		echo "</a>";
+	}
+	
+	echo "<td align=\"center\"  >";
+	if($year==$config['FAIRYEAR']) {
 		echo "<a title=\"".i18n("Delete this registration")."\" href=\"#\" onClick=\"delete_registration({$r->reg_id});return false\" >";
 		echo "<img src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\" border=0>";
 		echo "</a>";
-		/*
+
-		echo "<form target=\"_blank\" method=\"post\" action=\"../register_participants.php\">";
+			echo "<form target=\"_blank\" method=\"post\" action=\"../register_participants.php\">";
-		echo "<input type=\"hidden\" name=\"action\" value=\"continue\">";
+			echo "<input type=\"hidden\" name=\"action\" value=\"continue\">";
-		echo "<input type=\"hidden\" name=\"email\" value=\"$r->email\">";
+			echo "<input type=\"hidden\" name=\"email\" value=\"$r->email\">";
-		echo "<input type=\"hidden\" name=\"regnum\" value=\"$r->reg_num\">";
+			echo "<input type=\"hidden\" name=\"regnum\" value=\"$r->reg_num\">";
-		echo "<input type=\"submit\" value=\"".i18n("Login")."\">";
+			echo "<input type=\"submit\" value=\"".i18n("Login")."\">";
-		echo "</form>";
+			echo "</form>";
-		*/
 
 
 	}

admin/registration_receivedforms.php

@@ -20,14 +20,19 @@
    the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
    Boston, MA 02111-1307, USA.
 */
+
+   // This file was modified March of 2015 by Sebastian Ruan
+   // Receive all button was added
+
 ?>
 <?
- require_once("../common.inc.php");
+ require("../common.inc.php");
+ include "../config/signaturepage_or_permissionform.php";
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
- require_once("../register_participants.inc.php");
+ require("../register_participants.inc.php");
 
- send_header("Input Received Signature Forms",
+ send_header("Input Received $plural_participationform",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php',
 			'Participant Registration' => 'admin/registration.php')
@@ -37,21 +42,23 @@
 $showformatbottom=true;
  if($_POST['action']=="received" && $_POST['registration_number'])
  {
- 	$q=mysql_query("SELECT * FROM registrations WHERE num='".$_POST['registration_number']."' AND conferences_id='".$conference['id']."'");
+ 	$q=$pdo->prepare("SELECT * FROM registrations WHERE num='".$_POST['registration_number']."' AND year='".$config['FAIRYEAR']."'");
-	if(mysql_num_rows($q)==1)
+	$q->execute();
+	if($q->rowCount()==1)
 	{
-		$r=mysql_fetch_object($q);
+		$r=$q->fetch(PDO::FETCH_OBJ);
 		$reg_id=$r->id;
 		$reg_num=$r->num;
 		$reg_status=$r->status;
 
-		if($r->status=='new') {
+		if($r->status=='new')
+		{
 			echo error(i18n("Invalid Registration Status (%1 is New).  Cannot receive an empty form.",array($_POST['registration_number'])));
 		}
 		else
 		{
 			//make sure all of the statuses are correct
-			$statusstudent=studentsStatus($reg_id);
+			$statusstudent=studentStatus($reg_id);
 			$statusemergencycontact=emergencycontactStatus($reg_id);
 			$statusproject=projectStatus($reg_id);
 			if($config['participant_mentor']=="yes")
@@ -70,21 +77,26 @@ $showformatbottom=true;
 				$statusnamecheck == "complete"
 			) {
 				
-				$q=mysql_query("SELECT projects.title,
+				$q=$pdo->prepare("SELECT projects.title,
 							projectcategories.category,
 							projectdivisions.division
 						FROM
 							projects,projectcategories,projectdivisions
 						WHERE
 							projects.registrations_id='$reg_id'
-							AND projects.projectcategories_id=projectcategories.id
+							AND
-							AND projects.projectdivisions_id=projectdivisions.id
+							projects.projectcategories_id=projectcategories.id
-							AND projectcategories.conferences_id=projects.conferences_id
+							AND
-							AND projectdivisions.conferences_id=projects.conferences_id
+							projects.projectdivisions_id=projectdivisions.id
+							AND 
+							projectcategories.year=projects.year
+							AND
+							projectdivisions.year=projects.year
 						");
+				$q->execute();
 
-echo mysql_Error();
+echo $pdo->errorInfo();
-				$projectinfo=mysql_fetch_object($q);
+				$projectinfo=$q->fetch(PDO::FETCH_OBJ);
 				echo "<table class=\"summarytable\">";
  				echo "<tr><th colspan=\"2\">".i18n("Registration Summary for %1",array($reg_num))."</th></tr>";
 				switch($reg_status)
@@ -99,19 +111,20 @@ echo mysql_Error();
 				echo "<tr><td><b>".i18n("Project Title")."</b></td><td>$projectinfo->title</td></tr>";
 				echo "<tr><td><b>".i18n("Category / Division")."</b></td><td>$projectinfo->category / $projectinfo->division</td></tr>";
 
-				$q=mysql_query("SELECT users.firstname,
+				$q=$pdo->prepare("SELECT students.firstname,
-							users.lastname,
+							students.lastname,
 							schools.school
 						FROM
-							users,schools
+							students,schools
 						WHERE
-							users.registrations_id='$reg_id'
+							students.registrations_id='$reg_id'
 							AND
-							users.schools_id=schools.id
+							students.schools_id=schools.id
 						");
+				$q->execute();
 
 				$studnum=1;
-				while($studentinfo=mysql_fetch_object($q))
+				while($studentinfo=$q->fetch(PDO::FETCH_OBJ))
 				{
 					echo "<tr><td><b>".i18n("School %1",array($studnum))."</b></td><td>$studentinfo->school </td></tr>";
 
@@ -124,7 +137,8 @@ echo mysql_Error();
 				echo "</table>\n";
 					echo "<br />";
 
-				if($r->status!='complete') {
+				if($r->status!='complete')
+				{
 					echo "<table style=\"margin-left: 30px;\">";
 					echo "<tr><td colspan=\"3\">";
 					echo i18n("Is this the correct form to register?");
@@ -138,7 +152,8 @@ echo mysql_Error();
 					echo "<input type=submit value=\"".i18n("No, this is the wrong form")."\" style=\"width: 400px; height: 40px; margin: 10px;\"/>";
 					echo "</form>";
 
-					if($config['regfee']>0) {
+					if($config['regfee']>0)
+					{
 
 						echo "<form method=\"post\" action=\"registration_receivedforms.php\">";
 						echo "<input type=\"hidden\" name=\"registration_number\" value=\"$reg_num\" />";
@@ -152,7 +167,8 @@ echo mysql_Error();
 						echo "<input type=submit value=\"".i18n("Yes, right form without registration fee")."\" style=\"width: 400px; height: 40px; margin: 10px;\"/>";
 						echo "</form>";
 					}
-					else {
+					else
+					{
 						echo "<form method=\"post\" action=\"registration_receivedforms.php\">";
 						echo "<input type=\"hidden\" name=\"registration_number\" value=\"$reg_num\" />";
 						echo "<input type=\"hidden\" name=\"action\" value=\"receivedyes\" />";
@@ -168,7 +184,8 @@ echo mysql_Error();
 					echo "</table>";
 					$showformatbottom=false;
 				}
-				else {
+				else
+				{
 					echo i18n("This form has already been received.  Registration is complete");
 					echo "<br />";
 					echo "<a href=\"registration_receivedforms.php?action=unregister&registration_number=$reg_num\">".i18n("Click here to unregister this project")."</a>";
@@ -178,16 +195,9 @@ echo mysql_Error();
 
 
 			}
-			else {
+			else
+			{
 				echo error(i18n("All registration sections are not complete.  Cannot register incomplete form"));
-				$reg=getRegistration($reg_id);
-				echo "<table class=\"tableview\">";
-				echo "<b>Registration Number: {$reg['registration_number']}</b><br />\n";
-				foreach($reg['status'] AS $k=>$v) {
-					echo "<tr><th>$k</td><td>".outputStatus($v)."</td></tr>\n";
-				}
-				echo "</table>\n";
-				echo "<br /><br />\n";
 			}
 		}
 	}
@@ -202,24 +212,26 @@ echo mysql_Error();
  else if(($_POST['action']=="receivedyes" || $_POST['action']=="receivedyesnocash") && $_POST['registration_number']) {
  	
 	$regnum = intval($_POST['registration_number']);
- 	$checkNumQuery=mysql_query("SELECT projectnumber
+ 	$checkNumQuery=$pdo->prepare("SELECT projectnumber
 					FROM projects, registrations 
 					WHERE projects.registrations_id = registrations.id 
 						AND num='$regnum'
-						AND registrations.conferences_id='{$conference['id']}'");
+						AND registrations.year='{$config['FAIRYEAR']}'");
-	$checkNumResults=mysql_fetch_object($checkNumQuery);
+	$checkNumQuery->execute();
+	$checkNumResults=$checkNumQuery->fetch(PDO::FETCH_OBJ);
  	$projectnum=$checkNumResults->projectnumber;
 
-	$q=mysql_query("SELECT id FROM registrations WHERE num='$regnum' AND conferences_id='{$conference['id']}'");
+	$q=$pdo->prepare("SELECT id FROM registrations WHERE num='$regnum' AND year='{$config['FAIRYEAR']}'");
-	$r=mysql_fetch_object($q);
+	$q->execute();
+	$r=$q->fetch(PDO::FETCH_OBJ);
 	$reg_id = $r->id;
 
  	if($projectnum == null)
  	{
 	 	list($projectnumber,$ps,$pns,$pss) = generateProjectNumber($reg_id);
-		mysql_query("UPDATE projects SET projectnumber='$projectnumber',
+		$stmt = $pdo->prepare("UPDATE projects SET projectnumber='$projectnumber',
 				projectsort='$ps',projectnumber_seq='$pns',projectsort_seq='$pss'
-				WHERE registrations_id='$reg_id' AND conferences_id='{$conference['id']}'");
+				WHERE registrations_id='$reg_id' AND year='{$config['FAIRYEAR']}'");
 		echo happy(i18n("Assigned Project Number: %1",array($projectnumber)));
  	}
 	else
@@ -228,22 +240,24 @@ echo mysql_Error();
 	//get all students with this registration number
 	$recipients=getEmailRecipientsForRegistration($reg_id);
 
- 	if($_POST['action']=="receivedyes") {
+ 	if($_POST['action']=="receivedyes")
+ 	{
  		//actually set it to 'complete'
-		mysql_query("UPDATE registrations SET status='complete' WHERE num='$regnum' AND conferences_id='{$conference['id']}'");
+		$stmt = $pdo->prepare("UPDATE registrations SET status='complete' WHERE num='$regnum' AND year='{$config['FAIRYEAR']}'");
-
+		$stmt->execute();
 		foreach($recipients AS $recip) {
+			$to=$recip['to'];
 			$subsub=array();
 			$subbod=array(
+				"TO"=>$recip['to'],
 				"EMAIL"=>$recip['email'],
 				"FIRSTNAME"=>$recip['firstname'],
 				"LASTNAME"=>$recip['lastname'],
-				"USERNAME"=>$recip['username'],
 				"NAME"=>$recip['firstname']." ".$recip['lastname'],
 				"REGNUM"=>$regnum,
 				"PROJECTNUMBER"=>$projectnumber,
 				);
-			$res=email_send("register_participants_received",$recip['email'],$subsub,$subbod);
+			email_send("register_participants_received",$to,$subsub,$subbod);
 		}
 
 	 	echo happy(i18n("Registration of form %1 successfully completed",array($regnum)));
@@ -251,43 +265,50 @@ echo mysql_Error();
  	else if($_POST['action']=="receivedyesnocash")
  	{
  		//actually set it to 'paymentpending'
-		mysql_query("UPDATE registrations SET status='paymentpending' WHERE num='$regnum' AND conferences_id='{$conference['id']}'");
+		$stmt = $pdo->prepare("UPDATE registrations SET status='paymentpending' WHERE num='$regnum' AND year='{$config['FAIRYEAR']}'");
-
+		$stmt->execute();
 		foreach($recipients AS $recip) {
+			$to=$recip['to'];
 			$subsub=array();
 			$subbod=array(
+				"TO"=>$recip['to'],
 				"EMAIL"=>$recip['email'],
 				"FIRSTNAME"=>$recip['firstname'],
 				"LASTNAME"=>$recip['lastname'],
-				"USERNAME"=>$recip['username'],
 				"NAME"=>$recip['firstname']." ".$recip['lastname'],
 				"REGNUM"=>$regnum,
 				"PROJECTNUMBER"=>$projectnumber,
 				);
 
-			email_send("register_participants_paymentpending",$recip['email'],$subsub,$subbod);
+			email_send("register_participants_paymentpending",$to,$subsub,$subbod);
 		}
  		echo happy(i18n("Registration of form %1 marked as payment pending",array($regnum)));
  	}
  }
- else if($_POST['action']=="receivedno" && $_POST['registration_number']) {
+ else if($_POST['action']=="receivedno" && $_POST['registration_number'])
+ {
  	echo notice(i18n("Registration of form %1 cancelled",array($_POST['registration_number'])));
 
  }
  else if($_GET['action']=="unregister" && $_GET['registration_number']) {
  	$reg_num=intval(trim($_GET['registration_number']));
- 	$q=mysql_query("SELECT registrations.id AS reg_id, projects.id AS proj_id FROM projects,registrations WHERE projects.registrations_id=registrations.id AND registrations.conferences_id='{$conference['id']}' AND registrations.num='$reg_num'");
+ 	$q=$pdo-prepare("SELECT registrations.id AS reg_id, projects.id AS proj_id FROM projects,registrations WHERE projects.registrations_id=registrations.id AND registrations.year='{$config['FAIRYEAR']}' AND registrations.num='$reg_num'");
-	$r=mysql_fetch_object($q);
+	$q->execute();
- 	mysql_query("UPDATE projects SET projectnumber=null, projectsort=null, projectnumber_seq=0, projectsort_seq=0 WHERE id='$r->proj_id' AND conferences_id='{$conference['id']}'");
+	$r=$q->fetch(PDO::FETCH_OBJ);
- 	mysql_query("UPDATE registrations SET status='open' WHERE id='$r->reg_id' AND conferences_id='{$conference['id']}'");
+ 	$stmt=$pdo->prepare("UPDATE projects SET projectnumber=null, projectsort=null, projectnumber_seq=0, projectsort_seq=0 WHERE id='$r->proj_id' AND year='{$config['FAIRYEAR']}'");
+ 	$stmt->execute();
+	$stmt=$pdo->prepare("UPDATE registrations SET status='open' WHERE id='$r->reg_id' AND year='{$config['FAIRYEAR']}'");
+	$stmt->execute();
 	echo happy(i18n("Successfully unregistered project"));
  }
 
 
- if($showformatbottom) {
+ if($showformatbottom)
+ {echo "<table>";
+	 echo "<tr><td>";
 	 echo "<form id=\"inputform\" method=\"post\" action=\"registration_receivedforms.php\">";
 	 echo "<input type=\"hidden\" name=\"action\" value=\"received\" />";
-	 echo i18n("Enter the registration number from the signature form: ")."<br />";
+	 echo i18n("Enter the registration number from the $signatureformpermissionform : ")."<br />";
 	 echo "<input id=\"registration_number\" type=\"text\" size=\"15\" name=\"registration_number\" />";
 	 echo "<input type=\"submit\" value=\"".i18n("Lookup Registration Number")."\" />";
 	 echo "</form>";
@@ -296,7 +317,156 @@ echo mysql_Error();
 	 document.forms.inputform.registration_number.focus();
 	 </script>
 	 <?
+
+	echo "<br/><br/>";
+	 echo "</td></tr><tr><td>";
+	 echo "<font size=\"2\" color=\"red\">This button does not keep track of payments</font>";
+	 echo "</td></tr><tr><td>";
+	 echo "<form method=\"post\" action=\"registration_receivedforms.php\">";
+	 echo "<input type=\"hidden\" name=\"action\" value=\"recieve_all\" />";
+	 echo "<input type=\"submit\" value=\"".i18n("Receive All")."\" onclick=\"return confirmClick('Are you sure you wish to mark all students as has having their $signatureformpermissionform received?')\" />";
+	 echo "</form>";
+	 echo "</tr></td>";
+	 echo "</table>";
+	 echo "<br>";
+	 echo i18n(" <lh>'Receive All' notes:</lh> <ul><li>The button will mark all open-status students that have completed registration as having their $signatureformpermissionform received.
+	 												    <li> Students with above status will be emailed a \"$signatureformpermissionform received\" confirmation.
+	 												    <li> Project numbers will be assigned to these students' projects.
+	 												</ul>");
  }
 
- send_footer();
+
-?>
+if ($_POST['action'] == 'recieve_all')
+{	
+	// Grab all projects that don't have project numbers. Status should therefor be open or new but not complete 
+	$query_noprojectnumber = $pdo->prepare("SELECT * FROM projects WHERE projectnumber IS NULL AND year =".$config['FAIRYEAR']."");
+	// Define arrays to append to later
+	$query_noprojectnumber.execute();
+	$completed_students = array();
+	$incomplete_students = array();
+	$newstatus_students = array();
+
+	// loop through each project that doesn't have a project number
+	while($studentproject=$query_noprojectnumber->fetch(PDO::FETCH_ASSOC))
+	{	
+		// Grab registration information about the current project
+	 	$q=$pdo->prepare("SELECT * FROM registrations WHERE id='".$studentproject['registrations_id']."' AND year='".$config['FAIRYEAR']."'");
+		$q->execute();
+		$r=$q->fetch(PDO::FETCH_OBJ);
+		$reg_id=$r->id;
+		$reg_num=$r->num;
+		$reg_status=$r->status;
+
+		// student has completed some or all of the registration process for their project. Let's find out which one is true
+		if ($r->status!='new')
+			{
+				//make sure all of the statuses are correct
+				$statusstudent=studentStatus($reg_id);
+				$statusemergencycontact=emergencycontactStatus($reg_id);
+				$statusproject=projectStatus($reg_id);
+				if($config['participant_mentor']=="yes")
+					$statusmentor=mentorStatus($reg_id);
+				else
+					$statusmentor="complete";
+				$statussafety=safetyStatus($reg_id);
+				$statusnamecheck=namecheckStatus($reg_id);
+
+				if(
+					$statusstudent == "complete" &&
+					$statusemergencycontact == "complete" &&
+					//S$statusproject == "complete" &&
+					$statusmentor == "complete" &&
+					$statussafety == "complete" &&
+					$statusnamecheck == "complete" &&
+					$r->status!='complete'
+					//above: project status must not be complete. If it is complete signature page/permission form has already been received.
+				) {
+				 	
+				 	// Generate project number and update it in data base
+				 	list($projectnumber,$ps,$pns,$pss) = generateProjectNumber($reg_id);
+					$stmt = $pdo->prepare("UPDATE projects SET projectnumber='$projectnumber',
+							projectsort='$ps',projectnumber_seq='$pns',projectsort_seq='$pss'
+							WHERE registrations_id='$reg_id' AND year='{$config['FAIRYEAR']}'");
+					$stmt->execute();
+
+				//email stuff
+					//get all students with this registration number
+					//$recipients=getEmailRecipientsForRegistration($reg_id);
+
+			 		//Set status to 'complete'
+					$stmt = $pdo->prepare("UPDATE registrations SET status='complete' WHERE num='$reg_num' AND year='{$config['FAIRYEAR']}'");
+					$stmt->execute();
+					/*foreach($recipients AS $recip) {
+						$to=$recip['to'];
+						$subsub=array();
+						$subbod=array(
+							"TO"=>$recip['to'],
+							"EMAIL"=>$recip['email'],
+							"FIRSTNAME"=>$recip['firstname'],
+							"LASTNAME"=>$recip['lastname'],
+							"NAME"=>$recip['firstname']." ".$recip['lastname'],
+							"REGNUM"=>$regnum,
+							"PROJECTNUMBER"=>$projectnumber,
+							);
+						email_send("register_participants_received",$to,$subsub,$subbod);
+					}*/
+
+				// End email stuff
+					//add cuurent registration number to completed_students array
+					$completed_students[] = $reg_num;
+
+				}else{
+					// or add current registration number to incomplete_student array
+					$incomplete_students[] = $reg_num;
+				}
+			
+
+			}
+		//New status automatically means student has not completed the registration process for their project. So execute below:
+		else{
+			// or add current registration number to newstatus_students array
+			$newstatus_students[] = $reg_num;
+			}
+
+		
+	}
+	// Find how many project numbers were assigned/how many projects have complete status (ie signature page/permission form is considered received)
+	$total_completed = count($completed_students);
+
+	// since incomplete_students and newstatus_students both did not get project numbers and are not considered as having signature page/permission form received
+	//    combine them 
+	$total_incomplete = array_merge($incomplete_students, $newstatus_students);
+	
+	echo "<br><br>";
+	echo "<table>";
+	echo "<tr><td>".i18n("$total_completed student(s) registered as $non_capital_participationform received.")."</td></tr>";
+	
+	//display below only if there are registration numbers that don't have project numbers and the students have not completed the registration process
+	if (count($total_incomplete) > 0) {
+		echo "<tr><td>".i18n("Registration numbers which are NOT marked as having their $non_capital_participationform received are shown below:")."</td></tr>";
+		echo "<tr><td>&nbsp</td></tr>";
+		$string = "";
+		echo "<tr><td>";
+
+		//create a string that contains all incomplete registration numbers
+		foreach ($total_incomplete as $regnum){
+			$string = $string.i18n($regnum);
+			$string = $string.", ";
+		} 
+
+		// delete the comma at the end of the string
+		$string = substr($string, 0, strlen($string)-2);
+		echo $string;
+		echo "</td></tr>";
+		echo "<tr><td>&nbsp</td></tr>";
+		echo "<tr><td>";
+		echo i18n("The above registration numbers correspond to projects in which the registration process has not been completed by the student.");
+		echo "</td></tr>";
+	}
+	echo "</table>";
+	echo happy_(i18n("Received all permision forms for complete students"));
+}
+
+send_footer();
+
+?>

admin/registration_stats.php

@@ -22,13 +22,13 @@
 */
 ?>
 <?
- require_once("../common.inc.php");
+ require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
- require_once("../register_participants.inc.php");
+ require("../register_participants.inc.php");
 
- if($_GET['conferences_id']) $conferences_id=$_GET['conferences_id'];
+ if($_GET['year']) $year=$_GET['year'];
- else $conferences_id=$conference['id'];
+ else $year=$config['FAIRYEAR'];
 
  send_header("Registration Statistics",
  		array('Committee Main' => 'committee_main.php',
@@ -61,12 +61,15 @@
  echo "</select>";
  echo "</form>";
 
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='$conferences_id' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='$year' ORDER BY id");
-while($r=mysql_fetch_object($q))
+
+
+while($r=$q->fetch(PDO::FETCH_OBJ)
 	$cats[$r->id]=$r->category;
 
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='$conferences_id' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='$year' ORDER BY id");
-while($r=mysql_fetch_object($q))
+$q->execute();
+while($r=$q->fetch(PDO::FETCH_OBJ))
 	$divs[$r->id]=$r->division;
 
 if($showstatus) {
@@ -90,7 +93,7 @@ else $wherestatus="";
 		default:	$ORDERBY="registrations.status DESC, projects.title"; break;
 	}
 
-	$q=mysql_query("SELECT  registrations.id AS reg_id,
+	$q=$pdo->prepare("SELECT  registrations.id AS reg_id,
 				registrations.num AS reg_num,
 				registrations.status,
 				registrations.email,
@@ -104,12 +107,13 @@ else $wherestatus="";
 				left outer join projects on projects.registrations_id=registrations.id
 			WHERE
 				1
-				AND registrations.conferences_id='$conferences_id' 
+				AND registrations.year='$year' 
 				$wherestatus
 			ORDER BY
 				$ORDERBY
 			");
-		echo mysql_error();
+		$q->execute();
+		echo $pdo->errorInfo();
 	
 	$stats_totalprojects=0;
 	$stats_totalstudents=0;
@@ -123,7 +127,7 @@ else $wherestatus="";
 	$schools_names=array();
 	$languages=array();
 
-	while($r=mysql_fetch_object($q))
+	while($r=$q->fetch(PDO::FETCH_OBJ))
 	{
 		$stats_totalprojects++;
 		$stats_divisions[$r->projectdivisions_id]++;
@@ -142,25 +146,25 @@ else $wherestatus="";
 		$status_text=i18n($status_text);
 
 
-		$sq=mysql_query("SELECT users.firstname,
+		$sq=$pdo->prepare("SELECT students.firstname,
-					users.lastname,
+					students.lastname,
-					users.id,
+					students.id,
 					schools.school,
 					schools.board,
 					schools.id AS schools_id
 				FROM
-					users,schools
+					students,schools
 				WHERE
-					users.registrations_id='$r->reg_id'
+					students.registrations_id='$r->reg_id'
 					AND
-					users.schools_id=schools.id
+					students.schools_id=schools.id
 				");
-				echo mysql_error();
+				echo $pdo->errorInfo();
 
 		$studnum=1;
 		$schools="";
 		$students="";
-		while($studentinfo=mysql_fetch_object($sq))
+		while($studentinfo=$sq->fetch(PDO::FETCH_OBJ))
 		{
 			$stats_totalstudents++;
 			$stats_students_catdiv[$r->projectcategories_id][$r->projectdivisions_id]++;
@@ -183,7 +187,6 @@ else $wherestatus="";
 	}
 	echo "<th>".i18n("Total")."<br /><nobr>".i18n("Stud | Proj")."</th>";
 	echo "</tr></thead>";
-	echo "<tbody>";
 	foreach($divs AS $d=>$dn) {
 		echo "<tr><td>$dn</td>";
 		$tstud=0;
@@ -226,7 +229,7 @@ else $wherestatus="";
 	echo ($tproj);
 	echo "</b></td>";
 	echo "</tr>";
-	echo "</tbody>";
+
 	echo "</table>";
 	echo "</td></tr>";
 
@@ -240,10 +243,10 @@ else $wherestatus="";
 	}
 	echo "<th>".i18n("Total")."<br /><nobr>".i18n("Stud | Proj")."</nobr></th>";
 	echo "</tr></thead>";
-	echo "<tbody>";
 
 	asort($schools_names);
-	foreach($schools_names AS $id=>$sn) {
+	foreach($schools_names AS $id=>$sn) 
+	{
 		echo "<tr><td>$sn</td>";
 		$tstud=0;
 		$tproj=0;
@@ -259,7 +262,6 @@ else $wherestatus="";
 		echo ($tproj?$tproj:0)."</b></td>";
 		echo "</tr>";
 	}
-	echo "</tbody>";
 	echo "</table>";
 	echo i18n("%1 schools total",array(count($schools_names)));
 
@@ -268,7 +270,7 @@ else $wherestatus="";
 	echo "<tr><td colspan=\"2\"><h3>{$status_str[$showstatus]} - ".i18n("Projects per age category / division / language")."</h3></td></tr>";
 	echo "<tr><td colspan=\"2\">";
 	echo "<table class=\"tableview\" width=\"100%\">";	
-	echo "<thead><tr><th rowspan='2' width=\"50%\"></th>";
+	echo "<thead><tr><td rowspan='2' width=\"50%\"></td>";
 	foreach($cats AS $c=>$cn) {
 		echo "<th colspan='".count($languages)."'>$cn</th>";
 	}
@@ -285,11 +287,11 @@ else $wherestatus="";
 		echo "<th>$l</th>";
 	}
 	echo "</tr></thead>";
-	echo "<tbody>";
 	foreach($divs AS $d=>$dn) {
 		echo "<tr><td>$dn</td>";
 		$tproj=array();
-		foreach($cats AS $c=>$cn) {
+		foreach($cats AS $c=>$cn)
+		{
 			foreach($languages AS $l=>$ln) {
 				echo "<td align=\"center\">";
 				echo ($stats_projects_lang[$c][$d][$l]?$stats_projects_lang[$c][$d][$l]:0);
@@ -323,7 +325,7 @@ else $wherestatus="";
 	}
 	echo "</tr>";
 
-	echo "</tbody>";
+
 	echo "</table>";
 
 	echo "</td></tr>";

admin/registration_webconsent.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  send_header("Web Consent", 
  		array('Committee Main' => 'committee_main.php',
@@ -34,15 +34,18 @@
 
  echo "<br />";
 
- if(is_array($_POST['changed'])) {
+ if(is_array($_POST['changed']))
+ {
  	$numchanged=0;
- 	foreach($_POST['changed'] AS $id=>$val) {
+ 	foreach($_POST['changed'] AS $id=>$val)
-		if($val==1) {
+	{
+		if($val==1)
+		{
 			$numchanged++;
 			$webfirst=$_POST['webfirst'][$id]=="yes"?"yes":"no";
 			$weblast=$_POST['weblast'][$id]=="yes"?"yes":"no";
 			$webphoto=$_POST['webphoto'][$id]=="yes"?"yes":"no";
-			mysql_query("UPDATE users SET 
+			$stmt = $pdo->prepare("UPDATE students SET 
 					webfirst='$webfirst',
 					weblast='$weblast',
 					webphoto='$webphoto'
@@ -68,27 +71,28 @@
 
  <?
 
-		$sq=mysql_query("SELECT users.firstname,
+		$sq=$pdo->prepare("SELECT students.firstname,
-					users.lastname,
+					students.lastname,
-					users.id,
+					students.id,
 					projects.projectnumber,
-					users.webfirst,
+					students.webfirst,
-					users.weblast,
+					students.weblast,
-					users.webphoto
+					students.webphoto
 				FROM
-					users,
+					students,
 					registrations,
 					projects
 				WHERE
-				 	users.registrations_id=registrations.id
+				 	students.registrations_id=registrations.id
 				AND	( registrations.status = 'complete' OR registrations.status='paymentpending' )
 				AND	projects.registrations_id=registrations.id
-				AND 	registrations.conferences_id='".$conference['id']."' 
+				AND 	registrations.year='".$config['FAIRYEAR']."' 
-				AND 	projects.conferences_id='".$conference['id']."' 
+				AND 	projects.year='".$config['FAIRYEAR']."' 
-				AND 	users.conferences_id='".$conference['id']."' 
+				AND 	students.year='".$config['FAIRYEAR']."' 
 				ORDER BY projectnumber
 				");
-				echo mysql_error();
+		$sq->execute();
+				echo $pdo->errorInfo();
 
 	echo "<form method=\"post\" action=\"registration_webconsent.php\">";
 	echo "<table class=\"tableview\">";
@@ -99,8 +103,7 @@
 	echo " <th>".i18n("Last")."</th>";
 	echo " <th>".i18n("Photo")."</th>";
 	echo "</tr></thead>";
-	echo "<tbody>";
+	while($r=$sq->fetch(PDO::FETCH_OBJ))
-	while($r=mysql_fetch_object($sq))
 	{
 		echo "<tr>";
 		echo "<td>$r->projectnumber<input id=\"changed_$r->id\" type=\"hidden\" name=\"changed[$r->id]\" value=\"0\"></td>";
@@ -113,7 +116,6 @@
 		echo "<td><input $ch type=\"checkbox\" name=\"webphoto[$r->id]\" value=\"yes\" onchange=\"changed($r->id)\"></td>";
 		echo "</tr>";
 	}
-	echo "</tbody>";
 	echo "</table>";
 	echo "<input type=\"submit\" value=\"".i18n("Save Changes")."\">";
 	echo "</form>";

admin/reports.inc.php

@@ -21,11 +21,14 @@
    Boston, MA 02111-1307, USA.
 */
 
- require_once("reports_students.inc.php");  /* $report_students_fields */
+// This file was modified Jan of 2014 by Richard Sin
- require_once("reports_judges.inc.php");  /* $report_students_fields */
+// A glitch that prints out both english and french columns has been modified.
- require_once("reports_awards.inc.php");  /* $report_students_fields */
+
- require_once("reports_committees.inc.php");  /* $report_students_fields */
+ require_once("reports_students.inc.php");  	/* $report_students_fields */
- require_once("reports_volunteers.inc.php"); /* $report_volunteers_fields */
+ require_once("reports_judges.inc.php");  	/* $report_students_fields */
+ require_once("reports_awards.inc.php");  	/* $report_students_fields */
+ require_once("reports_committees.inc.php"); 	/* $report_students_fields */
+ require_once("reports_volunteers.inc.php"); 	/* $report_volunteers_fields */
  require_once("reports_schools.inc.php");
  require_once("reports_tours.inc.php");
  require_once("reports_fairs.inc.php");
@@ -49,7 +52,7 @@
  
  $report_options = array();
  $report_options['type'] = array('desc' => 'Report Format',
- 				'values' => array('pdf' => 'PDF', 'label'=>'Label', 'csv'=>'CSV (for Excel)', 'text'=>'Coming Soon: Text (Plain text in columns)', 'html'=>'Coming Soon: HTML (Browser Renderable)' )
+ 				'values' => array('pdf'=>'PDF', 'csv'=>'CSV', 'label'=>'Label', 'tcpdf_label'=>'TCPDF Label (experimental)')
 		);
  $report_options['group_new_page'] = array('desc' => 'Start each new grouping on a new page',
  					'values' => array('no'=>'No', 'yes'=>'Yes')
@@ -66,6 +69,12 @@
  $report_options['field_box'] = array('desc' => 'Draw a box around each text field on the label',
  					'values' => array('no'=>'No', 'yes'=>'Yes')
 		);
+ $report_options['label_fairname'] = array('desc' => 'Print the fair name at the top of each label',
+ 					'values' => array('no'=>'No', 'yes'=>'Yes')
+		);
+ $report_options['label_logo'] = array('desc' => 'Print the fair logo at the top of each label',
+ 					'values' => array('no'=>'No', 'yes'=>'Yes')
+		);
  $report_options['default_font_size'] = array('desc' => 'Default font size to use in the report',
  					'values' => array(
 					'10'=>'10', 
@@ -90,138 +99,175 @@ LRP 180		99765	5967	4	1 3/4 x 1/2 	80 */
 
 
 /* FIXME: put these in a databse */
-/* All dimensions are in millimeters */
  $report_stock = array();
-
  $report_stock['fullpage'] = array('name' => 'Letter 8.5 x 11 (3/4" margin)',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 7,
+			'x_spacing' => 0,
+			'cols' => 1,
+			'label_height' => 9.5,
+			'y_spacing' => 0,
+			'rows' => 1,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'P',
-			'label_width' => 177.8,
-			'label_height' => 241.3,
-			'x_spacing' => 0,
-			'y_spacing' => 0,
-			'cols' => 1,
-			'rows' => 1,
 			);
 
  $report_stock['fullpage_landscape'] = array('name' => 'Letter 8.5 x 11 Landscape (3/4" margin)',
+			'page_width' => 11,
+			'page_height' => 8.5,
+			'label_width' => 9.5,
+			'x_spacing' => 0,
+			'cols' => 1,
+			'label_height' => 7,
+			'y_spacing' => 0,
+			'rows' => 1,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'L',
-			'label_width' => 241.3,
-			'label_height' => 177.8,
-			'x_spacing' => 0,
-			'y_spacing' => 0,
-			'cols' => 1,
-			'rows' => 1,
 			);
 
  $report_stock['fullpage_full'] = array('name' => 'Letter 8.5 x 11 (no margin)',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 8.5,
+			'x_spacing' => 0,
+			'cols' => 1,
+			'label_height' => 11,
+			'y_spacing' => 0,
+			'rows' => 1,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'P',
-			'label_width' => 215.9,
-			'label_height' => 279.4,
-			'x_spacing' => 0,
-			'y_spacing' => 0,
-			'cols' => 1,
-			'rows' => 1,
 			);
 
  $report_stock['fullpage_landscape_full'] = array('name' => 'Letter 8.5 x 11 Landscape (no margin)',
+			'page_width' => 11,
+			'page_height' => 8.5,
+			'label_width' => 11,
+			'x_spacing' => 0,
+			'cols' => 1,
+			'label_height' => 8.5,
+			'y_spacing' => 0,
+			'rows' => 1,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'L',
-			'label_width' => 279.4,
-			'label_height' => 215.9,
-			'x_spacing' => 0,
-			'y_spacing' => 0,
-			'cols' => 1,
-			'rows' => 1,
 			);
 
  $report_stock['5161'] = array('name' => 'Avery 5161/5261/5961/8161, G&T 99189 (1"x4")',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 4,
+			'x_spacing' => 0.15,
+			'cols' => 2,
+			'label_height' => 1,
+			'y_spacing' => 0.00,
+			'y_padding' => 0.05,
+			'rows' => 10,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'P',
-			'label_width' => 101.6,
-			'label_height' => 25.4,
-			'x_spacing' => 3.81,
-			'y_spacing' => 0.00,
-			'cols' => 2,
-			'rows' => 10,
 			);
 	
  $report_stock['5162'] = array('name' => 'Avery 5162/5262/5962/8162/8462, G&T 99190 (1 1/3"x4")',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 3.99,
+			'x_spacing' => 0.187,
+			'cols' => 2,
+			'label_height' => 1.326,
+			'y_spacing' => 0.00,
+			'y_padding' => 0.30,
+			'rows' => 7,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'P',
-			'label_width' => 101.35,
-			'label_height' => 33.6804,
-			'x_spacing' => 4.7498,
-			'y_spacing' => 0.00,
-			'cols' => 2,
-			'rows' => 7,
 			);
  $report_stock['5163'] = array('name' => 'Avery 5163/5263/5963/8163/8463, G&T 99181 (2"x4")',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 4,
+			'x_spacing' => 0.1719,
+			'cols' => 2,
+			'label_height' => 2,
+			'y_spacing' => 0.00,
+			'rows' => 5,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'P',
-			'label_width' => 101.6,
-			'label_height' => 50.8,
-			'x_spacing' => 4.3663,
-			'y_spacing' => 0.00,
-			'cols' => 2,
-			'rows' => 5,
 			);
 
+/* This is combined with 5161
+ $report_stock['5961'] = array('name' => 'Avery 5961, G&T 99189 (1"x4")',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 4,
+			'x_spacing' => 0.08,
+			'cols' => 2,
+			'label_height' => 1,
+			'y_spacing' => 0.08,
+			'rows' => 10,
+			);
+*/		
+
  $report_stock['5164'] = array('name' => 'Avery 5164/5264/5964/8164, G&T 99763 (4"x3 1/3")',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 4,
+			'x_spacing' => 3/16,
+			'cols' => 2,
+			'label_height' => 3 + 1/3,
+			'y_spacing' => 0,
+			'rows' => 3,
 			'page_format' => 'LETTER',	/* tcpdf format */
 			'page_orientation' => 'P',	/* tcpdf orientation */
-			'label_width' => 101.6,
-			'label_height' => 84.6667,
-			'x_spacing' => 4.7625,
-			'y_spacing' => 0,
-			'cols' => 2,
-			'rows' => 3,
 
 			);
  $report_stock['nametag'] = array('name' => 'Cards 4"x3"',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 4,
+			'x_spacing' => 0,
+			'cols' => 2,
+			'label_height' => 3,
+			'y_spacing' => 0,
+			'rows' => 3,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'P',
-			'label_width' => 101.6,
-			'label_height' => 76.2,
-			'x_spacing' => 0,
-			'y_spacing' => 0,
-			'cols' => 2,
-			'rows' => 3,
 			);
 
  $report_stock['letter_4up'] = array('name' => 'Fullpage, 4up',
+			'page_width' => 8.5,
+			'page_height' => 11,
+			'label_width' => 4,
+			'x_spacing' => 0.25,
+			'cols' => 2,
+			'label_height' => 5,
+			'y_spacing' => 0.25,
+			'rows' => 2,
 			'page_format' => 'LETTER',
 			'page_orientation' => 'P',
-			'label_width' => 101.6,
-			'label_height' => 127.0,
-			'x_spacing' => 0.25,
-			'y_spacing' => 0.25,
-			'cols' => 2,
-			'rows' => 2,
 			);
 
  $report_stock['ledger'] = array('name' => 'Ledger/Tabloid 11 x 17',
-			'page_format' => 'TABLOID',
+			'page_width' => 11,
-			'page_orientation' => 'P',
+			'page_height' => 17,
-			'label_width' => 279.4,
+			'label_width' => 11,
-			'label_height' => 431.8,
 			'x_spacing' => 0,
-			'y_spacing' => 0,
 			'cols' => 1,
+			'label_height' => 17,
+			'y_spacing' => 0,
 			'rows' => 1,
+			'page_format' => 'LETTER',
+			'page_orientation' => 'P',
 			);
 	
  $report_stock['ledger_landscape'] = array('name' => 'Ledger/Tabloid 11 x 17 Landscape',
-			'page_format' => 'TABLOID',
+			'page_width' => 17,
-			'page_orientation' => 'L',
+			'page_height' => 11,
-			'label_width' => 431.8,
+			'label_width' => 17,
-			'label_height' => 279.4,
 			'x_spacing' => 0,
-			'y_spacing' => 0,
 			'cols' => 1,
+			'label_height' => 11,
+			'y_spacing' => 0,
 			'rows' => 1,
+			'page_format' => 'LETTER',
+			'page_orientation' => 'P',
 			);
 
 
@@ -299,9 +345,10 @@ foreach($report_stock as $n=>$v) {
 	$allow_fields = array_keys($$fieldvar);
 
 	/* First delete all existing fields */
-	mysql_query("DELETE FROM reports_items 
+	$stmt = $pdo->prepare("DELETE FROM reports_items 
 			WHERE `reports_id`='{$report['id']}'
 			AND `type`='$type'");
+	$stmt->execute();
 	/* Now add new ones */
 
 	if(count($report[$type]) == 0) return;
@@ -310,13 +357,16 @@ foreach($report_stock as $n=>$v) {
 	$x = 0;
 	foreach($report[$type] as $k=>$v) {
 		if($type == 'option') {
-			/* field, value, x, y, w, h, align, valign, fn, fs, fsize, overflow */
+			/* field, value, x, y, w, h, lines, face, align, valign, fn, fs, fsize, overflow */
-			$vals = "'$k','$v','0','0','0','0','','','','','0','truncate'";
+			$vals = "'".$k."','".$v."','0','0','0','0','0','','','','','','0','truncate'";
 		} else {
+			if($v['lines'] == 0) $v['lines'] =1;
 			$fs = is_array($v['fontstyle']) ? implode(',',$v['fontstyle']) : '';
-			$vals = "'{$v['field']}','{$v['value']}',
+			$opts = "{$v['align']} {$v['valign']}";
-				'{$v['x']}','{$v['y']}','{$v['w']}','{$v['h']}',
+			$vals = "'{$v['field']}','".$v['value']."',
-				'{$v['align']}','{$v['valign']}',
+				'{$v['x']}','{$v['y']}','{$v['w']}',
+				'{$v['h']}','{$v['lines']}','{$v['face']}',
+				'$opts','{$v['valign']}',
 				'{$v['fontname']}','$fs','{$v['fontsize']}',
 				'{$v['on_overflow']}'";
 		}
@@ -325,13 +375,14 @@ foreach($report_stock as $n=>$v) {
 		$x++;
 	}
 	
-	mysql_query("INSERT INTO reports_items(`reports_id`,`type`,`ord`,
+	$stmt = $pdo->prepare("INSERT INTO reports_items(`reports_id`,`type`,`ord`,
 				`field`,`value`,`x`, `y`, `w`, `h`,
-				`align`,`valign`,
+				`lines`, `face`, `align`,`valign`,
 				`fontname`,`fontstyle`,`fontsize`,`on_overflow`) 
 			VALUES $q;");
 
-	echo mysql_error();
+	$stmt->execute();
+	echo $pdo->erroInfo();
 	
  }
 	
@@ -345,8 +396,9 @@ foreach($report_stock as $n=>$v) {
 
 	$report = array();
 
-	$q = mysql_query("SELECT * FROM reports WHERE id='$report_id'");
+	$q = $pdo->prepare("SELECT * FROM reports WHERE id='$report_id'");
-	$r = mysql_fetch_assoc($q);
+	$q->execute();
+	$r = $q->fetch(PDO::FETCH_ASSOC);
 	$report['name'] = $r['name'];
 	$report['id'] = $r['id'];
 	$report['system_report_id'] = $r['system_report_id']; 
@@ -368,14 +420,15 @@ foreach($report_stock as $n=>$v) {
 	else
 		$allow_fields=array();
 
- 	$q = mysql_query("SELECT * FROM reports_items 
+ 	$q = $pdo->prepare("SELECT * FROM reports_items 
 			WHERE reports_id='{$report['id']}' 
 			ORDER BY `ord`");
-	print(mysql_error());
+	$q->execute();
+	print($pdo->erroInfo());
 	
-	if(mysql_num_rows($q) == 0) return $ret;
+	if($q->rowCount() == 0) return $report;
 
-	while($a = mysql_fetch_assoc($q)) {
+	while($a = $q->fetch(PDO::FETCH_ASSOC)) {
 		$f = $a['field'];
 		$t = $a['type'];
 		switch($t) {
@@ -383,22 +436,33 @@ foreach($report_stock as $n=>$v) {
 			/* We dont' care about order, just construct
 			 * ['option'][name] = value; */
 			if(!in_array($f, $allow_options)) {
-				print("Type[$type] Field[$f] not allowed.\n");
+//				print("Type[$type] Field[$f] not allowed.\n");
 				continue;
 			}
 			$report['option'][$f] = $a['value'];
-			break;
 		default:
 			if(!in_array($f, $allow_fields)) {
-				print("Type[$type] Field[$f] not allowed.\n");
+//				print("Type[$type] Field[$f] not allowed.\n");
 				continue;
 			}
 			/* Pull out all the data */
 			$val = array();
-			$col_fields = array('field', 'x', 'y', 'w', 'h', 'align', 'valign', 'value', 'fontname','fontsize','on_overflow');
+			$col_fields = array('field', 'x', 'y', 'w', 'h', 'lines', 'face', 'align', 'valign', 'value', 'fontname','fontsize','on_overflow');
 			foreach($col_fields as $lf) $val[$lf] = $a[$lf];
-
 			$val['fontstyle'] = explode(',', $a['fontstyle']);
+			/* valign, fontname, fontsize,fontstyle are unused, except in tcpdf reports 
+			(i.e. nothign has changed, only adding on */
+
+			if($val['lines'] == 0) $val['lines'] = 1;
+			$opts = explode(" ", $val['align']);
+			$align_opts = array ('left', 'right', 'center');
+			$valign_opts = array ('vtop', 'vbottom', 'vcenter');
+			$style_opts = array ('bold');
+			foreach($opts as $o) {
+				if(in_array($o, $align_opts)) $val['align'] = $o;
+				if(in_array($o, $valign_opts)) $val['valign'] = $o;
+				if(in_array($o, $valign_opts)) $val['face'] = $o;
+			}
 
 			$report[$t][$a['ord']] = $val;
 			break;
@@ -412,13 +476,15 @@ foreach($report_stock as $n=>$v) {
  {
  	if($report['id'] == 0) {
 		/* New report */
-		mysql_query("INSERT INTO reports (`id`) VALUES ('')");
+		$stmt = $pdo->prepare("INSERT INTO reports (`id`) VALUES ('')");
-		$report['id'] = mysql_insert_id();
+		$stmt->execute();
+		$report['id'] = $pdo->lastInsertId();
 	} else {
 		/* if the report['id'] is not zero, see if this is a
 		 * systeim report before doing anything. */
-		$q = mysql_query("SELECT system_report_id FROM reports WHERE id='{$report['id']}'");
+		$q = $pdo->prepare("SELECT system_report_id FROM reports WHERE id='{$report['id']}'");
-		$i = mysql_fetch_assoc($q);
+		$q->execute();
+		$i = $q->fetch(PDO::FETCH_ASSOC);
 		if(intval($i['system_report_id']) != 0) {
 			/* This is a system report, the editor (should)
 			 * properly setup the editor pages so that the user
@@ -437,12 +503,13 @@ foreach($report_stock as $n=>$v) {
 	print("</pre>");
 */
 
- 	mysql_query("UPDATE reports SET 
+ 	$stmt = $pdo->prepare("UPDATE reports SET 
-			`name`='".mysql_escape_string($report['name'])."',
+			`name`='".$report['name']."',
-			`desc`='".mysql_escape_string($report['desc'])."',
+			`desc`='".$report['desc']."',
-			`creator`='".mysql_escape_string($report['creator'])."',
+			`creator`='".$report['creator']."',
-			`type`='".mysql_escape_string($report['type'])."'
+			`type`='".$report['type']."'
 			WHERE `id`={$report['id']}");
+	$stmt->execute();
 
 	report_save_field($report, 'col', $report['loc']);
 	report_save_field($report, 'group', array());
@@ -456,9 +523,9 @@ foreach($report_stock as $n=>$v) {
  function report_load_all() 
  {
  	$ret = array();
- 	$q = mysql_query("SELECT * FROM reports ORDER BY `name`");
+ 	$q = $pdo->prepare("SELECT * FROM reports ORDER BY `name`");
 
-	while($r = mysql_fetch_assoc($q)) {
+	while($r = $q->fetch(PDO::FETCH_ASSOC)) {
 		$report = array();
 	        $report['name'] = $r['name'];
 	        $report['id'] = $r['id'];
@@ -475,8 +542,9 @@ foreach($report_stock as $n=>$v) {
  	$r = intval($report_id);
 	/* if the report['id'] is not zero, see if this is a
 	 * systeim report before doing anything. */
-	$q = mysql_query("SELECT system_report_id FROM reports WHERE id='$r'");
+	$q = $pdo->prepare("SELECT system_report_id FROM reports WHERE id='$r'");
-	$i = mysql_fetch_assoc($q);
+	$q->execute();
+	$i = $q->fetch(PDO::FETCH_ASSOC);
 	if(intval($i['system_report_id']) != 0) {
 		/* This is a system report, the editor (should)
 		 * properly setup the editor pages so that the user
@@ -486,20 +554,27 @@ foreach($report_stock as $n=>$v) {
 		echo "ERROR: attempt to delete a system report (reports.id=$r)";
 		exit;
 	}
- 	mysql_query("DELETE FROM reports WHERE `id`=$r");
+ 	$stmt = $pdo->prepare("DELETE FROM reports WHERE `id`=$r");
-	mysql_query("DELETE FROM reports_items WHERE `reports_id`=$r");
+	$stmt->execute();
- }
+	$stmt = $pdo->prepare("DELETE FROM reports_items WHERE `reports_id`=$r");
+ $stmt->execute();}
+
 
  function report_gen($report) 
  {
- 	global $config, $report_students_fields, $report_judges_fields, $report_awards_fields, $report_schools_fields;
+foreach($report['col'] as $v)
+
+	global $config, $report_students_fields, $report_judges_fields, $report_awards_fields, $report_schools_fields;
 	global $report_stock, $report_committees_fields, $report_volunteers_fields;
 	global $report_tours_fields, $report_fairs_fields;
 	global $report_fundraisings_fields;
 	global $filter_ops;
-	global $conference;
 
-	//print_r($report);
+//foreach($report as $k=>$v){
+//print_r($k.' ~	>');
+//print_r($v);
+//print_r('<br> <br>');
+//}
 	$fieldvar = "report_{$report['type']}s_fields";
 	$fields = $$fieldvar;
 
@@ -507,7 +582,9 @@ foreach($report_stock as $n=>$v) {
 	$fieldname = array();
 	$thead = array();
 		
-	$table['col']=array();
+	$table['header']=array();
+	$table['widths']=array();
+	$table['dataalign']=array();
 	$table['option']=array();
 	$table['total']=0;
 
@@ -524,40 +601,53 @@ foreach($report_stock as $n=>$v) {
 		$rep=new lcsv(i18n($report['name']));
 		$gen_mode = 'table';
 		break;
-
 	case 'label':
+		/* Label */
+		$label_stock = $report_stock[$report['option']['stock']];
+		$rep=new lpdf(	i18n($config['fairname']),
+				i18n($report['name']),
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo.gif");
+		$rep->setPageStyle("labels");
+		$rep->newPage($label_stock['page_width'], $label_stock['page_height']);
+		$rep->setFontSize(11);
+		$rep->setLabelDimensions($label_stock['label_width'], $label_stock['label_height'],
+				$label_stock['x_spacing'], $label_stock['y_spacing'],11,$label_stock['y_padding']);
+		$gen_mode = 'label';
+		break;
+	case 'pdf': case '':
+		/* FIXME: handle landscape pages in here */
+		$label_stock = $report_stock[$report['option']['stock']];
+		$rep=new lpdf(	i18n($config['fairname']),
+				i18n($report['name']),
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo.gif");
+		$rep->newPage($label_stock['page_width'], $label_stock['page_height']);
+		if($report['option']['default_font_size']) {
+			$rep->setDefaultFontSize($report['option']['default_font_size']);
+			$rep->setFontSize($report['option']['default_font_size']);
+		}
+		else {
+			$rep->setDefaultFontSize(11);
+			$rep->setFontSize(11);
+		}
+
+		$gen_mode = 'table';
+		if($report['option']['allow_multiline'] == 'yes') 
+			$table['option']['allow_multiline'] = true;
+		break;
+	case 'tcpdf_label':
 		$label_stock = $report_stock[$report['option']['stock']];
 		$show_box = ($report['option']['label_box'] == 'yes') ? true : false;
+		$show_fair = ($report['option']['label_fairname'] == 'yes') ? true : false;
+		$show_logo = ($report['option']['label_logo'] == 'yes') ? true : false;
 
 		$rep=new pdf($report['name'], $label_stock['page_format'], $label_stock['page_orientation']);
 		$rep->setup_for_labels($show_box, $show_fair, $show_logo, 
-				$label_stock['label_width'], $label_stock['label_height'],
+				$label_stock['label_width'] * 25.4, $label_stock['label_height'] * 25.4,
-				$label_stock['x_spacing'], $label_stock['y_spacing'],
+				$label_stock['x_spacing'] * 25.4, $label_stock['y_spacing'] * 25.4,
 				$label_stock['rows'], $label_stock['cols']);
-		$gen_mode = 'label';
+		$gen_mode = 'tcpdf_label';
 		break;
 
-	case 'pdf': case '':
-		$label_stock = $report_stock[$report['option']['stock']];
-		if($report['option']['allow_multiline'] == 'yes') 
-			$on_overflow = 'nothing';
-		else 
-			$on_overflow = '...';
-
-		$rep=new pdf($report['name'], $label_stock['page_format'], $label_stock['page_orientation']);
-		$rep->setup_for_tables($show_box, $show_fair, $show_logo, 
-				$label_stock['label_width'], $label_stock['label_height'],
-				$label_stock['x_spacing'], $label_stock['y_spacing'],
-				$label_stock['rows'], $label_stock['cols']);
-		$gen_mode = 'table';
-		break;
-
-
-
-	case 'text':
-		echo "Not implemented [{$report['option']['type']}]";
-		exit;
-
 	default:
 		echo "Invalid type [{$report['option']['type']}]";
 		exit;
@@ -572,51 +662,51 @@ foreach($report_stock as $n=>$v) {
 
 	$total_width = 0;
 	$scale_width = 0;
+	$temp=array();
+	$count=0;
+	foreach($report['col'] as $o=>$d) {
+		if($config['default_language']!='fr'){
+			if(strpos($d['field'],'fr_')!='fr_'){
+			$temp[$count]=$d;
+			$count++;
+			}
+		} 
+	}
+	$report['col']=$temp;
 	/* Add up the column widths, and figure out which
 	 * ones are scalable, just in case */
 	foreach($report['col'] as $o=>$d) {
 		$f = $d['field'];
-		if($d['w'] != 0) { 
+		$total_width += $fields[$f]['width'];
-			/* Always 0 on old reports, so we never get in here */
+		if($fields[$f]['scalable'] == true)
-			$total_width += $d['w'];
+			$scale_width += $fields[$f]['width'];
-			/* For the rest of the computation, this field is
-			 * not scalable */
-			 /* FIXME! */
-		} else {
-			$total_width += $fields[$f]['width'];
-			if($fields[$f]['scalable'] == true) 
-				$scale_width += $fields[$f]['width'];
-		}
 	}
 
 	/* Determine the scale factor (use the label width so
 	 * we can enforce margins) */
+
 	if($report['option']['fit_columns'] == 'yes') { // && $total_width > $label_stock['label_width'])  {
 		$static_width = $total_width - $scale_width;
-		if($scale_width) 
+        	if($scale_width){
-			$scale_factor = ($label_stock['label_width'] - $static_width) / $scale_width;
+			if ($label_stock['label_width'] - $static_width > 0) {
-		else
+	        		$scale_factor = ($label_stock['label_width'] - $static_width) / $scale_width;
-			$scale_factor = 1.0;
+ 			} else {
+				$scale_factor = $label_stock['label_width']/$total_width;
+			} 
+		} else {
+        		$scale_factor = 1.0;
+		}
 	} else {
-		$scale_factor = 1.0;
+			$scale_factor = 1.0;
 	}
 
-
 	/* Select columns to display */
 	foreach($report['col'] as $o=>$d) {
 		$f = $d['field'];
-
+		$table['header'][] = i18n($fields[$f]['header']);
-		/* If width is specificed, use that, else compute based on default field width */
+		$sf = ($fields[$f]['scalable'] == true) ? $scale_factor : 1.0;
-		if($d['w'] == 0)
+		$table['widths'][] = $fields[$f]['width'] * $sf;
-			$width = $fields[$f]['width'] * (($fields[$f]['scalable'] == true) ? $scale_factor : 1.0);
+		$table['dataalign'][] = 'left';
-		else 
-			$width = $d['w'];
-		$col = array(	'header' => i18n($fields[$f]['header']),
-				'width' => $width,
-				'align' => 'left',
-				'on_overflow' => $on_overflow);
-		$table['col'][] = $col;
-
 		$sel[] = "{$fields[$f]['table']} AS C$x";
 		$fieldname[$f] = "C$x";
 		/* We want to add these to group by, but AFTER all the other group bys */
@@ -638,7 +728,7 @@ foreach($report_stock as $n=>$v) {
 			$fieldname[$f] = "G$o";
 		}
 
-		if(isset($fields[$f]['able_sort']))
+		if(isset($fields[$f]['table_sort']))
 			$order[] = $fields[$f]['table_sort'];
 		else
 			$order[] = $fieldname[$f];
@@ -649,6 +739,7 @@ foreach($report_stock as $n=>$v) {
 		}
 	}
 
+
 	/* If no sort order is specified, make the first field the order */
 	if(count($report['sort']) == 0) 
 		$report['sort'] = array(0 => array('field' => $report['col'][0]['field']));
@@ -692,8 +783,8 @@ foreach($report_stock as $n=>$v) {
 	$order = implode(",", $order);
 		
 	
-	if(!isset($report['conferences_id'])){
+	if(!isset($report['year'])) {
-		$report['conferences_id'] = $conference['id'];
+		$report['year'] = $config['FAIRYEAR'];
 	}
 	
 	$group_by = array_merge($group_by, $post_group_by);
@@ -711,11 +802,13 @@ foreach($report_stock as $n=>$v) {
 	$q = call_user_func_array($func, array($report, $components));
 
 	$q = "SELECT $sel  $q  $filter_query $group_query ORDER BY $order";
-	$r = mysql_query($q);
+	$r = $pdo->prepare($q);
-
+	$r->execute();
+ 
 //	print_r($report);
 //	print_r($report['filter']);
 //	echo "$q";
+	
 
 	if($r == false) {
 		echo "The report database query has failed.  This is
@@ -725,20 +818,19 @@ foreach($report_stock as $n=>$v) {
 		a bug report so we can get this fixed.<br />"; 
 		echo "<pre>";
 		echo "Query: [$q]<br />";
-		echo "Error: [".mysql_error()."]<br />";
+		echo "Error: [".$pdo->erroInfo()."]<br />";
 		echo "</pre>";
 		exit;
 	}
-	echo mysql_error();
+	echo $pdo->erroInfo();
 
 	$ncols = count($report['col']);
 	$n_groups = count($report['group']);
 	$last_group_data = array();
 
 //	echo "<pre>";print_r($rep);
-
+	while($i = $r->fetch(PDO::FETCH_ASSOC)) {
-	while($i = mysql_fetch_assoc($r)) {
+		
-
 		if($n_groups > 0) {
 			$group_change = false;
 			/* See if any of the "group" fields have changed */
@@ -758,48 +850,78 @@ foreach($report_stock as $n=>$v) {
 
 			if($group_change) {
 				/* Dump the last table */
+
 				if(count($table['data'])) {
 				//	print_r($table);
-					$rep->addTable($table);
+					$rep->addTable($table);  //table is the content
+					$rep->nextLine();
 					$table['data'] = array();
 					$table['total'] = 0;
 					/* Start a new page AFTER a table is
 					* dumped, so the first page doesn't
 					* end up blank */
 					if($report['option']['group_new_page'] == 'yes') {
-						$rep->addpage();
+						$rep->newPage();
 					} else {
 						$rep->hr();
+						$rep->vspace(-0.1);
 					}
 				}
 				
 				/* Construct a new header */
 				$h = implode(" -- ", $last_group_data);
 				$rep->heading($h);
+				$rep->nextLine();
 			}
 			
 		}
 
 		$data = array();
 		if($gen_mode == 'label') {
+			$show_box = ($report['option']['label_box'] == 'yes') ? true : false;
+			$show_fair = ($report['option']['label_fairname'] == 'yes') ? true : false;
+			$show_logo = ($report['option']['label_logo'] == 'yes') ? true : false;
+			$rep->newLabel($show_box, $show_fair, $show_logo);
+		} else if($gen_mode == 'tcpdf_label') {
 			$rep->label_new();
 		}
 
-		foreach($report['col'] as $o=>$d) {
+		foreach($report['col'] as $o=>$d) {			//fill in one page
 			$f = $d['field'];
+
 			if(is_array($fields[$f]['value_map'])) {
 				$v = $fields[$f]['value_map'][$i["C$o"]];
 			} else if(is_callable($fields[$f]['exec_function'])) {
 				$v = call_user_func_array($fields[$f]['exec_function'], array($report, $f, $i["C$o"]));
-//			} else if(isset($fields[$f]['exec_code'])) {
-//				Somethign like this, how do we pass $i["C$o"] in?
-//				$v = exec($fields[$f]['exec_code']);
 			} else {
 				$v =  $i["C$o"];
 			}
+
 			if($gen_mode == 'table') {
 				$data[] = $v;
 			} else if($gen_mode == 'label') {
+				$opt = array();
+				if($d['face'] == 'bold') $opt[] = 'bold';
+				$opt[] = $d['align'];
+				$opt[] = $d['valign'];
+				if($report['option']['field_box'] == 'yes') 
+					$opt[] = 'field_box';
+
+//the page content is filled
+				/* Special column, draw a box */
+				if($f == 'static_box') {
+					$rep->addLabelBox($d['x'], $d['y'], $d['w'],
+								$d['h']);
+				} else {
+					/* Special column, override result with static text */
+					if($f == 'static_text') $v = $d['value'];
+
+					$lh = ($d['lines'] == 0) ? 0 : $d['h']/$d['lines'];
+					$rep->addLabelText2($d['x'], $d['y'], $d['w'],
+							$d['h'], $lh,
+							$v, $opt);
+				}
+			} else if($gen_mode == 'tcpdf_label') {
 				/* Setup additional options */
 				$show_box = ($report['option']['field_box'] == 'yes') ? true : false;
 
@@ -809,7 +931,7 @@ foreach($report_stock as $n=>$v) {
 				case 'static_box':
 					$rep->label_rect($d['x'], $d['y'], $d['w'], $d['h']);
 					break;
-				case 'conference_logo':
+				case 'fair_logo':
 					$rep->label_fair_logo($d['x'], $d['y'], $d['w'], $d['h'], $show_box);
 					break;
 				case "projectbarcode":
@@ -819,8 +941,8 @@ foreach($report_stock as $n=>$v) {
 					'hpadding' => 'auto',
 					'fgcolor' => array(0,0,0),
 					'bgcolor' => false, //array(255,255,255)
-					'module_width' => 3, // width of a single module in points
+					'module_width' => 2, // width of a single module in points
-					'module_height' => 3 // height of a single module in points
+					'module_height' => 2 // height of a single module in points
 					);
 					$rep->label_barcode($v, 'QRCODE,H', $d['x'], $d['y'], $d['w'], $d['h'], $style, 'N');
 				break;
@@ -829,6 +951,8 @@ foreach($report_stock as $n=>$v) {
 					if($f == 'static_text') 
 						$v = $d['value'];
 
+					$v = iconv("ISO-8859-1","UTF-8",$v);
+
 					$rep->label_text($d['x'], $d['y'], $d['w'], $d['h'],
 					$v, $show_box, $d['align'], $d['valign'],
 					$d['fontname'],$d['fontstyle'],$d['fontsize'],
@@ -837,7 +961,39 @@ foreach($report_stock as $n=>$v) {
 					break;
 				}
 
+
+
+/*
+				if($f == 'static_box') {
+					$rep->label_rect($d['x'], $d['y'], $d['w'], $d['h']);
+				} else {
+					if($f == 'static_text') $v = $d['value'];
+
+					$v = iconv("ISO-8859-1//TRANSLIT", "UTF-8", $v);
+					if($f=="projectbarcode") {
+						$style = array(
+							'border' => 2,
+							'vpadding' => 'auto',
+							'hpadding' => 'auto',
+							'fgcolor' => array(0,0,0),
+							'bgcolor' => false, //array(255,255,255)
+							'module_width' => 2, // width of a single module in points
+							'module_height' => 2 // height of a single module in points
+						);
+						$rep->label_barcode($v, 'QRCODE,H', $d['x'], $d['y'], $d['w'], $d['h'], $style, 'N');
+					}
+					else {
+						$rep->label_text($d['x'], $d['y'], $d['w'], $d['h'],
+								$v, $show_box, $d['align'], $d['valign'],
+								$d['fontname'],$d['fontstyle'],$d['fontsize'],
+								$d['on_overflow']);
+					}
+
+				}
+				*/
+
 			}
+//}
 
 			if($fields[$f]['total'] == true)
 				$table['total'] += $v;

admin/reports.php

@@ -35,8 +35,9 @@ $option_keys = array('type','stock');
 switch($_GET['action']) {
 case 'remove_report':
  	$id = intval($_GET['id']);
-	mysql_query("DELETE FROM reports_committee WHERE
+	$stmt = $pdo->prepare("DELETE FROM reports_committee WHERE
-			users_id='{$_SESSION['accounts_id']}' AND id='$id'");
+			users_id='{$_SESSION['users_uid']}' AND id='$id'");
+	$stmt->execute();
 	happy_('Report successfully removed');
 	exit;
 case 'reload':
@@ -60,16 +61,17 @@ case 'load_report':
 		$ret['name'] = $report['name'];
 		$ret['category'] = '';
 	} else {
-		$q = mysql_query("SELECT * FROM reports_committee WHERE id='$id'");
+		$q = $pdo->prepare("SELECT * FROM reports_committee WHERE id='$id'");
-		$ret = mysql_fetch_assoc($q);
+		$ret = $q->fetch(PDO::FETCH_ASSOC);
 		$ret['type'] = $ret['format'];
 	}
 
 	/* Load available categories */
-	$q = mysql_query("SELECT DISTINCT category FROM reports_committee
+	$q = $pdo->prepare("SELECT DISTINCT category FROM reports_committee
- 			WHERE users_id='{$_SESSION['accounts_id']}'
+ 			WHERE users_id='{$_SESSION['users_uid']}'
 			ORDER BY category");
-	while($i = mysql_fetch_object($q))
+	$q->execute();
+	while($i = $q->fetch(PDO::FETCH_OBJ))
 		$ret['cat'][] = $i->category;
 	echo json_encode($ret);
 	exit;
@@ -81,19 +83,20 @@ case 'save':
  	$reports_id = intval($_POST['reports_id']);
 	if($id == -1) {
 		/* New entry */
-		mysql_query("INSERT INTO `reports_committee` (`users_id`,`reports_id`) 
+		$stmt = $pdo->prepare("INSERT INTO `reports_committee` (`users_id`,`reports_id`) 
-			VALUES('{$_SESSION['accounts_id']}','$reports_id');");
+			VALUES('{$_SESSION['users_uid']}','$reports_id');");
-		echo mysql_error();
+		$stmt->execute();
-		$id = mysql_insert_id();
+		echo $pdo->errorInfo();
+		$id = $pdo->lastInsertId();
 	}
 
 	/* Update entry */
 	$category = $_POST['category'];
 	$category_exist = $_POST['category_exist'];
-	$comment = mysql_real_escape_string(stripslashes($_POST['comment']));
+	$comment = stripslashes($_POST['comment']);
 
 	if($category_exist != '') $category = $category_exist;
-	$category = mysql_real_escape_string(stripslashes(trim($category)));
+	$category = stripslashes(trim($category));
 
 	if($category == '') $category = 'default';
 
@@ -115,12 +118,13 @@ case 'save':
 		$stock = '';
 	}
 
-	mysql_query("UPDATE `reports_committee` SET
+	$stmt = $pdo->prepare("UPDATE `reports_committee` SET
 			`category`='$category',
 			`comment`='$comment',
 			`format`='$type',
 			`stock`='$stock'
 			WHERE id='$id'");
+	$stmt->execute();
 	happy_("Saved");
 	exit;
  }
@@ -237,20 +241,21 @@ $(document).ready(function() {
 <?
 
  /* Load all the users reports */
- $q = mysql_query("SELECT reports_committee.*,reports.name
+ $q = $pdo->prepare("SELECT reports_committee.*,reports.name
  			FROM reports_committee 
 				LEFT JOIN reports ON reports.id=reports_committee.reports_id
- 			WHERE users_id='{$_SESSION['accounts_id']}'
+ 			WHERE users_id='{$_SESSION['users_uid']}'
 			ORDER BY category,id");
- echo mysql_error();
+$q->execute();
- if(mysql_num_rows($q) == 0) {
+ echo $pdo->errorInfo();
+ if($q->rowCount()== 0) {
  	echo i18n('You have no reports saved');
  } else {
 
 	$last_category = '';
 	$x=0;
 	echo "<table class=\"tableview\" style=\"border:0px;\">";
-	while($i = mysql_fetch_object($q)) {
+	while($i = $q->fetch(PDO::FETCH_OBJ)) {
 		$x++;
 		if($last_category != $i->category) {
 			/* New category */
@@ -283,6 +288,18 @@ $(document).ready(function() {
 			</td>
 		</tr>			
 <?
+/*
+
+		if($i->reports_id > 0) {
+			echo '<tr><td width=\"20px\"></td><td>';
+			echo '<span style=\"font-size: 0.75em;\">';
+			echo i18n('Format').": {$i->format}, ";
+			echo i18n('Paper').": {$report_stock[$i->stock]['name']}, ";
+			echo i18n('Year').": {$config['FAIRYEAR']}";
+			echo '</span>';
+			echo '</td></tr>';
+		}
+*/
 
 	}
 	echo "</table>";

admin/reports_acscript.php

@@ -1,24 +1,15 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
  require("../lcsv.php");
 
- if($_GET['foryear']){
+ if($_GET['year']) $foryear=$_GET['year'];
- 	// backwards compatability
+ else $foryear=$config['FAIRYEAR'];
-	$r = mysql_fetch_assoc(mysql_query("SELECT id FROM conferences WHERE year = " . $_GET['foryear']));
-	if(is_array($r)){
-		$forconference = $r['id'];
-	}else{
-		$forconference = $conference['id'];
-	}
- }
- if($_GET['conference']) $forconference=$_GET['conference'];
- else $forconference=$conference['id'];
 
  if($_GET['awardtype']=="All") $awardtype="";
- else if($_GET['awardtype']) $awardtype=" AND award_types.type='".mysql_escape_string($_GET['awardtype'])."'";
+ else if($_GET['awardtype']) $awardtype=" AND award_types.type='".$_GET['awardtype']."'";
  else $awardtype="";
 
  if($_GET['show_unawarded_awards']=="on") $show_unawarded_awards="yes";
@@ -33,7 +24,11 @@
  if(is_array($_GET['show_category'])) {
 	 $show_category = array();
  	foreach($_GET['show_category'] as $id=>$val) {
-		$show_category[] = "award_awards_projectcategories.projectcategories_id='$id'";
+		$show_category[] = "projects.projectcategories_id='$id'";
+	}
+	if($show_unawarded_prizes=="yes")
+	{
+		$show_category[] = "projects.projectcategories_id IS NULL";
 	}
 	$and_categories = join(' OR ', $show_category);
  } else {
@@ -51,7 +46,7 @@ if(!$scriptformat) $scriptformat="default";
 	if($type=="pdf") {
 		$rep=new lpdf(	i18n($config['fairname']),
 				i18n("Awards Ceremony Script"),
-				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 				);
 
 		$rep->newPage();
@@ -61,7 +56,7 @@ if(!$scriptformat) $scriptformat="default";
 	else if($type=="csv") {
 		$rep=new lcsv(i18n("Awards Ceremony Script"));
 	}
-	$q=mysql_query("SELECT 
+	$q=$pdo->prepare("SELECT 
 				award_awards.id,
 				award_awards.name,
 				award_awards.presenter,
@@ -73,31 +68,28 @@ if(!$scriptformat) $scriptformat="default";
 			FROM 
 				award_awards,
 				award_types,
-				sponsors,
+				sponsors
-				award_awards_projectcategories
 			WHERE 
-					award_awards.conferences_id='$forconference'
+					award_awards.year='$foryear'
-				AND	award_types.conferences_id='$forconference'
+				AND	award_types.year='$foryear'
 				AND	award_awards.award_types_id=award_types.id
 				AND	award_awards.sponsors_id=sponsors.id
-				AND     award_awards.id=award_awards_projectcategories.award_awards_id
 				AND	award_awards.excludefromac='0'
-				AND ($and_categories)
 				$awardtype
-			GROUP BY award_awards.id
 			ORDER BY awards_order");
+		$q->execute();
 
-	echo mysql_error();
+	echo $pdo->errorInfo();
 //	echo "<pre>";
-	if(!mysql_num_rows($q)) {
+	if(!$q->rowCount()) {
 		$rep->output();
 		exit;
 	}
 	$awards = array();
 
-	while($r=mysql_fetch_object($q)) {
+	while($r=$q->fetch(PDO::FETCH_OBJ)) {
 
-		$pq=mysql_query("SELECT 
+		$pq=$pdo->prepare("SELECT 
 						award_prizes.prize,
 						award_prizes.number,
 						award_prizes.id,
@@ -114,16 +106,18 @@ if(!$scriptformat) $scriptformat="default";
 						LEFT JOIN projects ON projects.id=winners.projects_id
 					WHERE 
 						award_awards_id='{$r->id}' 
-						AND award_prizes.conferences_id='$forconference'
+						AND award_prizes.year='$foryear'
 						AND award_prizes.excludefromac='0'
+						AND ($and_categories)
 					ORDER BY 
 						`order`,
 						projects.projectnumber");
-					echo mysql_error();
+		$pq->execute();
+					echo $pdo->errorInfo();
 
 		$r->winners = array();
 		$r->awarded_count = 0;
-		while($w = mysql_fetch_object($pq)) {
+		while($w = $pq->fetch(PDO::FETCH_OBJ)) {
 			if($w->projects_id)
 			{
 				$r->awarded_count++;
@@ -237,30 +231,31 @@ if(!$scriptformat) $scriptformat="default";
 						if($scriptformat=="default") 
 							$rep->addText( "    ($pr->projectnumber) $pr->title");
 
-						$sq=mysql_query("SELECT users.firstname,
+						$sq=$pdo->prepare("SELECT students.firstname,
-									users.lastname,
+									students.lastname,
-									users.pronunciation,
+									students.pronunciation,
-									users.schools_id,
+									students.schools_id,
 									schools.school
 								FROM
-									users,
+									students,
 									schools
 								WHERE
-									users.registrations_id='$pr->reg_id'
+									students.registrations_id='$pr->reg_id'
-									AND users.schools_id=schools.id
+									AND students.schools_id=schools.id
 								");
+						$sq->execute();
 	
 						$students="       Students: ";
 						$studnum=0;
 						$pronounce = "";
 						$rawpronounce = "";
-						while($studentinfo=mysql_fetch_object($sq)) {
+						while($studentinfo=$sq->fetch(PDO::FETCH_OBJ)) {
 							if($studnum>0) $students.=", ";
 							$students.="$studentinfo->firstname $studentinfo->lastname";
 
-							if($studentinfo->pronunciation) {
+							if($studnum>0) $pronounce .= ", ";
-								$students .= "    (Pronounced \"{$studentinfo->pronunciation}\")";
+							$pronounce .= "\"{$studentinfo->pronunciation}\"";
-							}
+							$rawpronounce .= "{$studentinfo->pronunciation}";
 
 							$student_winner[$studnum] = "$studentinfo->firstname $studentinfo->lastname";
 							$student_win_pronunc[$studnum] = "$studentinfo->pronunciation";
@@ -270,6 +265,8 @@ if(!$scriptformat) $scriptformat="default";
 
 						if($scriptformat=="default") {
 							$rep->addText($students);
+							if(trim($rawpronounce) != "" && $show_pronunciation == TRUE)
+								$rep->addText("       Pronunciation: $pronounce");
 							$rep->addText("       School: {$student_school[0]}");
 						}
 						if($scriptformat=="formatted") {

admin/reports_appeal_letters.php

@@ -24,13 +24,13 @@
 <?
 require_once('../common.inc.php');
 require_once('../user.inc.php');
-user_auth_required('admin');
+user_auth_required('committee', 'admin');
 
 require_once('../tcpdf/tcpdf_sfiab_config.php');
 require_once('../tcpdf/tcpdf.php');
 
 $fcid = intval($_GET['fundraising_campaigns_id']);
-$key = mysql_real_escape_string($_GET['key']);
+$key = $_GET['key'];
 
 /* Start an output PDF */
 $pdf = new TCPDF(PDF_PAGE_ORIENTATION, PDF_UNIT, PDF_PAGE_FORMAT, true, 'UTF-8', false);
@@ -69,16 +69,17 @@ $pdf->setImageScale(PDF_IMAGE_SCALE_RATIO);
 
 /* Load the users */
 $users = array();
-$q = mysql_query("SELECT * FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$fcid'");
+$q = $pdo->prepare("SELECT * FROM fundraising_campaigns_users_link WHERE fundraising_campaigns_id='$fcid'");
-while($l = mysql_fetch_assoc($q)) {
+while($l = $q->fetch(PDO::FETCH_ASSOC))) {
 	$uid = $l['users_uid'];
 	$users[$uid] = user_load_by_uid($uid);
 }
 
 /* Grab all the emails */
-$q = mysql_query("SELECT * FROM emails WHERE fundraising_campaigns_id='$fcid' AND val='$key'");
+$q = $pdo->prepare("SELECT * FROM emails WHERE fundraising_campaigns_id='$fcid' AND val='$key'");
+$q->execute();
 
-while($e = mysql_fetch_assoc($q)) {
+while($e = $q->fetch(PDO::FETCH_ASSOC))) {
 
 	foreach($users as $uid=>&$u) {
 	 	$subject = communication_replace_vars($e['subject'], $u);

admin/reports_awards.inc.php

@@ -20,104 +20,127 @@
    the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
    Boston, MA 02111-1307, USA.
 */
+
+function report_awards_fr($report, $field, $text) {
+	return i18n($text,array(),array(),"fr");
+}
+
+function report_cash_words($report, $field, $text) {
+	return wordify($text, true);
+}
+
 $report_awards_fields = array(
 	'name' =>  array(
 		'start_option_group' => 'Award Information',
 		'name' => 'Award -- Name',
 		'header' => 'Award Name',
-		'width' => 76.2 /*mm*/,
+		'width' => 3.0,
 		'table' => 'award_awards.name' ),
 
+	'name_fr' =>  array(
+		'name' => 'Award -- Name (French)',
+		'header' => 'Award Name',
+		'width' => 3.0,
+		'table' => 'award_awards.name',
+		'exec_function' => 'report_awards_fr' ),
+
 	'criteria' =>  array(
 		'name' => 'Award -- Criteria',
 		'header' => 'Award Criteria',
-		'width' => 76.2 /*mm*/,
+		'width' => 3.0,
 		'table' => 'award_awards.criteria' ),
 
+	'criteria_fr' =>  array(
+		'name' => 'Award -- Criteria (French)',
+		'header' => 'Award Criteria',
+		'width' => 3.0,
+		'table' => 'award_awards.criteria',
+		'exec_function' => 'report_awards_fr' ),
+
 	'presenter' =>  array(
 		'name' => 'Award -- Presenter',
 		'header' => 'Award Presenter',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'award_awards.presenter' ),
 
 	'order' =>  array(
 		'name' => 'Award -- Order',
 		'header' => 'Award Order',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'award_awards.order' ),
 
 	'cwsfaward' =>  array(
 		'name' => 'Award -- CWSF Award',
 		'header' => 'CWSF',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'award_awards.cwsfaward',
 		'value_map' => array ('0' => 'No', '1' => 'Yes')),
 
 	'type' => array(
 		'name' => 'Award -- Type',
 		'header' => 'Award Type',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'award_types.type' ),
 
 	'empty_winner_box' => array(
 		'name' => 'Award -- Empty Winner Box (for hand entry on printed reports)',
 		'header' => 'Winner',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => "CONCAT('')" ),
 
 	'sponsor_organization' => array(
 		'start_option_group' => 'Sponsor Information',
 		'name' => 'Sponsor -- Organization',
 		'header' => 'Sponsor Organization',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => 'sponsors.organization' ),
 
 	'sponsor_phone' => array(
 		'name' => 'Sponsor -- Phone',
 		'header' => 'Sp. Phone',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'sponsors.phone' ),
 
 	'sponsor_fax' => array(
 		'name' => 'Sponsor -- Fax',
 		'header' => 'Sp. Fax',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'sponsors.fax' ),
 
 	'sponsor_address' =>  array(
 		'name' => 'Sponsor -- Street Address',
 		'header' => 'Sponsor Address',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => 'sponsors.address'),
 
 	'sponsor_city' =>  array(
 		'name' => 'Sponsor -- City',
 		'header' => 'Sp. City',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'sponsors.city' ),
 
 	'sponsor_province' =>  array(
 		'name' => 'Sponsor -- '.$config['provincestate'],
 		'header' => 'Sp. '.$config['provincestate'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'sponsors.province_code' ),
 
 	'sponsor_postal' =>  array(
 		'name' => 'Sponsor -- '.$config['postalzip'],
 		'header' => 'Sp. '.$config['postalzip'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'sponsors.postalcode' ),
 
 	'sponsor_notes' =>  array(
 		'name' => 'Sponsor -- Notes',
 		'header' => 'Sponsor Notes',
-		'width' => 76.2 /*mm*/,
+		'width' => 3,
 		'table' => 'sponsors.notes' ),
 
 	'sponsorship_status' =>  array(
 		'name' => 'Sponsorship -- Status',
 		'header' => 'Sp. Status',
-		'width' => 12.7 /*mm*/,
+		'width' => .5,
 		'table' => 'sponsorships.status',
 		'value_map' => array ('pending' => 'Pending', 'confirmed' => 'Confirmed'), "received"=>"Received"),
 
@@ -125,134 +148,134 @@ $report_awards_fields = array(
 		'start_option_group' => 'Sponsor Primary Contact',
 		'name' => 'Primary Contact -- Salutation',
 		'header' => 'Cnct. Salutation',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'PRIMARYCONTACTUSER.salutation' ),
 
 	'pcontact_last_name' =>  array(
 		'name' => 'Primary Contact -- Last Name',
 		'header' => 'Cnct. Last Name',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'PRIMARYCONTACTUSER.lastname' ),
 
 	'pcontact_first_name' => array(
 		'name' => 'Primary Contact -- First Name',
 		'header' => 'Cnct. First Name',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'PRIMARYCONTACTUSER.firstname' ),
 
 	'pcontact_name' =>  array(
 		'name' => 'Primary Contact -- Full Name (last, first)',
 		'header' => 'Contact Name',
-		'width' => 44.45 /*mm*/,
+		'width' => 1.75,
 		'table' => "CONCAT(PRIMARYCONTACTUSER.lastname, ', ', PRIMARYCONTACTUSER.firstname)",
 		'table_sort'=> 'PRIMARYCONTACTUSER.lastname' ),
 		
 	'pcontact_namefl' =>  array(
 		'name' => 'Primary Contact -- Full Name (salutation first last)',
 		'header' => 'Contact Name',
-		'width' => 44.45 /*mm*/,
+		'width' => 1.75,
 		'table' => "CONCAT(PRIMARYCONTACTUSER.salutation, ' ', PRIMARYCONTACTUSER.firstname, ' ', PRIMARYCONTACTUSER.lastname)",
 		'table_sort'=> 'PRIMARYCONTACTUSER.lastname' ),
 
 	'pcontact_position' =>  array(
 		'name' => 'Primary Contact -- Position',
 		'header' => 'Cnct. Position',
-		'width' => 31.75 /*mm*/,
+		'width' => 1.25,
 		'table' => 'PRIMARYCONTACT.position'),
 
 	'pcontact_email' =>  array(
 		'name' => 'Primary Contact -- Email',
 		'header' => 'Cnct. Email',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => 'PRIMARYCONTACTUSER.email'),
 
 	'pcontact_hphone' => array(
 		'name' => 'Primary Contact -- Home Phone',
 		'header' => 'Cnct. Home',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'PRIMARYCONTACTUSER.phonehome' ),
 
 	'pcontact_wphone' => array(
 		'name' => 'Primary Contact -- Work Phone',
 		'header' => 'Cnct. Work',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'PRIMARYCONTACTUSER.phonework' ),
 
 	'pcontact_cphone' => array(
 		'name' => 'Primary Contact -- Cell Phone',
 		'header' => 'Cnct. Cell',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'PRIMARYCONTACTUSER.phonecell' ),
 
 	'pcontact_fax' => array(
 		'name' => 'Primary Contact -- Fax',
 		'header' => 'Cnct. Fax',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'PRIMARYCONTACTUSER.fax' ),
 		
 	'pcontact_notes' =>  array(
 		'name' => 'Primary Contact -- Notes',
 		'header' => 'Contact Notes',
-		'width' => 76.2 /*mm*/,
+		'width' => 3,
 		'table' => 'PRIMARYCONTACT.notes' ),
 
 	'pcontact_address' =>  array(
 		'name' => 'Primary Contact Address -- Street',
 		'header' => 'Address',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => "CONCAT(PRIMARYCONTACTUSER.address, ' ', PRIMARYCONTACTUSER.address2)"),
 
 	'pcontact_city' =>  array(
 		'name' => 'Primary Contact Address -- City',
 		'header' => 'City',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'PRIMARYCONTACTUSER.city'),
 
 	'pcontact_province' =>  array(
 		'name' => 'Primary Contact Address -- '.$config['provincestate'],
 		'header' => $config['provincestate'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'PRIMARYCONTACTUSER.province'),
 
 	'pcontact_postal' =>  array(
 		'name' => 'Primary Contact Address -- '.$config['postalzip'],
 		'header' => $config['postalzip'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'PRIMARYCONTACTUSER.postalcode' ),
 
  	'pcontact_city_prov' =>  array(
-                'name' => 'Primary Contact Address -- City, '.$config['provincestate'].' (for mailing)',
+		'name' => 'Primary Contact Address -- City, '.$config['provincestate'].' (for mailing)',
-                'header' => 'City',
+		'header' => 'City',
-                'width' => 38.1 /*mm*/,
+		'width' => 1.5,
-                'table' => "CONCAT(PRIMARYCONTACTUSER.city, ', ', PRIMARYCONTACTUSER.province)"),
+		'table' => "CONCAT(PRIMARYCONTACTUSER.city, ', ', PRIMARYCONTACTUSER.province)"),
 
 	'judgeteamname' => array(
 		'start_option_group' => 'Judging Team',
 		'components' => array('judgingteam'),
 		'name' => 'Judging Team -- Name',
 		'header' => 'Judging Team',
-		'width' => 76.2 /*mm*/,
+		'width' => 3.0,
 		'table' => 'judges_teams.name'),
 
 	'judgeteamnum' => array(
 		'components' => array('judgingteam'),
 		'name' => 'Judging Team -- Number',
 		'header' => 'Team',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'judges_teams.num'),
 
 	'judgeteammembers_name' => array(
 		'components' => array('judgingteam', 'judgingteammembers'),
 		'name' => 'Judging Team -- Judge Name',
 		'header' => 'Judge Name',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => "CONCAT(judges.firstname, ' ', judges.lastname)"),
 
 	'judgeteammembers' => array(
 		'components' => array('judgingteam', 'judgingteammembers'),
 		'name' => 'Judging Team -- Members (REQUIRES MySQL 5.0)',
 		'header' => 'Team Members',
-		'width' => 76.2 /*mm*/,
+		'width' => 3.0,
 		'table' => "GROUP_CONCAT(judges.firstname, ' ', judges.lastname ORDER BY judges.lastname SEPARATOR ', ')",
 		'group_by' => array('award_awards.id', 'judges_teams.num') ),
 
@@ -260,28 +283,37 @@ $report_awards_fields = array(
 		'start_option_group' => 'Prize Info (Duplicates award data for each prize, omits awards with no prizes)',
 		'name' => 'Prize -- Name',
 		'header' => 'Prize Name',
-		'width' => 50.8 /*mm*/,
+		'width' => 2,
 		'table' => 'award_prizes.prize',
 		'components' => array('prizes')),
 
 	'prize_cash' => array(
 		'name' => 'Prize --  Cash Amount',
 		'header' => 'Cash',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'award_prizes.cash',
 		'components' => array('prizes')),
 
+	'prize_cash_words' => array(
+		'name' => 'Prize --  Cash Amount In Words',
+		'header' => 'Cash',
+		'width' => 0.5,
+		'table' => 'award_prizes.cash',
+		'components' => array('prizes'),
+		'exec_function' => 'report_cash_words'
+		),
+	
 	'prize_scholarship' => array(
 		'name' => 'Prize --  Scholarship Amount',
 		'header' => 'Scholarship',
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'award_prizes.scholarship',
 		'components' => array('prizes')),
 
 	'prize_value' => array(
 		'name' => 'Prize --  Value Amount',
 		'header' => 'Value',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'award_prizes.value',
 		'components' => array('prizes')),
 
@@ -289,7 +321,7 @@ $report_awards_fields = array(
 	'prize_fullname' => array(
 		'name' => 'Prize --  Name, Category, Division',
 		'header' => 'Prize Name',
-		'width' => 101.6 /*mm,
+		'width' => 4,
 		'table' => "CONCAT(award_prizes.prize,' in ',projectcategories.category,' ', projectdivisions.division)",
 		'table_sort' => 'award_prizes.order',
 		'components' => array('prizes')),
@@ -297,7 +329,7 @@ $report_awards_fields = array(
 	'prize_trophy_any' => array(
 		'name' => 'Prize -- Trophy (\'Yes\' if the award has a trophy)',
 		'header' => 'Trophy',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => "IF ( award_prizes.trophystudentkeeper=1
 				OR award_prizes.trophystudentreturn=1
 				OR award_prizes.trophyschoolkeeper=1
@@ -307,7 +339,7 @@ $report_awards_fields = array(
 	'prize_trophy_return' => array(
 		'name' => 'Prize -- Annual Trophy (\'Yes\' if the award has a school or student trophy that isn\'t a keeper)',
 		'header' => 'Trophy',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => "IF ( award_prizes.trophystudentreturn=1
 				OR award_prizes.trophyschoolreturn=1, 'Yes', 'No')",
 		'components' => array('prizes')),
@@ -315,21 +347,21 @@ $report_awards_fields = array(
 	'prize_trophy_return_student' => array(
 		'name' => 'Prize -- Annual Student Trophy (\'Yes\' if the award has astudent trophy that isn\'t a keeper)',
 		'header' => 'Ind.',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => "IF ( award_prizes.trophystudentreturn=1, 'Yes', 'No')",
 		'components' => array('prizes')),
 
 	'prize_trophy_return_school' => array(
 		'name' => 'Prize -- Annual School Trophy (\'Yes\' if the award has a school trophy that isn\'t a keeper)',
 		'header' => 'Sch.',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => "IF ( award_prizes.trophyschoolreturn=1, 'Yes', 'No')",
 		'components' => array('prizes')),
 
 	'prize_all' => array(
 		'name' => 'Prize -- Lists all prize data (name, cash, scholarship, value, trophies)',
 		'header' => 'Prize',
-		'width' => 50.8 /*mm*/,
+		'width' => 2,
 		'table' => "CONCAT(
 				IF(award_prizes.prize != '', CONCAT(award_prizes.prize,'\n', ''),''),
 				IF(award_prizes.cash != '', CONCAT('$',award_prizes.cash,'\n'), ''),
@@ -342,19 +374,6 @@ $report_awards_fields = array(
 				)",
 		'components' => array('prizes')),
 
-	/* The label system depends on each report type having conference_name and conference_logo */
-	'conference_name' =>  array(
-		'start_option_group' => 'Conference Information',
-                'name' => 'Conference -- Name',
-                'header' => 'Conference Name',
-                'width' => 76.2 /*mm*/,
-                'table' => "'".mysql_escape_string($conference['name'])."'"),
-		
-	'conference_logo' =>  array(
-		'name' => 'Conference -- Logo (for Labels only)',
-		'header' => '',
-		'width' => 1 /*mm*/,
-		'table' => "CONCAT(' ')"),
 
 );
 
@@ -363,15 +382,15 @@ $report_awards_fields = array(
  	global $config, $report_awards_fields;
 	
 	$fields = $report_awards_fields;
-	$conferenceId = $report['conference_id'];
+	$year = $report['year'];
 
 	$judges_join = '';
 	$judges_where = '';
 	if(in_array('judgingteam', $components)) {
 	   	$judges_join = 'LEFT JOIN judges_teams_awards_link ON judges_teams_awards_link.award_awards_id=award_awards.id
 				LEFT JOIN judges_teams ON judges_teams.id=judges_teams_awards_link.judges_teams_id';
-		$judges_where = "AND judges_teams_awards_link.conferences_id='$conferenceId'
+		$judges_where = "AND judges_teams_awards_link.year='$year'
-				AND judges_teams.conferences_id='$conferenceId'";
+				AND judges_teams.year='$year'";
 	}
 
 	$judges_members_join = '';
@@ -380,14 +399,14 @@ $report_awards_fields = array(
 		$judges_members_join = 'LEFT JOIN judges_teams_link ON judges_teams_link.judges_teams_id=judges_teams.id
 				LEFT JOIN judges ON judges.id=judges_teams_link.judges_id';
 
-		$judges_members_where = "AND judges_teams_link.conferences_id='$conferenceId'";
+		$judges_members_where = "AND judges_teams_link.year='$year'";
 	}
 
 	$prizes_join = '';
 	if(in_array('prizes', $components)) {
 		$prizes_join = 'LEFT JOIN award_prizes ON award_prizes.award_awards_id=award_awards.id';
 		/* Don't need a where filter, the prize is attached by unique ID to an award
-		 * that is already from the correct conference. */
+		 * that is already from the correct year. */
 	}
 
 
@@ -404,12 +423,13 @@ $report_awards_fields = array(
 			$judges_members_join
 			$prizes_join
 		WHERE
-			award_awards.conferences_id='$conferenceId'
+			award_awards.year='$year'
-			AND award_types.conferences_id='$conferenceId'
+			AND award_types.year='$year'
 			$judges_where 
 			$judges_members_where
 		";
 
 	return $q;
 }
+
 ?>

admin/reports_ceremony.php

@@ -25,9 +25,9 @@
  require("../common.inc.php");
  require_once("../user.inc.php");
  require_once('reports.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("Award Ceremony Scripts",
- 		array('Main' => 'user_main.php',
+ 		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php'),
             "print_awards_ceremony_scripts"
 			);
@@ -38,15 +38,11 @@
  echo "<tr><td><b>".i18n("Year").":</b></td><td>";
 
  //get the year information, use fairname since it should be there for all years[right?]
- /* Find our conference oid */
+ $results = $pdo->prepare("SELECT year FROM config WHERE var='fairname' AND year > 0 ORDER BY year DESC");
- $q = mysql_query("SELECT oid FROM conferences WHERE id='{$_SESSION['conferences_id']}'");
+ $results->execute();
- $c = mysql_fetch_assoc($q);
- $conferences_oid = $c['oid'];
-
- $results = mysql_query("SELECT year FROM conferences WHERE oid='$conferences_oid' AND year > 0 ORDER BY year DESC");
  
  echo "<select name=\"year\" size=1>";
- while($r=mysql_fetch_object($results)) {
+ while($r=$results->fetch(PDO::FETCH_OBJ)) {
  	echo "<option>$r->year</option>";
  }
  echo "</select></td></tr>";
@@ -65,9 +61,10 @@
  echo "<tr>";
  //list award subsets to output
  echo "<td><b>".i18n("Award Type").":</b></td> <td> <select name=\"awardtype\" size=1>";
- $results = mysql_query("SELECT type FROM award_types WHERE conferences_id=".$conference['id']." ORDER BY type");
+ $results = $pdo->prepare("SELECT type FROM award_types WHERE year=".$config['FAIRYEAR']." ORDER BY type");
+ $results->execute();
  echo "<option value=\"All\">".i18n("All")."</option>";
- while($r=mysql_fetch_object($results)) {
+ while($r=$results->fetch(PDO::FETCH_OBJ)) {
  	echo "<option value=\"$r->type\">".i18n("$r->type")."</option>";
  }
  echo "</select></td>";
@@ -97,8 +94,9 @@
 
  echo "<tr><td><b>".i18n("Include the following age categories").":</b></td>";
  echo "<td>";
- $q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='{$conference['id']}' ORDER BY id");
+ $q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='{$config['FAIRYEAR']}' ORDER BY id");
- while($r=mysql_fetch_object($q)) {
+ $q->execute();
+ while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	echo "<input name=\"show_category[{$r->id}]\" type=\"checkbox\" checked=\"checked\" />";
 	echo "".i18n($r->category)."<br />";
  }

admin/reports_committees.inc.php

@@ -23,117 +23,115 @@
 
 $report_committees_fields = array(
 	'name' =>  array(
-		'start_option_group' => 'Committee Member Name',
 		'name' => 'Committee Member -- Full Name ',
 		'header' => 'Name',
-		'width' => 44.45 /*mm*/,
+		'width' => 1.75,
 		'table' => "CONCAT(users.firstname, ' ', users.lastname)",
 		'table_sort' => 'users.lastname'),
 
 	'last_name' =>  array(
 		'name' => 'Committee Member -- Last Name',
 		'header' => 'Last Name',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'users.lastname' ),
 
 	'first_name' => array(
 		'name' => 'Committee Member -- First Name',
 		'header' => 'First Name',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'users.firstname' ),
 
 	'email' =>  array(
-		'start_option_group' => 'Committee Member Contact Information',
 		'name' => 'Committee Member -- Email',
 		'header' => 'Email',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
-		'table' => 'accounts.email'),
+		'table' => 'users.email'),
 
 	'phone_home' => array(
 		'name' => 'Committee Member -- Phone (Home)',
 		'header' => 'Phone(Home)',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'users.phonehome'),
 
 	'phone_work' => array(
 		'name' => 'Committee Member -- Phone (Work)',
 		'header' => 'Phone(Work)',
-		'width' => 31.75 /*mm*/,
+		'width' => 1.25,
 		'table' => 'users.phonework'),
 		
 	'phone_cel' => array(
-		'name' => 'Committee Member -- Phone (Cell)',
+		'name' => 'Committee Member -- Phone (Cel)',
-		'header' => 'Phone(Cell)',
+		'header' => 'Phone(Cel)',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'users.phonecell'),
 
 	'address' =>  array(
 		'name' => 'Committee Member -- Address Street',
 		'header' => 'Address',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => "CONCAT(users.address, ' ', users.address2)"),
 
 	'city' =>  array(
 		'name' => 'Committee Member -- Address City',
 		'header' => 'City',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'users.city' ),
 
 	'province' =>  array(
 		'name' => 'Committee Member -- Address '.$config['provincestate'],
 		'header' => $config['provincestate'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'users.province' ),
 
 	'postal' =>  array(
 		'name' => 'Committee Member -- Address '.$config['postalzip'],
 		'header' => $config['postalzip'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'users.postalcode' ),
 
 	'organization' => array(
-		'start_option_group' => 'Committee Member Misc.',
 		'name' => 'Committee Member -- Organization',
 		'header' => 'Organization',
-		'width' => 50.8 /*mm*/,
+		'width' => 2,
 		'table' => 'users.organization'),
 
+	'committee' => array(
+		'name' => 'Committee Member -- Committee Name',
+		'header' => 'Committee',
+		'width' => 2,
+		'table' => 'committees.name'),
+
+	'title' => array(
+		'name' => 'Committee Member -- Title on Committee',
+		'header' => 'Title',
+		'width' => 2,
+		'table' => 'committees_link.title'),
+
+	'committeetitle' => array(
+		'name' => 'Committee Member -- Committee and Title',
+		'header' => 'Committee and Title',
+		'width' => 2,
+		'table' => "CONCAT(committees.name, ' - ', committees_link.title)"),
+
 	'firstaid' => array(
 		'name' => 'Committee Member -- First Aid Training',
 		'header' => 'F.Aid',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'users.firstaid',
 		'value_map' =>array ('no' => 'no', 'yes' => 'YES')),
 
 	'cpr' => array(
 		'name' => 'Committee Member -- CPR Training',
 		'header' => 'CPR',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'users.cpr',
 		'value_map' =>array ('no' => 'no', 'yes' => 'YES')),
-
 		
-	/* The label system depends on each report type having conference_name and conference_logo */
-	'conference_name' =>  array(
-		'start_option_group' => 'Conference Information',
-                'name' => 'Conference -- Name',
-                'header' => 'Conference Name',
-                'width' => 76.2 /*mm*/,
-                'table' => "'".mysql_escape_string($conference['name'])."'"),
-
-	'conference_logo' =>  array(
-		'name' => 'Conference -- Logo (for Labels only)',
-		'header' => '',
-		'width' => 1 /*mm*/,
-		'table' => "CONCAT(' ')"),
-
 	'static_text' =>  array(
-		'start_option_group' => 'Special Fields',
 		'name' => 'Static Text (useful for labels)',
 		'header' => '',
-		'width' => 2.54 /*mm*/,
+		'width' => 0.1,
 		'table' => "CONCAT(' ')"),
-
 );
 
  function report_committees_fromwhere($report, $components)
@@ -141,10 +139,9 @@ $report_committees_fields = array(
  	global $config, $report_committees_fields;
 	
 	$fields = $report_committees_fields;
-/*
-	// if this gets unremarked for future use, then the year references will need to be updated to use conferences instead
 	$year = $report['year'];
 
+/*
 	$teams_from = '';
 	$teams_where = '';
 	if(in_array('teams', $components)) {
@@ -155,11 +152,17 @@ $report_committees_fields = array(
 				AND committees_teams.year='$year'";
 	}
 */										
-	$q = "	FROM 	users
+	$q = "	FROM 
-			LEFT JOIN user_roles on user_roles.users_id=users.id
+			committees_link
-			LEFT JOIN accounts ON accounts.id=users.accounts_id
+			JOIN committees ON committees_link.committees_id=committees.id
+			JOIN users
+				ON committees_link.users_uid=users.uid
+			LEFT OUTER JOIN users u2
+				ON u2.uid=users.uid
+				AND u2.year>users.year
 		WHERE
-			user_role.type='committee'
+			users.types LIKE '%committee%'
+			AND u2.uid IS NULL
 		";
 
 	return $q;

admin/reports_editor.php

@@ -22,9 +22,10 @@
 */
 ?>
 <?
+ 
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
 
  require_once('reports_students.inc.php');
  require_once('reports_judges.inc.php');
@@ -38,8 +39,9 @@
  require_once('reports.inc.php');
  require_once('../tcpdf.inc.php');
 
+
  $fields = array();
- $locs = array('X' => 'x', 'Y' => 'y', 'W' => 'w', 'H' => 'h');
+ $locs = array('X' => 'x', 'Y' => 'y', 'W' => 'w', 'H' => 'h', 'Lines' => 'lines');
 
  function field_selector($name, $id, $selected)
  {
@@ -53,6 +55,10 @@
 			if($in_optgroup) echo '</optgroup>';
 			echo '<optgroup label="'.i18n($f['start_option_group']).'">';
 		}
+		if($f['name']=='Project -- Type'){										//filter out if the configuration setting does not allow for the project type
+			global $config;
+			if($config['project_type']=='no') continue;
+		}
 		$sel = ($selected == $k) ? 'selected=\"selected\"': '' ;
         	echo "<option value=\"$k\" $sel >{$f['name']}</option>";
 	}	
@@ -64,7 +70,7 @@
  {
 	echo "<select name=\"$name\" $onchange >";
 	foreach($a as $v=>$val) {
-		$sel = ($selected == $v) ? 'selected=\"selected\"' : '';
+		$sel = ($selected == $v) ? 'selected=selected' : '';
 		echo "<option value=\"$v\" $sel>$val</option>";
 	}
 	echo '</select>';
@@ -175,7 +181,7 @@
  }
 
 
- send_header("Report Management",
+ send_header("Reports Editor",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php'),
             "report_management"
@@ -203,7 +209,53 @@ function initCanvas(w,h,lw,lh) {
 	labelHeight=lh;
 }
 
-function createData(x,y,w,h,align,valign,fontname,fontstyle,fontsize,value) {
+function createData(x,y,w,h,l,face,align,valign,value) {
+	var canvas=document.getElementById('layoutcanvas');
+	var newdiv=document.createElement('div');
+	if(valign=="vcenter") verticalAlign="middle";
+	else if(valign=="vtop") verticalAlign="top";
+	else if(valign=="vbottom") verticalAlign="bottom";
+	else verticalAlign="top";
+//	alert(verticalAlign);
+
+	//convert x,y,w,h from % to absolute
+
+	var dx=Math.round(x*canvasWidth/100);
+	var dy=Math.round(y*canvasHeight/100);
+	var dw=Math.round(w*canvasWidth/100);
+	var dh=Math.round(h*canvasHeight/100);
+//	alert(dx+','+dy+','+dw+','+dh);
+
+	var fontheight=Math.round(dh/l);
+
+	newdiv.setAttribute('id','o_'+canvasObjectIndex);
+	newdiv.style.display="table-cell";
+	newdiv.style.position="absolute";
+	newdiv.style.width=dw+"px";
+	newdiv.style.height=dh+"px";
+	newdiv.style.left=dx+"px";
+	newdiv.style.top=dy+"px";
+	newdiv.style.textAlign=align;
+	newdiv.style.verticalAlign=verticalAlign;
+	newdiv.style.padding="0 0 0 0";
+	newdiv.style.margin="0 0 0 0";
+//	newdiv.style.vertical-align=valign;
+	newdiv.style.border="1px solid blue";
+	newdiv.style.fontSize=fontheight+"px";
+	newdiv.style.lineHeight=fontheight+"px";
+	newdiv.style.fontFamily="Verdana";
+	newdiv.style.fontSizeAdjust=0.65;
+
+	var maxlength=Math.floor(dw/(fontheight*0.7))*l;
+	if(value.length>maxlength) value=value.substring(0,maxlength);
+	newdiv.innerHTML=value; //"Maple Test xxxx"; //value;
+
+	canvas.appendChild(newdiv);
+
+	canvasObjectIndex++;
+}
+
+function createDataTCPDF(x,y,w,h,align,valign,fontname,fontstyle,fontsize,value) {
 
 	var canvas=document.getElementById('layoutcanvas');
 	var newdiv=document.createElement('div');
@@ -271,13 +323,14 @@ function createData(x,y,w,h,align,valign,fontname,fontstyle,fontsize,value) {
 
  if($repaction == 'export') {
  	echo "<pre>";
-	$q = mysql_query("SELECT system_report_id FROM reports WHERE 1 ORDER BY system_report_id DESC");
+	$q = $pdo->prepare("SELECT system_report_id FROM reports WHERE 1 ORDER BY system_report_id DESC");
-	$r = mysql_fetch_assoc($q);
+	$q->execute();
+	$r = $q->fetch(PDO::FETCH_ASSOC);
 	$sid = $r['system_report_id'] + 1;
-	$n = mysql_escape_string($report['name']);
+	$n = $report['name'];
-	$c = mysql_escape_string($report['creator']);
+	$c = $report['creator'];
-	$d = mysql_escape_string($report['desc']);
+	$d = $report['desc'];
-	$t = mysql_escape_string($report['type']);
+	$t = $report['type'];
 
  	echo "INSERT INTO `reports` (`id`, `system_report_id`, `name`, `desc`, `creator`, `type`) VALUES\n";
 	echo "\t('', '$sid', '$n', '$d', '$c', '$t');\n";
@@ -287,7 +340,7 @@ function createData(x,y,w,h,align,valign,fontname,fontstyle,fontsize,value) {
 	/* Do the options */
 	$x = 0;
 	foreach($report['option'] as $k=>$v) {
-		echo "\n\t('', LAST_INSERT_ID(), 'option', $x, '$k', '$v', 0, 0, 0, 0, 0, '', ''),";
+		echo "\n\t('', LAST_INSERT_ID(), 'option', $x, '$k', '".$v."', 0, 0, 0, 0, 0, '', ''),";
 		$x++;
 	}
 	/* Do the fields */
@@ -304,7 +357,7 @@ function createData(x,y,w,h,align,valign,fontname,fontstyle,fontsize,value) {
 			if($vlines == 0) $vlines = 1;
 			$face = $v['face'];
 			$align = $v['align']. ' ' . $v['valign'];
-			$value=mysql_escape_string(stripslashes($v['value']));
+			$value= stripslashes($v['value']);
 			if(!$first) echo ',';
 			$first = false;
 			echo "\n\t('', LAST_INSERT_ID(), '$f', $x, '$k', '$value', $vx, $vy, $vw, $vh, $vlines, '$face', '$align')";
@@ -405,10 +458,10 @@ function createData(x,y,w,h,align,valign,fontname,fontstyle,fontsize,value) {
  echo "</table>\n";
  
 $doCanvasSample = false;
+$doCanvasSampletcpdf = false;
  $l_w=$report_stock[$report['option']['stock']]['label_width'];
  $l_h=$report_stock[$report['option']['stock']]['label_height'];
-
+ if($l_w && $l_h && $report['option']['type']=="label") {
- if($l_w && $l_h && $report['option']['type']=='label') {
      echo "<h4>Label Data Locations</h4>";
 
 	$doCanvasSample=true;
@@ -420,10 +473,26 @@ $doCanvasSample = false;
 	echo "<script type=\"text/javascript\">initCanvas($canvaswidth,$canvasheight,$l_w,$l_h)</script>\n";
  }
 
+ if($l_w && $l_h && $report['option']['type']=="tcpdf_label") {
+     echo "<h4>Label Data Locations - TCPDF</h4>";
 
+	$l_w *= 25.4; 
+	$l_h *= 25.4; 
+	$doCanvasSampletcpdf=true;
+	$ratio=$l_h/$l_w;
+	$canvaswidth=600;
+	$canvasheight=round($canvaswidth*$ratio);
+	echo "<div id=\"layoutcanvas\" style=\"border: 1px solid red; position: relative; width: {$canvaswidth}px; height: {$canvasheight}px;\">";
+	echo "</div>\n";
+	echo "<script type=\"text/javascript\">initCanvas($canvaswidth,$canvasheight,$l_w,$l_h)</script>\n";
+ }
+
+
+ echo "<table>";
  $x=0;
+
  
- if($report['option']['type'] == 'label') {
+ if($report['option']['type'] == 'label' || $report['option']['type'] == 'tcpdf_label') {
  	$fontlist = array('' => 'Default');
 	$fl = PDF::getFontList();
 	foreach($fl as $f) $fontlist[$f] = $f;
@@ -431,27 +500,38 @@ $doCanvasSample = false;
 			  
  	foreach($report['col'] as $o=>$d) {
 		$f = $d['field'];
-		echo "<b>{$fields[$d['field']]['name']}: </b><br/>";
+		echo "<tr><td align=\"right\">Loc ".($o+1).": </td>";
+		echo "<td>";
 		$script="";
 		foreach($locs as $k=>$v) {
-			echo "$k=<input type=\"text\" size=\"5\" name=\"col[$x][$v]\" value=\"{$d[$v]}\">";
+			if($k=='Lines' && $report['option']['type'] != 'label') continue;
+			echo "$k=<input type=\"text\" size=\"3\" name=\"col[$x][$v]\" value=\"{$d[$v]}\">";
 			$script.="{$d[$v]},";
 		}
 
+		if($report['option']['type'] == 'label') {
+			echo 'Face=';
+			selector("col[$x][face]", array('' => '', 'bold' => 'Bold'), $d['face']);
+		}
 		echo 'Align';
 		selector("col[$x][align]", array('center' => 'Center', 'left' => 'Left', 'right' => 'Right'), 
 				$d['align']);
 		echo 'vAlign';
-		selector("col[$x][valign]", array('middle' => 'Middle', 'top' => 'Top', 'bottom' => 'Bottom'), 
+		if($report['option']['type'] == 'label') {
-				$d['valign']);
+			selector("col[$x][valign]", array('vcenter' => 'Center', 'vtop' => 'Top', 'vbottom' => 'Bottom'), 
-		echo '<br/>';	
+					$d['valign']);
-		echo 'Font=';
+		} else {
-		selector("col[$x][fontname]", $fontlist, $d['fontname']);
+			selector("col[$x][valign]", array('middle' => 'Middle', 'top' => 'Top', 'bottom' => 'Bottom'), 
-		selector("col[$x][fontstyle]", array('' => '', 'bold' => 'Bold'), $d['fontstyle']);
+					$d['valign']);
-		echo "<input type=\"text\" size=\"3\" name=\"col[$x][fontsize]\" value=\"{$d['fontsize']}\">";
+			
-		echo 'pt  ';
+			echo 'Font=';
-		echo 'OnOverflow=';
+			selector("col[$x][fontname]", $fontlist, $d['fontname']);
-		selector("col[$x][on_overflow]", array('nothing'=>'Nothing (overflow the box)', 'truncate'=>'Truncate','...'=>'Truncate and add ellipses (...)', 'scale'=>'Scale'), $d['on_overflow']);
+			selector("col[$x][fontstyle]", array('' => '', 'bold' => 'Bold'), $d['fontstyle']);
+			echo "<input type=\"text\" size=\"3\" name=\"col[$x][fontsize]\" value=\"{$d['fontsize']}\">";
+			echo 'pt  ';
+			echo 'OnOverflow=';
+			selector("col[$x][on_overflow]", array('tuncate'=>'Truncate','...'=>'Add ...', 'scale'=>'Scale'), $d['on_overflow']);
+		}
 
 		if($f == 'static_text') {
 			echo "<br />Text=<input type=\"text\" size=\"40\" name=\"col[$x][value]\" value=\"{$d['value']}\">";
@@ -459,45 +539,56 @@ $doCanvasSample = false;
 			echo "<input type=\"hidden\" name=\"col[$x][value]\" value=\"\">";
 		}
 		if($doCanvasSample)
-			echo "<script type=\"text/javascript\">createData({$script}'{$d['align']}','{$d['valign']}','{$d['fontname']}','{$d['fontstyle']}','{$d['fontsize']}','{$canvasLabels[$x]}')</script>\n";
+			echo "<script type=\"text/javascript\">createData({$script}'{$d['face']}','{$d['align']}','{$d['valign']}','{$canvasLabels[$x]}')</script>\n";
+		if($doCanvasSampletcpdf)
+			echo "<script type=\"text/javascript\">createDataTCPDF({$script}'{$d['align']}','{$d['valign']}','{$d['fontname']}','{$d['fontstyle']}','{$d['fontsize']}','{$canvasLabels[$x]}')</script>\n";
 
 		$x++;
-		echo '<br/><br/>';
 	}
  	for(;$x<$n_columns;$x++) {
-		echo "<b>New Column ".($x+1).": </b><br/> ";
+		echo "<tr><td align=\"right\">Loc ".($x+1).": </td>";
+		echo "<td>";
 		foreach($locs as $k=>$v) {
-			echo "$k=<input type=\"text\" size=\"5\" name=\"col[$x][$v]\" value=\"0\">";
+			if($k=='Lines' && $report['option']['type'] != 'label') continue;
+			echo "$k=<input type=\"text\" size=\"3\" name=\"col[$x][$v]\" value=\"0\">";
+		}
+		if($report['option']['type'] == 'label') {
+			echo 'Face=';
+			selector("col[$x][face]", array('' => '', 'bold' => 'Bold'), '');
 		}
 
 		echo 'Align';
 		selector("col[$x][align]", array('center' => 'Center', 'left' => 'Left', 'right' => 'Right'), 
 				'center');
 		echo 'vAlign';
-		selector("col[$x][valign]", array('middle' => 'Middle', 'top' => 'Top', 'bottom' => 'Bottom'), 'middle');
+		if($report['option']['type'] == 'label') {
+			selector("col[$x][valign]", array('vcenter' => 'Center', 'vtop' => 'Top', 'vbottom' => 'Bottom'), 
+					'top');
+		} else {
+			selector("col[$x][valign]", array('middle' => 'Middle', 'top' => 'Top', 'bottom' => 'Bottom'), 'middle');
 			
-		echo '<br/>';	
+			echo 'Font=';
-		echo 'Font=';
+			selector("col[$x][fontname]", $fontlist, '');
-		selector("col[$x][fontname]", $fontlist, '');
+			selector("col[$x][fontstyle]", array('' => '', 'bold' => 'Bold'), '');
-		selector("col[$x][fontstyle]", array('' => '', 'bold' => 'Bold'), '');
+			echo "<input type=\"text\" size=\"3\" name=\"col[$x][fontsize]\" value=\"\">";
-		echo "<input type=\"text\" size=\"3\" name=\"col[$x][fontsize]\" value=\"\">";
+			echo 'pt  ';
-		echo 'pt  ';
+			echo 'OnOverflow=';
-		echo 'OnOverflow=';
+			selector("col[$x][on_overflow]", array('Truncate'=>'truncate','Add ...'=>'...', 'Scale'=>'scale'),'');
-		selector("col[$x][on_overflow]", array('nothing'=>'Nothing (overflow the box)', 'truncate'=>'Truncate','...'=>'Truncate and add ellipses (...)', 'scale'=>'Scale'),'truncate');
+		}
-
 		echo "<input type=\"hidden\" name=\"col[$x][value]\" value=\"\">";
-		echo "<br/><br/>"; 
+		echo "</td></tr>"; 
 	}
  }
+ echo "</table>\n";
  echo "<h4>Grouping</h4>";
- for($x=0;$x<2;$x++) {
+ for($x=0;$x<3;$x++) {
 	echo "Group By".($x + 1).": ";
 	$f = $report['group'][$x]['field'];
 	field_selector("group[$x]", "group$x", $f);
 	echo "<br />"; 
  }
  echo "<h4>Sorting</h4>";
- for($x=0;$x<3;$x++) {
+ for($x=0;$x<5;$x++) {
 	echo "Sort By".($x + 1).": ";
 	$f = $report['sort'][$x]['field'];
 	field_selector("sort[$x]", "sort$x",$f); 

admin/reports_fairs.inc.php

@@ -20,396 +20,379 @@
    Boston, MA 02111-1307, USA.
 */
 
-$parts = explode('-', $config['dates']['fairdate']);
-$fairYear = $parts[0];
 $report_fairs_fields = array(
 
-	'fairinfo_name' =>  array(
+	'fair_name' =>  array(
-		'start_option_group' => 'Fair Information',
 		'name' => 'Fair -- Fair Name',
 		'header' => 'Name',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'fairs.name'),
 
 	'fairstats_year' => array (
-		'start_option_group' => 'Fair Statistics',
 		'name' => 'Fair Stats -- Year',
 		'header' => 'Year',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.year',
 		'components' => array('fairs_stats')),
 
 	'fairstats_year' => array (
 		'name' => 'Fair Stats -- Year',
 		'header' => 'Year',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.year',
 		'components' => array('fairs_stats')),
 
 	'fairstats_start_date' => array (
 		'name' => 'Fair Stats -- Fair Start',
 		'header' => 'Fair Start',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.start_date',
 		'components' => array('fairs_stats')), 
 
 	'fairstats_end_date' => array (
 		'name' => 'Fair Stats -- Fair End',
 		'header' => 'Fair End',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.end_date',
 		'components' => array('fairs_stats')), 
 
 	'fairstats_budget' => array (
 		'name' => 'Fair Stats -- Budget',
 		'header' => 'Budget',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.budget',
 		'components' => array('fairs_stats')), 
 
 	'fairstats_address' => array (
 		'name' => 'Fair Stats -- Fair Location',
 		'header' => 'Fair Location',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.address',
 		'components' => array('fairs_stats')), 
 	'fairstats_ysf_affiliation_complete' => array (
 		'name' => 'Fair Stats -- YSC Affilitation Complete',
 		'header' => 'YSC Affilitation Complete',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.ysf_affiliation_complete',
 		'components' => array('fairs_stats')), 
 	'fairstats_charity' => array (
 		'name' => 'Fair Stats -- Charity Number/Info',
 		'header' => 'Charity Number/Info',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.charity',
 		'components' => array('fairs_stats')), 
 	'fairstats_scholarships' => array (
 		'name' => 'Fair Stats -- Scholarship Info',
 		'header' => 'Scholarship Info',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.scholarships',
 		'components' => array('fairs_stats')), 
 	'fairstats_male_1' => array (
 		'name' => 'Fair Stats -- Males Grade 1-3',
 		'header' => 'Males Grade 1-3',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.male_1',
 		'components' => array('fairs_stats')), 
 	'fairstats_male_4' => array (
 		'name' => 'Fair Stats -- Males Grade 4-6',
 		'header' => 'Males Grade 4-6',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.male_4',
 		'components' => array('fairs_stats')), 
 	'fairstats_male_7' => array (
 		'name' => 'Fair Stats -- Males Grade 7-8',
 		'header' => 'Males Grade 7-8',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.male_7',
 		'components' => array('fairs_stats')), 
 	'fairstats_male_9' => array (
 		'name' => 'Fair Stats -- Males Grade 9-10',
 		'header' => 'Males Grade 9-10',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.male_9',
 		'components' => array('fairs_stats')), 
 	'fairstats_male_11' => array (
 		'name' => 'Fair Stats -- Males Grade 11-12',
 		'header' => 'Males Grade 11-12',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.male_11',
 		'components' => array('fairs_stats')), 
 	'fairstats_female_1' => array (
 		'name' => 'Fair Stats -- Females Grade 1-3',
 		'header' => 'Females Grade 1-3',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.female_1',
 		'components' => array('fairs_stats')), 
 	'fairstats_female_4' => array (
 		'name' => 'Fair Stats -- Females Grade 4-6',
 		'header' => 'Females Grade 4-6',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.female_4',
 		'components' => array('fairs_stats')), 
 	'fairstats_female_7' => array (
 		'name' => 'Fair Stats -- Females Grade 7-8',
 		'header' => 'Females Grade 7-8',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.female_7',
 		'components' => array('fairs_stats')), 
 	'fairstats_female_9' => array (
 		'name' => 'Fair Stats -- Females Grade 9-10',
 		'header' => 'Females Grade 9-10',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.female_9',
 		'components' => array('fairs_stats')), 
 	'fairstats_female_11' => array (
 		'name' => 'Fair Stats -- Females Grade 11-12',
 		'header' => 'Females Grade 11-12',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.female_11',
 		'components' => array('fairs_stats')), 
 	'fairstats_projects_1' => array (
 		'name' => 'Fair Stats -- Projects Grade 1-3',
 		'header' => 'Projects Grade 1-3',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.projects_1',
 		'components' => array('fairs_stats')), 
 	'fairstats_projects_4' => array (
 		'name' => 'Fair Stats -- Projects Grade 4-6',
 		'header' => 'Projects Grade 4-6',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.projects_4',
 		'components' => array('fairs_stats')), 
 	'fairstats_projects_7' => array (
 		'name' => 'Fair Stats -- Projects Grade 7-8',
 		'header' => 'Projects Grade 7-8',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.projects_7',
 		'components' => array('fairs_stats')), 
 	'fairstats_projects_9' => array (
 		'name' => 'Fair Stats -- Projects Grade 9-10',
 		'header' => 'Projects Grade 9-10',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.projects_9',
 		'components' => array('fairs_stats')), 
 	'fairstats_projects_11' => array (
 		'name' => 'Fair Stats -- Projects Grade 11-12',
 		'header' => 'Projects Grade 11-12',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.projects_11',
 		'components' => array('fairs_stats')), 
 	'fairstats_firstnations' => array (
 		'name' => 'Fair Stats -- First Nations Students',
 		'header' => 'First Nations Students',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.firstnations',
 		'components' => array('fairs_stats')), 
 	'fairstats_students_atrisk' => array (
 		'name' => 'Fair Stats -- Inner City Students',
 		'header' => 'Inner City Students',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.students_atrisk',
 		'components' => array('fairs_stats')), 
 	'fairstats_schools_atrisk' => array (
 		'name' => 'Fair Stats -- Inner City Schools',
 		'header' => 'Inner City Schools',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.schools_atrisk',
 		'components' => array('fairs_stats')), 
 	'fairstats_students_total' => array (
 		'name' => 'Fair Stats -- Total Participants',
 		'header' => 'Total Participants',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.students_total',
 		'components' => array('fairs_stats')), 
 	'fairstats_schools_total' => array (
 		'name' => 'Fair Stats -- Total Schools',
 		'header' => 'Total Schools',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.schools_total',
 		'components' => array('fairs_stats')), 
 	'fairstats_schools_active' => array (
 		'name' => 'Fair Stats -- Active Schools',
 		'header' => 'Active Schools',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.schools_active',
 		'components' => array('fairs_stats')), 
 	'fairstats_students_public' => array (
 		'name' => 'Fair Stats -- Participants from Public',
 		'header' => 'Participants from Public',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.students_public',
 		'components' => array('fairs_stats')), 
 	'fairstats_schools_public' => array (
 		'name' => 'Fair Stats -- Public Schools',
 		'header' => 'Public Schools',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.schools_public',
 		'components' => array('fairs_stats')), 
 	'fairstats_students_private' => array (
 		'name' => 'Fair Stats -- Participants from Independent',
 		'header' => 'Participants from Independent',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.students_private',
 		'components' => array('fairs_stats')), 
 	'fairstats_schools_private' => array (
 		'name' => 'Fair Stats -- Independent Schools',
 		'header' => 'Independent Schools',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.schools_private',
 		'components' => array('fairs_stats')), 
 	'fairstats_schools_districts' => array (
 		'name' => 'Fair Stats -- School Districts',
 		'header' => 'School Districts',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.schools_districts',
 		'components' => array('fairs_stats')), 
 	'fairstats_studentsvisiting' => array (
 		'name' => 'Fair Stats -- Students Visiting',
 		'header' => 'Students Visiting',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.studentsvisiting',
 		'components' => array('fairs_stats')), 
 	'fairstats_publicvisiting' => array (
 		'name' => 'Fair Stats -- Public Guests Visting',
 		'header' => 'Public Guests Visting',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.publicvisiting',
 		'components' => array('fairs_stats')), 
 	'fairstats_teacherssupporting' => array (
 		'name' => 'Fair Stats -- Teachers Supporting Projects',
 		'header' => 'Teachers Supporting Projects',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.teacherssupporting',
 		'components' => array('fairs_stats')), 
 	'fairstats_increasedinterest' => array (
 		'name' => 'Fair Stats -- Students Increased Interest in Science',
 		'header' => 'Students Increased Interest in Science',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.increasedinterest',
 		'components' => array('fairs_stats')), 
 	'fairstats_consideringcareer' => array (
 		'name' => 'Fair Stats -- Students Considering Career in Science',
 		'header' => 'Students Considering Career in Science',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.consideringcareer',
 		'components' => array('fairs_stats')), 
 	'fairstats_committee_members' => array (
 		'name' => 'Fair Stats -- Committee Members',
 		'header' => 'Committee Members',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.committee_members',
 		'components' => array('fairs_stats')), 
 	'fairstats_judges' => array (
 		'name' => 'Fair Stats -- Judges',
 		'header' => 'Judges',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.judges',
 		'components' => array('fairs_stats')), 
 	'fairstats_next_chair_name' => array (
 		'name' => 'Fair Stats -- Regional Chairperson Name',
 		'header' => 'Regional Chairperson Name',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.next_chair_name',
 		'components' => array('fairs_stats')), 
 	'fairstats_next_chair_email' => array (
 		'name' => 'Fair Stats -- Email',
 		'header' => 'Email',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.next_chair_email',
 		'components' => array('fairs_stats')), 
 	'fairstats_next_chair_hphone' => array (
 		'name' => 'Fair Stats -- Home Phone',
 		'header' => 'Home Phone',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.next_chair_hphone',
 		'components' => array('fairs_stats')), 
 	'fairstats_next_chair_bphone' => array (
 		'name' => 'Fair Stats -- Business Phone',
 		'header' => 'Business Phone',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.next_chair_bphone',
 		'components' => array('fairs_stats')), 
 	'fairstats_next_chair_fax' => array (
 		'name' => 'Fair Stats -- Fax',
 		'header' => 'Fax',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.next_chair_fax',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate1' => array (
 		'name' => 'Fair Stats -- Delegate 1',
 		'header' => 'Delegate 1',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate1',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate2' => array (
 		'name' => 'Fair Stats -- Delegate 2',
 		'header' => 'Delegate 2',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate2',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate3' => array (
 		'name' => 'Fair Stats -- Delegate 3',
 		'header' => 'Delegate 3',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate3',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate4' => array (
 		'name' => 'Fair Stats -- Delegate 4',
 		'header' => 'Delegate 4',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate4',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate1_email' => array (
 		'name' => 'Fair Stats -- Delegate 1 Email',
 		'header' => 'Delegate 1 Email',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate1_email',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate2_email' => array (
 		'name' => 'Fair Stats -- Delegate 2 Email',
 		'header' => 'Delegate 2 Email',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate2_email',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate3_email' => array (
 		'name' => 'Fair Stats -- Delegate 3 Email',
 		'header' => 'Delegate 3 Email',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate3_email',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate4_email' => array (
 		'name' => 'Fair Stats -- Delegate 4 Email',
 		'header' => 'Delegate 4 Email',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate4_email',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate1_size' => array (
 		'name' => 'Fair Stats -- Delegate 1 Jacket Size',
 		'header' => 'Delegate 1 Jacket Size',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate1_size',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate2_size' => array (
 		'name' => 'Fair Stats -- Delegate 2 Jacket Size',
 		'header' => 'Delegate 2 Jacket Size',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate2_size',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate3_size' => array (
 		'name' => 'Fair Stats -- Delegate 3 Jacket Size',
 		'header' => 'Delegate 3 Jacket Size',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate3_size',
 		'components' => array('fairs_stats')), 
 	'fairstats_delegate4_size' => array (
 		'name' => 'Fair Stats -- Delegate 4 Jacket Size',
 		'header' => 'Delegate 4 Jacket Size',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'fairs_stats.delegate4_size',
 		'components' => array('fairs_stats')), 
 
-	/* The label system depends on each report type having conference_name and conference_logo */
-	'conference_name' =>  array(
-		'start_option_group' => 'Local Conference Information',
-                'name' => 'Conference -- Name',
-                'header' => 'Conference Name',
-                'width' => 76.2 /*mm*/,
-                'table' => "'".mysql_escape_string($conference['name'])."'"),
-
-	'conference_logo' =>  array(
-		'name' => 'Conference -- Logo (for Labels only)',
-		'header' => '',
-		'width' => 1 /*mm*/,
-		'table' => "CONCAT(' ')"),
 
 	'static_text' => array (
 		'name' => 'Static Text (useful for labels)',
 		'header' => '',
-		'width' => 2.54 /*mm*/,
+		'width' => 0.1,
 		'table' => "CONCAT(' ')"),
 
 );
@@ -419,19 +402,19 @@ $report_fairs_fields = array(
  	global $config, $report_fairs_fields;
 	
 	$fields = $report_fairs_fields;
-	$conferences_id = $report['conferences_id'];
+	$year = $report['year'];
 
 	if(in_array('fairs_stats', $components)) {
 		$fs_from = 'LEFT JOIN fairs_stats ON fairs_stats.fairs_id=fairs.id';
-		$fs_where = "fairs_stats.conferences_id='$conferences_id' AND";
+		$fs_where = "fairs_stats.year='$year'";
 
 	}
 
 	$q = "	FROM 	fairs 
 			$fs_from
 		WHERE
+			1 AND 
 			$fs_where
-			1
 		";
 
 	return $q;

admin/reports_fundraising.inc.php

@@ -24,12 +24,14 @@
 
 /* Take the language array in users_fundraising, unserialize it, and join it
  * with a space */
-function report_fundraisings_languages(&$report, $field, $text)
+function report_fundraisings_languages($report, $field, $text)
 {
 		$l = unserialize($text);
 		return join(' ', $l);
 }
 
+
+
 /* Components: */
 /* Yes, fundraisings, the generator takes the report type (also the user.type in many cases) and
  * just adds an 's' to find the fields and the functions. */
@@ -38,21 +40,21 @@ $report_fundraisings_fields = array(
 		'start_option_group' => 'Campaign ID',
 		'name' => 'Fundraising Campaign numerical ID',
 		'header' => 'ID',
-		'width' => 6.35 /*mm*/,
+		'width' => 0.25,
 		'table' => "fundraising_campaigns.id"),
 	
 	'salutation' =>  array(
 		'start_option_group' => 'Contact Information',
 		'name' => 'Contact -- Salutation (Mr., Mrs., etc.)',
 		'header' => 'Sal',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => "users.salutation",
 		'components' => array('users') ),
 
 	'namefl' =>  array(
 		'name' => 'Contact -- Full Name (first last)',
 		'header' => 'Name',
-		'width' => 44.45 /*mm*/,
+		'width' => 1.75,
 		'table' => "CONCAT(users.firstname, ' ', users.lastname)",
 		'table_sort'=> 'users.lastname',
 		'components' => array('users') ),
@@ -60,35 +62,35 @@ $report_fundraisings_fields = array(
 	'email' =>  array(
 		'name' => 'Contact -- Email',
 		'header' => 'Email',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => 'users.email',
 		'components' => array('users') ),
 
 	'phone_home' => array(
 		'name' => 'Contact -- Phone (Home)',
 		'header' => 'Phone(Home)',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'users.phonehome',
 		'components' => array('users') ),
 
 	'phone_work' => array(
 		'name' => 'Contact -- Phone (Work)',
 		'header' => 'Phone(Work)',
-		'width' => 31.75 /*mm*/,
+		'width' => 1.25,
 		'table' => "users.phonework",
 		'components' => array('users') ),
 
 	'organization' => array(
 		'name' => 'Contact -- Organization',
 		'header' => 'Organization',
-		'width' => 50.8 /*mm*/,
+		'width' => 2,
 		'table' => 'users.organization',
 		'components' => array('users') ),
 
 	'position' => array(
 		'name' => 'Contact -- Position',
 		'header' => 'Position',
-		'width' => 50.8 /*mm*/,
+		'width' => 2,
 		'table' => 'users_sponsor.position',
 		'components' => array('users') ),
 
@@ -96,72 +98,58 @@ $report_fundraisings_fields = array(
 		'start_option_group' => 'Contact Address',
 		'name' => 'Contact Address -- Street',
 		'header' => 'Address',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => "CONCAT(users.address, ' ', users.address2)",
 		'components' => array('users') ),
 
 	'city' =>  array(
 		'name' => 'Contact Address -- City',
 		'header' => 'City',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'users.city',
 		'components' => array('users') ),
 
 	'province' =>  array(
 		'name' => 'Contact Address -- '.$config['provincestate'],
-			'header' => $config['provincestate'],
+		'header' => $config['provincestate'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'users.province',
 		'components' => array('users') ),
 
 	'postal' =>  array(
 		'name' => 'Contact Address -- '.$config['postalzip'],
 		'header' => $config['postalzip'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'users.postalcode' ,
 		'components' => array('users') ),
 
        'city_prov' =>  array(
                 'name' => 'Contact Address -- City, '.$config['provincestate'].' (for mailing)',
                 'header' => 'City',
-                'width' => 38.1 /*mm*/,
+                'width' => 1.5,
                 'table' => "CONCAT(users.city, ', ', users.province)",
 		'components' => array('users') ),
-/* // FIXME - not sure what to do with these options, converting from years to conferences	
+	
 	'year' =>  array(
 		'start_option_group' => 'Miscellaneous',
 		'name' => 'Contact -- Year',
 		'header' => 'Year',
-		'width' => 12.7 //mm,
+		'width' => 0.5,
 		'table' => 'users.year',
 		'components' => array('users') ),
 
 	'user_filter' => array(
 		'name' => 'User Filter by MAX(year)',
 		'header' => '',
-		'width' => 2.54 //mm,
+		'width' => 0.1,
 		'table' => 'MAX(users.year)',
-		'group_by' => array('users.accounts_id'),
+		'group_by' => array('users.uid'),
 		'components' => array('users') ),
-*/
+
 	'static_text' =>  array(
 		'name' => 'Static Text (useful for labels)',
 		'header' => '',
-		'width' => 2.54 /*mm*/,
+		'width' => 0.1,
-		'table' => "CONCAT(' ')"),
-
-	/* The label system depends on each report type having conference_name and conference_logo */
-	'conference_name' =>  array(
-		'start_option_group' => 'Conference Information',
-                'name' => 'Conference -- Name',
-                'header' => 'Conference Name',
-                'width' => 76.2 /*mm*/,
-                'table' => "'".mysql_escape_string($conference['name'])."'"),
-
-	'conference_logo' =>  array(
-		'name' => 'Conference -- Logo (for Labels only)',
-		'header' => '',
-		'width' => 1 /*mm*/,
 		'table' => "CONCAT(' ')"),
 
 );
@@ -171,21 +159,16 @@ $report_fundraisings_fields = array(
  	global $config, $report_fundraisings_fields;
 	
 	$fields = $report_fundraisings_fields;
-//	$conferences_id = $report['conferences_id'];
+	$year = $report['year'];
 
 	if(in_array('users', $components)) {
 		$users_from = 'LEFT JOIN fundraising_campaigns_users_link ON fundraising_campaigns.id=fundraising_campaigns_users_link.fundraising_campaigns_id
-				LEFT JOIN users ON users.accounts_id=fundraising_campaigns_users_link.users_uid
+				LEFT JOIN users ON users.uid=fundraising_campaigns_users_link.users_uid
 				LEFT JOIN users_sponsor ON users_sponsor.users_id=users.id';
 		$users_where = "users.deleted!='yes' AND";
 	}
 
 /*
-	// this chunk of code was already remarked when updating the system to use conferences
-	// instead of fair years.  If it gets re-used however, then it will need to be updated
-	// accordingly.  Not sure as I write this comment how the fundraising years will link
-	// to the conferences, rather than to the fair years that were previously used.
-
 	$teams_from = '';
 	$teams_where = '';
 	if(in_array('teams', $components)) {

admin/reports_gen.php

@@ -22,33 +22,29 @@
 */
 ?>
 <?
-require_once("../common.inc.php");
+ require_once("../common.inc.php");
-require_once("../user.inc.php");
+ require_once("../user.inc.php");
-user_auth_required('admin');
+ user_auth_required('committee', 'admin');
-require_once('reports.inc.php');
+ require_once('reports.inc.php');
 
+ 
+ $id = intval($_GET['id']);
+ $type = stripslashes($_GET['type']);
+ $stock = stripslashes($_GET['stock']);
+ $year = intval($_GET['year']);
+ $include_incomplete_registrations = ($_GET['include_incomplete_registrations'] == 'yes') ? 'yes' : '';
+ $show_options = array_key_exists('show_options', $_GET);
+ if($year < 1000) $year = $config['FAIRYEAR'];
 
-$id = intval($_GET['id']);
+ /* If it's a system report, turn that into the actual report id */
-$type = $_GET['type'];
+ if(array_key_exists('sid', $_GET)) {
-$stock = $_GET['stock'];
+ 	$sid = intval($_GET['sid']);
-if(array_key_exists('conferences_id', $_GET)){
+ 	$q = $pdo->prepare("SELECT id FROM reports WHERE system_report_id='$sid'");
-	$conferences_id = intval($_GET['conferences_id']);
+	$q->execute();
-	$result = mysql_result(mysql_query("SELECT COUNT(*) FROM conferences WHERE id = $conferences_id"), 0);
+	$r = $q->fetch(PDO::FETCH_OBJ);
-	if($result != 1) $conferences_id = $conference['id'];
-}else{
-	$conferences_id = $conference['id'];
-}
-$include_incomplete_registrations = ($_GET['include_incomplete_registrations'] == 'yes') ? 'yes' : '';
-$show_options = array_key_exists('show_options', $_GET);
-
-/* If it's a system report, turn that into the actual report id */
-if(array_key_exists('sid', $_GET)) {
-	$sid = intval($_GET['sid']);
-	$q = mysql_query("SELECT id FROM reports WHERE system_report_id='$sid'");
-	$r = mysql_fetch_assoc($q);
 	$id = $r['id'];
-}
+ }
-
+ 
 $report = report_load($id);
 /* Add a custom filter if specified */
 $filter_args = '';
@@ -60,7 +56,7 @@ if(is_array($_GET['filter'])) {
 }
 
 switch($_GET['action']) {
-    case 'dialog_gen':
+case 'dialog_gen':
 	if($id < 0) {
 		$u = "{$config['SFIABDIRECTORY']}/{$report_custom[-$id]['custom_url']}";
 		?>
@@ -93,11 +89,12 @@ switch($_GET['action']) {
 	</tr><tr>
 	<?
 	/* See if the report is in this committee member's list */
-	$q = mysql_query("SELECT * FROM reports_committee 
+	$q = $pd->prepare("SELECT * FROM reports_committee 
-				WHERE users_id='{$_SESSION['accounts_id']}'
+ 				WHERE users_id='{$_SESSION['users_uid']}'
 				AND reports_id='{$report['id']}'");
-	if(mysql_num_rows($q) > 0) {
+	$q->execute();
-		$i = mysql_fetch_assoc($q);
+	if($q->rowCount() > 0) {
+		$i = $q->fetch(PDO::FETCH_ASSOC);
 		?>
 		<td colspan="2"><hr /><h3><?=i18n('My Reports Info')?></h3></td>
 		</tr><tr>
@@ -114,12 +111,12 @@ switch($_GET['action']) {
 	<?
 	$format = $report['options']['type'];
 	$stock = $report['options']['stock'];
-	$conferences_id = $conference['id'];
+	$year = $config['FAIRYEAR'];
 
 	 /* Out of all the report optins, we really only want these ones */
 	$option_keys = array('type','stock');
 	foreach($report_options as $ok=>$o) {
-		if(!in_array($ok, $option_keys)) continue;
+ 		if(!in_array($ok, $option_keys)) continue;
 
 		echo "<tr><td class=\"label\"><b>{$o['desc']}</b>:</td>";
 		echo "<td class=\"input\"><select name=\"$ok\" id=\"$ok\">";
@@ -129,16 +126,15 @@ switch($_GET['action']) {
 		}
 		echo "</select></td></tr>\n";
 	}
-
+	/* Find all the years */
-	// Find all conferences
+	$q = $pdo->prepare("SELECT DISTINCT year FROM config WHERE year>1000 ORDER BY year DESC");
-	$q = mysql_query("SELECT conferences.name, conferences.id, dates.date FROM conferences JOIN dates on dates.conferences_id = conferences.id WHERE dates.name='fairdate' ORDER BY dates.date DESC");
+	$q->execute();
-	echo "<tr><td  class=\"label\"><b>".i18n('Conference')."</b>:</td>";
+	echo "<tr><td  class=\"label\"><b>".i18n('Year')."</b>:</td>";
-	echo "<td class=\"input\"><select name=\"conferences_id\" id=\"conferences_id\">";
+	echo "<td class=\"input\"><select name=\"year\" id=\"year\">";
-	while($row = mysql_fetch_assoc($q)){
+	while($i =$q->fetch(PDO::FETCH_ASSOC)) {
-		$parts = explode(' ', $row['date']);
+		$y = $i['year'];
-		$date = $parts[0];
+		$sel = ($config['FAIRYEAR'] == $y) ? 'selected="selected"' : '';
-		$sel = ($row['id'] == $conferences_id) ? 'selected="selected"' : '';
+		echo "<option value=\"$y\" $sel>$y</option>";
-		echo "<option value=\"{$row['id']}\" $sel>{$row['name']} ($date)</option>";
 	}
 	echo "</select></td></tr>\n";
 	?>
@@ -187,95 +183,95 @@ switch($_GET['action']) {
 	</script>
 	<?
 	exit;
-}
+ }
 
 
-if($show_options == false) {
+ if($show_options == false) {
-	 if($id && $conferences_id) {
+	 if($id && $year) {
-		$report['conferences_id'] = $conferences_id;
+		$report['year'] = $year;
 		if($type != '') $report['option']['type'] = $type;
 		if($stock != '') $report['option']['stock'] = $stock;
 		if($include_incomplete_registrations != '') $report['option']['include_incomplete_registrations'] = 'yes';
 		report_gen($report);
 	 } else {
 	 exit;
-		header("Location: reports.php");
+ 		header("Location: reports.php");
 	 }
 	 exit;
-}
+ }
 
 
-send_header('Report Options', array(
+ send_header('Report Options', array(
-		'Committee Main' => 'committee_main.php',
+ 		'Committee Main' => 'committee_main.php',
 		'My Reports' => 'admin/reports.php'));
 
-echo '<form method=\"get\" action="reports_gen.php">';
+ echo '<form method=\"get\" action="reports_gen.php">';
-echo "<input type=\"hidden\" name=\"id\" value=\"$id\">";
+ echo "<input type=\"hidden\" name=\"id\" value=\"$id\">";
 
-echo '<table class="tableedit">';
+ echo '<table class="tableedit">';
-echo "<tr><td><b>".i18n('Report&nbsp;Name')."</b>:</td>";
+ echo "<tr><td><b>".i18n('Report&nbsp;Name')."</b>:</td>";
-echo "<td>{$report['name']}</td></tr>";
+ echo "<td>{$report['name']}</td></tr>";
-echo "<tr><td><b>".i18n('Description')."</b>:</td>";
+ echo "<tr><td><b>".i18n('Description')."</b>:</td>";
-echo "<td>{$report['desc']}</td></tr>";
+ echo "<td>{$report['desc']}</td></tr>";
-echo "<tr><td><b>".i18n('Created By')."</b>:</td>";
+ echo "<tr><td><b>".i18n('Created By')."</b>:</td>";
-echo "<td>{$report['creator']}</td></tr>";
+ echo "<td>{$report['creator']}</td></tr>";
 
-echo '<tr><td colspan="2"><hr /></td></tr>';
+ echo '<tr><td colspan="2"><hr /></td></tr>';
-/* See if the report is in this committee member's list */
+ /* See if the report is in this committee member's list */
-$q = mysql_query("SELECT * FROM reports_committee 
+ $q = $pdo->prepare("SELECT * FROM reports_committee 
-			WHERE users_id='{$_SESSION['accounts_id']}'
+ 			WHERE users_id='{$_SESSION['users_uid']}'
 			AND reports_id='{$report['id']}'");
-echo "<tr><td colspan=\"2\"><h3>".i18n('My Reports Info')."</h3></td></tr>";
+	$q->execute();
-if(mysql_num_rows($q) > 0) {
+ echo "<tr><td colspan=\"2\"><h3>".i18n('My Reports Info')."</h3></td></tr>";
-	/* Yes, it is */
+ if($q->rowCount() > 0) {
-	$i = mysql_fetch_object($q);
+ 	/* Yes, it is */
+	$i = $q->fetch(PDO::FETCH_OBJ);
 	echo "<tr><td><b>".i18n('Category')."</b>:</td>";
 	echo "<td>{$i->category}</td></tr>";
 	echo "<tr><td><b>".i18n('Comment')."</b>:</td>";
 	echo "<td>{$i->comment}</td></tr>";
-} else {
+ } else {
-	echo "<tr><td></td><td>".i18n('This report is NOT in your \'My Reports\' list.')."</td></tr>";
+ 	echo "<tr><td></td><td>".i18n('This report is NOT in your \'My Reports\' list.')."</td></tr>";
-}
+ }
-echo '<tr><td colspan="2"><hr /></td></tr>';
+ echo '<tr><td colspan="2"><hr /></td></tr>';
-echo "<tr><td colspan=\"2\"><h3>".i18n('Report Options')."</h3></td></tr>";
+ echo "<tr><td colspan=\"2\"><h3>".i18n('Report Options')."</h3></td></tr>";
 
-$format = $report['options']['type'];
+ $format = $report['options']['type'];
-$stock = $report['options']['stock'];
+ $stock = $report['options']['stock'];
-$conferences_id = $conference['id'];
+ $year = $config['FAIRYEAR'];
 
-/* Out of all the report optoins, we really only want these ones */
+ /* Out of all the report optoins, we really only want these ones */
-$option_keys = array('type','stock');
+ $option_keys = array('type','stock');
-foreach($report_options as $ok=>$o) {
+ foreach($report_options as $ok=>$o) {
-	if(!in_array($ok, $option_keys)) continue;
+ 	if(!in_array($ok, $option_keys)) continue;
-	echo "<tr><td><b>{$o['desc']}</b>:</td>";
+ 	echo "<tr><td><b>{$o['desc']}</b>:</td>";
 	echo "<td><select name=\"$ok\" id=\"$ok\">";
 	foreach($o['values'] as $k=>$v) {
 		$sel = ($report['option'][$ok] == $k) ? 'selected="selected"' : '';
 		echo "<option value=\"$k\" $sel>$v</option>";
 	}
 	echo "</select></td></tr>";
-}
+ }
+ /* Find all the years */
+ $q = $pdo->prepare("SELECT DISTINCT year FROM config WHERE year>1000 ORDER BY year DESC");
+ $q->execute();
+ echo "<tr><td><b>".i18n('Year')."</b>:</td>";
+ echo "<td><select name=\"year\" id=\"year\">";
+ while($i =$q->fetch(PDO::FETCH_ASSOC)) {
+ 	$y = $i['year'];
+	$sel = ($config['FAIRYEAR'] == $y) ? 'selected="selected"' : '';
+	echo "<option value=\"$y\" $sel>$y</option>";
+ }
+ echo "</select></td></tr>";
 
-// Find all conferences
+ echo "</table>";
-$q = mysql_query("SELECT conferences.name, conferences.id, dates.date FROM conferences JOIN dates on dates.conferences_id = conferences.id WHERE dates.name='fairdate' ORDER BY dates.date DESC");
-echo "<tr><td  class=\"label\"><b>".i18n('Conference')."</b>:</td>";
-echo "<td class=\"input\"><select name=\"conferences_id\" id=\"conferences_id\">";
-while($row = mysql_fetch_assoc($q)){
-	$parts = explode(' ', $row['date']);
-	$date = $parts[0];
-	$sel = ($row['id'] == $conferences_id) ? 'selected="selected"' : '';
-	echo "<option value=\"{$row['id']}\" $sel>{$row['name']} ($date)</option>";
-}
-echo "</select></td></tr>\n";
 
-echo "</table>";
+ echo '<br />';
-
+ echo "<input type=\"submit\" value=\"".i18n('Generate Report')."\" />";
-echo '<br />';
+ echo '</form>';
-echo "<input type=\"submit\" value=\"".i18n('Generate Report')."\" />";
-echo '</form>';
-
-send_footer();
 
+ send_footer();
 
+ 
 
 ?>

admin/reports_judges.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
  require("../lcsv.php");
  require("../questions.inc.php");
@@ -36,7 +36,7 @@ if($type=="pdf")
 {
 	$rep=new lpdf(	i18n($config['fairname']),
 			i18n("Judge List"),
-			$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+			$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 			);
 
 	$rep->newPage();
@@ -70,7 +70,7 @@ $table['header']=array(
 			i18n("Expertise Other"));
 
 /* Append headers for all the custom questions */
-$qs=questions_load_questions('judgereg', $conference['id']);
+$qs=questions_load_questions('judgereg', $config['FAIRYEAR']);
 $keys = array_keys($qs);
 foreach($keys as $qid) {
 	$table['header'][] = i18n($qs[$qid]['db_heading']);
@@ -78,18 +78,20 @@ foreach($keys as $qid) {
 
 
 //grab the list of divisions, because the last fields of the table will be the sub-divisions 
-$q=mysql_query("SELECT * FROM projectcategories WHERE conferences_id='".$conference['id']."' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-$numcats=mysql_num_rows($q);
+$q->execute();
+$numcats=$q->rowCount();
 $catheadings=array();
-while($r=mysql_fetch_object($q))
+while($r=$q->fetch(PDO::FETCH_OBJ))
 {
 	$cats[]=$r->id;
 	$catheadings[]="$r->category (out of 5)";
 }
 //grab the list of divisions, because the last fields of the table will be the sub-divisions 
-$q=mysql_query("SELECT * FROM projectdivisions WHERE conferences_id='".$conference['id']."' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
+$q->execute();
 $divheadings=array();
-while($r=mysql_fetch_object($q))
+while($r=$q->fetch(PDO::FETCH_OBJ))
 {
 	$divs[]=$r->id;
 	$divheadings[]="$r->division (out of 5)";
@@ -99,26 +101,57 @@ while($r=mysql_fetch_object($q))
 //now append the arrays together
 $table['header']=array_merge($table['header'],array_merge($catheadings,$divheadings));
 
+	$times = array();
+	$datetimeheadings=array();
+
+	/* Load the judging rounds */
+	$q = $pdo->prepare("SELECT date,starttime,endtime,name FROM judges_timeslots WHERE round_id='0' AND year='{$config['FAIRYEAR']}' ORDER BY starttime,type");
+	$q->execute();
+	$x = 0;
+	while($r = $q->fetch(PDO::FETCH_OBJ)) {
+		$found = false;
+		foreach($times as $xx => $t) {
+			if($t['date'] == $r->date && $t['starttime'] == $r->starttime && $t['endtime'] == $r->endtime) {
+				$times[$xx]['name'] .= ", {$r->name}";
+				$found = true;
+				break;
+			}
+		}
+		if(!$found) {
+			$times[$x] = array( 'date' => $r->date,
+					'starttime' => $r->starttime,
+					'endtime' => $r->endtime,
+					'name' => $r->name);
+			$datetimeheadings[]=$r->name;
+			$x++;
+		}
+	}
+
+$table['header']=array_merge($table['header'],$datetimeheadings);
+
+
 
 //fill these in if we ever make this PDFable
 $table['widths']=array();
 $table['dataalign']=array();
 
-$q=mysql_query("SELECT 
+$q=$pdo->prepare("SELECT 
-				users.*
+				users.*,
+				users_judge.*
 			FROM 
 				users
-				JOIN user_roles ON user_roles.users_id = users.id
+				JOIN users_judge ON users.id=users_judge.users_id
-				JOIN roles ON roles.id = user_roles.roles_id
+			WHERE 
-			WHERE
-				roles.type = 'judge' AND
 				users.deleted='no' AND 
-				users.conferences_id='".$conference['id']."'
+				users.year='".$config['FAIRYEAR']."'
+				AND users.types LIKE '%judge%'
+
 			ORDER BY 
 				lastname,
 				firstname");
-echo mysql_error();
+$q->execute();
-while($r=mysql_fetch_object($q)) {
+echo $pdo->errorInfo();
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$u=user_load($r->id);
 
 	$expertise_other=str_replace("\n"," ",$r->expertise_other);
@@ -144,11 +177,33 @@ while($r=mysql_fetch_object($q)) {
 	$languages=substr($languages,0,-1);
 
 	$qarray = array();
-	$qans = questions_load_answers('judgereg', $r->id, $conference['id']);
+	$qans = questions_load_answers('judgereg', $r->id, $config['FAIRYEAR']);
 	$keys = array_keys($qans);
 	foreach($keys as $qid) {
 		$qarray[] = $qans[$qid];
 	}
+
+
+	$tq = $pdo->prepare("SELECT * FROM judges_availability WHERE users_id=\"".$r->id."\" ORDER BY `start`");
+	$tq->execute();
+
+	$sel = array();
+	$timedata=array();
+	while($tr=$tq->fetch(PDO::FETCH_OBJ)) {
+		foreach($times as $x=>$t) {
+			if($tr->start == $t['starttime'] && $tr->end == $t['endtime'] && $tr->date == $t['date']) {
+				$sel[$x] = true;
+			}
+		}
+	}
+
+	foreach($times as $x=>$t) {
+		if($sel[$x]==true) {
+			$timedata[]="yes";
+		} else {
+			$timedata[]="no";
+		}
+	}
 		
 	$tmp=array(
 		$r->id,
@@ -174,7 +229,7 @@ while($r=mysql_fetch_object($q)) {
 	$tmp = array_merge($tmp, $qarray);
 
 	$extradata=array_merge($catdata,$divdata);
-	$table['data'][]=array_merge($tmp,$extradata);
+	$table['data'][]=array_merge(array_merge($tmp,$extradata),$timedata);
 }
 
 $rep->addTable($table);

admin/reports_judges_allyears.php

@@ -79,18 +79,20 @@ foreach($keys as $qid) {
 
 
 //grab the list of divisions, because the last fields of the table will be the sub-divisions 
-$q=mysql_query("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectcategories WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
-$numcats=mysql_num_rows($q);
+$q->execute();
+$numcats=$q->rowCount();
 $catheadings=array();
-while($r=mysql_fetch_object($q))
+while($r=$q->fetch(PDO::FETCH_OBJ))
 {
 	$cats[]=$r->id;
 	$catheadings[]="$r->category (out of 5)";
 }
 //grab the list of divisions, because the last fields of the table will be the sub-divisions 
-$q=mysql_query("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
+$q=$pdo->prepare("SELECT * FROM projectdivisions WHERE year='".$config['FAIRYEAR']."' ORDER BY id");
+$q->execute();
 $divheadings=array();
-while($r=mysql_fetch_object($q))
+while($r=$q->fetch(PDO::FETCH_OBJ))
 {
 	$divs[]=$r->id;
 	$divheadings[]="$r->division (out of 5)";
@@ -105,7 +107,7 @@ $table['header']=array_merge($table['header'],array_merge($catheadings,$divheadi
 $table['widths']=array();
 $table['dataalign']=array();
 
-$q=mysql_query("SELECT 
+$q=$pdo->prepare("SELECT 
 				users.*,
 				users_judge.*
 			FROM 
@@ -118,8 +120,9 @@ $q=mysql_query("SELECT
 				lastname,
 				firstname,
 				year");
-echo mysql_error();
+$q->execute();
-while($r=mysql_fetch_object($q)) {
+echo $pdo->errorInfo();
+while($r=$q->fetch(PDO::FETCH_OBJ)) {
 	$u=user_load($r->id);
 
 	$expertise_other=str_replace("\n"," ",$r->expertise_other);

admin/reports_judges_teams_projects.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
  require("../lcsv.php");
  require("judges.inc.php");
@@ -36,7 +36,7 @@
 
 		$rep=new lpdf(	i18n($config['fairname']),
 				i18n("Judging Team Project Assignments"),
-				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 				);
 
 		$rep->newPage();
@@ -49,8 +49,9 @@
 
 	$teams=getJudgingTeams();
 
-	$q=mysql_query("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE conferences_id='".$conference['id']."'");
+	$q=$pdo->prepare("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE year='".$config['FAIRYEAR']."'");
-	if(mysql_num_rows($q)>1)
+	$q->execute();
+	if($q->rowCount()>1)
 		$show_date=true;
 	else
 		$show_date=false;
@@ -60,7 +61,7 @@
 		$table=array();
 		$table['header']=array(i18n("Timeslot"),i18n("Proj #"),i18n("Project Title"));
 		if($show_date)
-			$table['widths']=array(		2.25,		0.75, 		4.00);
+			$table['widths']=array(		2.50,		0.75, 		3.75);
 		else
 			$table['widths']=array(		1.5,		0.75, 		4.75);
 
@@ -91,10 +92,11 @@
 				$rep->addText(i18n("Criteria").": ".$award['criteria']);
 
 				//get category eligibility
-				$q=mysql_query("SELECT projectcategories.category FROM projectcategories, award_awards_projectcategories WHERE award_awards_projectcategories.projectcategories_id=projectcategories.id AND award_awards_projectcategories.award_awards_id='{$award['id']}' AND award_awards_projectcategories.conferences_id='{$conference['id']}' AND projectcategories.conferences_id='{$conference['id']}' ORDER BY category");
+				$q=$pdo->prepare("SELECT projectcategories.category FROM projectcategories, award_awards_projectcategories WHERE award_awards_projectcategories.projectcategories_id=projectcategories.id AND award_awards_projectcategories.award_awards_id='{$award['id']}' AND award_awards_projectcategories.year='{$config['FAIRYEAR']}' AND projectcategories.year='{$config['FAIRYEAR']}' ORDER BY category");
-				echo mysql_error();
+				$q->execute();
+				echo $pdo->erroInfo();
 				$cats="";
-				while($r=mysql_fetch_object($q))
+				while($r=$q->fetch(PDO::FETCH_OBJ))
 				{
 					if($cats) $cats.=", ".i18n($r->category);
 					else $cats=i18n($r->category);
@@ -103,10 +105,11 @@
 
 
 				//get division eligibility
-				$q=mysql_query("SELECT projectdivisions.division_shortform FROM projectdivisions, award_awards_projectdivisions WHERE award_awards_projectdivisions.projectdivisions_id=projectdivisions.id AND award_awards_projectdivisions.award_awards_id='{$award['id']}' AND award_awards_projectdivisions.conferences_id='{$conference['id']}' AND projectdivisions.conferences_id='{$conference['id']}' ORDER BY division_shortform");
+				$q=$pdo->prepare("SELECT projectdivisions.division_shortform FROM projectdivisions, award_awards_projectdivisions WHERE award_awards_projectdivisions.projectdivisions_id=projectdivisions.id AND award_awards_projectdivisions.award_awards_id='{$award['id']}' AND award_awards_projectdivisions.year='{$config['FAIRYEAR']}' AND projectdivisions.year='{$config['FAIRYEAR']}' ORDER BY division_shortform");
-				echo mysql_error();
+				$q->execute();
+				echo $pdo->erroInfo();
 				$divs="";
-				while($r=mysql_fetch_object($q))
+				while($r=$q->fetch(PDO::FETCH_OBJ))
 				{
 					if($divs) $divs.=", ".i18n($r->division_shortform);
 					else $divs=i18n($r->division_shortform);
@@ -119,7 +122,7 @@
 		$rep->nextLine();
 
 		//get the timeslots that this team has.
-		$q=mysql_query("SELECT 
+		$q=$pdo->prepare("SELECT 
 					judges_timeslots.id,
 					judges_timeslots.date,
 					judges_timeslots.starttime,
@@ -135,17 +138,18 @@
 				ORDER BY
 					date,starttime
 				");
-		$numslots=mysql_num_rows($q);
+		$q->execute();
+		$numslots=$q->rowCount();
 
-		while($r=mysql_fetch_object($q))
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 		{
 			if($show_date)
-				$timeslot=$r->date." ";
+				$timeslot=format_date($r->date)." ";
 			else
 				$timeslot="";
 			$timeslot.=format_time($r->starttime)." - ".format_time($r->endtime);
 
-			$projq=mysql_query("SELECT
+			$projq=$pdo->prepare("SELECT
 					projects.projectnumber,
 					projects.id,
 					projects.title
@@ -156,12 +160,13 @@
 					judges_teams_timeslots_projects_link.judges_timeslots_id='$r->id' AND
 					judges_teams_timeslots_projects_link.judges_teams_id='".$team['id']."' AND
 					judges_teams_timeslots_projects_link.projects_id=projects.id AND
-					judges_teams_timeslots_projects_link.conferences_id='".$conference['id']."'
+					judges_teams_timeslots_projects_link.year='".$config['FAIRYEAR']."'
 				ORDER BY
 					projectnumber
 				");
+			$projq->execute(;)
 
-			while($proj=mysql_fetch_object($projq))
+			while($proj=$projq->fetch(PDO::FETCH_OBJ))
 			{
 				$table['data'][]=array($timeslot, $proj->projectnumber,$proj->title);
 				//make the timeslot empty so we dont list it each time if there's more than one project in the timeslot

admin/reports_mailinglabels.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("Mailing Label Generator",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php',

admin/reports_mailinglabels_generator.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
  require("../lcsv.php");
 
@@ -49,9 +49,9 @@ if($report)
 		if($_GET['fontsize']) $fontsize=$_GET['fontsize'];
 		if($_GET['toppadding']) $toppadding=$_GET['toppadding'];
 
-		$rep=new lpdf(	i18n($conference['name']),
+		$rep=new lpdf(	i18n($config['fairname']),
 				"$reportname Mailing Labels",
-				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 				);
 
 		$rep->setPageStyle("labels");
@@ -66,8 +66,9 @@ if($report)
 	{
 		//IF(schools.sciencehead=\"\",\"Science Department Head\",schools.sciencehead) AS co,
 		case "schools":
-				$q=mysql_query("SELECT  
+				$q=$pdo->prepare("SELECT  
 							schools.school AS name,
+							schools.board AS board,
 							schools.schoollang,
 							schools.sciencehead AS co,
 							schools.address AS address,
@@ -77,15 +78,16 @@ if($report)
 						FROM
 							schools
 						WHERE
-							conferences_id='{$conference['id']}'
+							year='{$config['FAIRYEAR']}'
 						ORDER BY
 							school
 						");
+				$q->execute();
 		break;
 
 		case "sponsors":
 
-				$q=mysql_query("SELECT  
+				$q=$pdo->prepare("SELECT  
 							award_sponsors.organization AS name,
 							award_sponsors.address AS address,
 							award_sponsors.city AS city,
@@ -104,29 +106,30 @@ if($report)
 						ORDER BY
 							organization
 						");
+				$q->execute();
 			break;
 
 			case "judges":
-				$q = mysql_query("
+				$q=$pdo->prepare("SELECT  
-					SELECT
+							CONCAT(judges.firstname,' ',judges.lastname) AS name,
-						CONCAT(users.firstname, ' ', users.lastname) AS name,
+							IF(judges.address2=\"\",
-						IF(users.address2=\"\",
+								judges.address,
-							users.address,
+								CONCAT(judges.address,' ',judges.address2)
-							CONCAT(users.address,' ',users.address2)
+							) AS address,
-						) AS address,
+							'' AS co,
-						'' AS co,
+							judges.city AS city,
-						users.city AS city,
+							judges.province AS province,
-						users.province AS province,
+							judges.postalcode AS postalcode
-						users.postalcode AS postalcode
+						FROM
-					FROM	users
+							judges,
-					JOIN	user_roles ON users.id = user_roles.users_id
+							judges_years
-					JOIN	roles ON roles.id = user_roles.roles_id
+						WHERE
-					WHERE
+							judges_years.judges_id=judges.id
-						roles.type = 'judge'
+							AND judges_years.year='{$config['FAIRYEAR']}'
-						AND users.conferences_id='{$conference['id']}'
+						ORDER BY
-					ORDER BY
+							lastname,firstname
-						firstname, lastname
+						");
-					");
+				$q->execute();
 			break;
 
 	}
@@ -144,7 +147,7 @@ if($report)
 					i18n($config['postalzip']));
 	}
 	
-	while($r=mysql_fetch_object($q))
+	while($r=$q-.fetch(PDO::FETCH_OBJ))
 	{
 		//handle C/O differently for schools, becuase, well, french schools are picky!
 		if($report=="schools") {
@@ -154,17 +157,23 @@ if($report)
 				$coname=i18n("Science Department Head",array(),array(),$r->schoollang);
 
 			$co=i18n("C/O %1",array($coname),array("Name of person"),$r->schoollang);
-		}
-		else $co="C/O $r->co";
 
-		if($_GET['type']=="pdf")
+			
-		{
+			$name=$r->name;
-			$rep->newLabel();
+			if($r->board) 
-			$rep->mailingLabel($r->name,$co,$r->address,$r->city,$r->province,$r->postalcode);
+				$name.=" [".$r->board."]";
 		}
-		else if($_GET['type']=="csv")
+		else {
-		{
+			 $co="C/O $r->co";
-			$table['data'][]=array($r->name,$co,$r->address,$r->city,$r->province,$r->postalcode);
+			 $name=$r->name;
+		}
+
+		if($_GET['type']=="pdf") {
+			$rep->newLabel();
+			$rep->mailingLabel($name,$co,$r->address,$r->city,$r->province,$r->postalcode);
+		}
+		else if($_GET['type']=="csv") {
+			$table['data'][]=array($name,$co,$r->address,$r->city,$r->province,$r->postalcode);
 		}
 	}
 

admin/reports_old.php

@@ -25,7 +25,7 @@
  require("../common.inc.php");
  require_once("../user.inc.php");
  require_once('reports.inc.php');
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  send_header("Reports",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php')

admin/reports_program_awards.php

@@ -1,7 +1,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
  require("../lcsv.php");
 
@@ -13,7 +13,7 @@
 
 		$rep=new lpdf(	i18n($config['fairname']),
 				i18n("Program Awards"),
-				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 				);
 
 		$rep->newPage();
@@ -23,7 +23,7 @@
 	{
 		$rep=new lcsv(i18n("Program Awards"));
 	}
-	$q=mysql_query("SELECT 
+	$q=$pdo->prepare("SELECT 
 				award_awards.id,
 				award_awards.name,
 				award_awards.criteria,
@@ -34,33 +34,35 @@
 				award_awards,
 				award_types
 			WHERE 
-					award_awards.conferences_id='".$conference['id']."'
+					award_awards.year='".$config['FAIRYEAR']."'
-				AND	award_types.conferences_id='".$conference['id']."'
+				AND	award_types.year='".$config['FAIRYEAR']."'
 				AND	award_awards.award_types_id=award_types.id
 				AND	award_awards.excludefromac='0'
 				AND	(award_types.type='special' OR award_types.type='grand')
 			ORDER BY awards_order");
+	$q->execute();
 
-	echo mysql_error();
+	echo $pdo->errorInfo();
 
-	if(mysql_num_rows($q))
+	if($q->rowCCount())
 	{
-		while($r=mysql_fetch_object($q))
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 		{
 			$rep->heading(i18n($r->name));
 
 			//get teh age categories
-			$acq=mysql_query("SELECT projectcategories.category FROM projectcategories, award_awards_projectcategories  WHERE projectcategories.conferences_id='".$conference['id']."' AND award_awards_projectcategories.conferences_id='".$conference['id']."' AND award_awards_projectcategories.award_awards_id='$r->id' AND award_awards_projectcategories.projectcategories_id=projectcategories.id ORDER BY projectcategories.id");
+			$acq=$pdo->prepare("SELECT projectcategories.category FROM projectcategories, award_awards_projectcategories  WHERE projectcategories.year='".$config['FAIRYEAR']."' AND award_awards_projectcategories.year='".$config['FAIRYEAR']."' AND award_awards_projectcategories.award_awards_id='$r->id' AND award_awards_projectcategories.projectcategories_id=projectcategories.id ORDER BY projectcategories.id");
-			echo mysql_error();
+			$acq->execute();
+			echo $pdo->errorInfo();
 			$cats="";
-			while($acr=mysql_fetch_object($acq))
+			while($acr=$acq->fetch(PDO::FETCH_OBJ))
 			{
 				$cats.=i18n($acr->category).", ";
 			}
 			$cats=substr($cats,0,-2);
 			$rep->addText("$cats: ".i18n($r->criteria));
 
-			$pq=mysql_query("SELECT 
+			$pq=$pdo->prepare("SELECT 
 						award_prizes.prize,
 						award_prizes.number,
 						award_prizes.id,
@@ -70,13 +72,14 @@
 						award_prizes 
 					WHERE 
 						award_awards_id='$r->id' 
-						AND award_prizes.conferences_id='".$conference['id']."'
+						AND award_prizes.year='".$config['FAIRYEAR']."'
 						AND award_prizes.excludefromac='0'
 					ORDER BY 
 						`order`");
-					echo mysql_error();
+			$pq->execute();
+					echo $pdo->errorInfo();
 			$prevprizeid=-1;
-			while($pr=mysql_fetch_object($pq))
+			while($pr=$pq->fetch(PDO::FETCH_OBJ))
 			{
 				if($prevprizeid!=$pr->id)
 				{

admin/reports_projects_details.php

@@ -24,18 +24,19 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
  require("../lcsv.php");
  require("judges.inc.php");
 
  $type=$_GET['type'];
 
-	if($type=="pdf") {
+	if($type=="pdf")
+	{
 
 		$rep=new lpdf(	i18n($config['fairname']),
 				i18n("Project Details"),
-				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 				);
 
 		$rep->newPage();
@@ -46,10 +47,7 @@
 		$rep=new lcsv(i18n("Project Details"));
 	}
 
-//	$regstatus=" AND ( registrations.status='complete' OR registrations.status='paymentpending' ) ";
+	$projq=$pdo->prepare("SELECT  
-$regstatus="";
-
-	$projq=mysql_query("SELECT  
 				registrations.id AS reg_id,
 				registrations.num AS reg_num,
 				projects.id,
@@ -71,38 +69,40 @@ $regstatus="";
 				LEFT JOIN projectcategories ON projectcategories.id=projects.projectcategories_id
 
 			WHERE
-				projects.conferences_id='".$conference['id']."' 
+				projects.year='".$config['FAIRYEAR']."' 
-				AND projectdivisions.conferences_id='".$conference['id']."'
+				AND projectdivisions.year='".$config['FAIRYEAR']."'
-				AND projectcategories.conferences_id='".$conference['id']."'
+				AND projectcategories.year='".$config['FAIRYEAR']."'
-				$regstatus
+				AND ( registrations.status='complete'
+				 OR registrations.status='paymentpending' )
 			ORDER BY
 				projects.projectnumber
 			");
-			echo mysql_error();
+			echo $pdo->errorInfo();
 
-	$totalprojects=mysql_num_rows($projq);
+	$totalprojects=$projq->rowCount();
 	$projectcount=0;
 	
-	while($proj=mysql_fetch_object($projq))
+	while($proj=$projq->fetch(PDO::FETCH_OBJ))
 	{
 		$projectcount++;
-		$sq=mysql_query("SELECT users.firstname,
+		$sq=$pdo->prepare("SELECT students.firstname,
-					users.lastname
+					students.lastname
 				FROM
-					users
+					students
 				WHERE
-					users.registrations_id='$proj->reg_id'
+					students.registrations_id='$proj->reg_id'
 				");
-
+		$sq->execute();
 		$students="";
 		$studnum=0;
-		while($studentinfo=mysql_fetch_object($sq))
+		while($studentinfo=$sq->fetch(PDO::FETCH_OBJ))
 		{
 			if($studnum>0) $students.=", ";
 			$students.="$studentinfo->firstname $studentinfo->lastname";
 			$studnum++;
 		}
 		$rep->heading(i18n("Project Information"));
+		$rep->nextline();
 
 		$table=array();
 //		$table['header']=array(i18n("Timeslot"),i18n("Judging Team"));
@@ -120,44 +120,29 @@ $regstatus="";
 		$rep->addTable($table);
 		unset($table);
 
-		$q=mysql_query("SELECT * FROM mentors WHERE registrations_id='".$proj->reg_id."'");
+		$q=$pdo->prepare("SELECT * FROM mentors WHERE registrations_id='".$proj->reg_id."'");
+		$q->execute();
+		$rep->nextline();
 		$rep->heading(i18n("Mentor Information"));
-		if(mysql_num_rows($q)) {
+		$rep->nextline();
-			while($r=mysql_fetch_object($q))
+
-			{
+		if($q->rowCount())
-				$rep->addText(i18n("%1 %2 from %3",array($r->firstname,$r->lastname,$r->organization)));
+		{
-				$rep->addText(i18n("Phone: %1 Email: %2",array($r->phone,$r->email)));
+		while($r=$q->fetch(PDO::FETCH_OBJ))
-			}
+		{
+			$rep->addText(i18n("%1 %2 from %3",array($r->firstname,$r->lastname,$r->organization)));
+			$rep->addText(i18n("Phone: %1 Email: %2",array($r->phone,$r->email)));
 		}
-		else {
+		}
+		else
+		{
 			$rep->addText(i18n("No mentors"));
 		}
 
-
 		$rep->nextline();
 		$rep->heading(i18n("Project Summary"));
-		$rep->addText($proj->summary);
-
-		$q=mysql_query("SELECT safetyquestions.question,
-			safety.answer
-		FROM safetyquestions
-		JOIN safety ON safetyquestions.id=safety.safetyquestions_id
-		WHERE safety.registrations_id='".$proj->reg_id."' 
-		ORDER BY safetyquestions.ord");
-
 		$rep->nextline();
-		$rep->heading(i18n("Safety Questions"));
+		$rep->addText($proj->summary);
-		$table=array();
-//		$table['header']=array(i18n("Timeslot"),i18n("Judging Team"));
-		$table['widths']=array(		6.25,		0.5);
-		$table['dataalign']=array("left","left");
-
-		while($r=mysql_fetch_object($q)) {
-			$table['data'][]=array(i18n($r->question),$r->answer);
-		}
-		$rep->addTable($table);
-		unset($table);
-
 
 		if($projectcount!=$totalprojects)
 			$rep->newPage();

admin/reports_projects_judges_teams.php

@@ -24,7 +24,7 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
  require("../lpdf.php");
  require("../lcsv.php");
  require("judges.inc.php");
@@ -36,7 +36,7 @@
 
 		$rep=new lpdf(	i18n($config['fairname']),
 				i18n("Project Judging Team Assignments"),
-				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/{$conference['id']}-logo-200.gif"
+				$_SERVER['DOCUMENT_ROOT'].$config['SFIABDIRECTORY']."/data/logo-200.gif"
 				);
 
 		$rep->newPage();
@@ -49,14 +49,15 @@
 
 	$teams=getJudgingTeams();
 
-	$q=mysql_query("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE conferences_id='".$conference['id']."'");
+	$q=$pdo->prepare("SELECT DISTINCT(date) AS d FROM judges_timeslots WHERE year='".$config['FAIRYEAR']."'");
-	if(mysql_num_rows($q)>1)
+	$q->execute();
+	if($q->rowCount()>1)
 		$show_date=true;
 	else
 		$show_date=false;
 
 
-	$projq=mysql_query("SELECT  
+	$projq=$pdo->prepare("SELECT  
 				registrations.id AS reg_id,
 				registrations.num AS reg_num,
 				projects.id,
@@ -73,32 +74,34 @@
 				LEFT JOIN projectcategories ON projectcategories.id=projects.projectcategories_id
 
 			WHERE
-				projects.conferences_id='".$conference['id']."' 
+				projects.year='".$config['FAIRYEAR']."' 
-				AND projectdivisions.conferences_id='".$conference['id']."'
+				AND projectdivisions.year='".$config['FAIRYEAR']."'
-				AND projectcategories.conferences_id='".$conference['id']."'
+				AND projectcategories.year='".$config['FAIRYEAR']."'
 				AND ( registrations.status='complete'
 				 OR registrations.status='paymentpending' )
 			ORDER BY
 				projects.projectnumber
 			");
-			echo mysql_error();
+		$projq->execute();
+			echo $pdo->errorInfo();
 	
-	while($proj=mysql_fetch_object($projq))
+	while($proj=$projq->fetch(PDO::FETCH_OBJ))
 	{
 		$rep->heading("(".$proj->projectnumber.") ".$proj->title);
 
-		$sq=mysql_query("SELECT students.firstname,
+		$sq=$pdo->prepare("SELECT students.firstname,
 					students.lastname
 				FROM
 					students
 				WHERE
 					students.registrations_id='$proj->reg_id'
 				");
+		$sq->execute();
 
 
 		$students="";
 		$studnum=0;
-		while($studentinfo=mysql_fetch_object($sq))
+		while($studentinfo=$sq->fetch(PDO::fETCH_OBJ)
 		{
 			if($studnum>0) $students.=", ";
 			$students.="$studentinfo->firstname $studentinfo->lastname";
@@ -110,14 +113,14 @@
 		$table=array();
 		$table['header']=array(i18n("Timeslot"),i18n("Judging Team"));
 		if($show_date)
-			$table['widths']=array(		2.25,		4.75);
+			$table['widths']=array(		2.50,		4.50);
 		else
 			$table['widths']=array(		1.5,		5.50);
 
 		$table['dataalign']=array("center","left");
 
 		//get the timeslots that this project has assigned to been judged.
-		$q=mysql_query("SELECT 
+		$q=$pdo->prepare("SELECT 
 					judges_timeslots.date,
 					judges_timeslots.starttime,
 					judges_timeslots.endtime,
@@ -128,13 +131,14 @@
 					LEFT JOIN judges_teams ON judges_teams_timeslots_projects_link.judges_teams_id=judges_teams.id
 				WHERE
 					judges_teams_timeslots_projects_link.projects_id='$proj->id'
-					AND judges_teams_timeslots_projects_link.conferences_id='".$conference['id']."'
+					AND judges_teams_timeslots_projects_link.year='".$config['FAIRYEAR']."'
 				ORDER BY
 					date,starttime
 				");
-		$numslots=mysql_num_rows($q);
+		$q->execute();
+		$numslots=$q->rowCount();
 
-		while($r=mysql_fetch_object($q))
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 		{
 			if($show_date)
 				$timeslot=format_date($r->date)." ";

admin/reports_schools.inc.php

@@ -22,36 +22,40 @@
 */
 
 
-function reports_schools_principal(&$report, $field, $text)
+function reports_schools_principal($report, $field, $text)
 {
+	$year = $report['year'];
 	if($text > 0) { /* text is the uid */
-		$u = user_load($text);
+		$u = user_load_by_uid_year($text, $year);
 		return $u['name'];
 	}
 	return '';
 }
-function reports_schools_sciencehead(&$report, $field, $text)
+function reports_schools_sciencehead($report, $field, $text)
 {
+	$year = $report['year'];
 	if($text > 0) { /* text is the uid */
-		$u = user_load($text);
+		$u = user_load_by_uid_year($text, $year);
-		return $u['name'];
+		return i18n("%1 or Science Department Head",array($u['name']));
 	}
-	return '';
+	return i18n("Science Department Head");
 }
 
-function reports_schools_shphone(&$report, $field, $text)
+function reports_schools_shphone($report, $field, $text)
 {
+	$year = $report['year'];
 	if($text > 0) { /* text is the uid */
-		$u = user_load($text);
+		$u = user_load_by_uid_year($text, $year);
 		return $u['phonework'];
 	}
 	return '';
 }
 
-function reports_schools_shemail(&$report, $field, $text)
+function reports_schools_shemail($report, $field, $text)
 {
+	$year = $report['year'];
 	if($text > 0) { /* text is the uid */
-		$u = user_load($text);
+		$u = user_load_by_uid_year($text, $year);
 		return $u['email'];
 	}
 	return '';
@@ -59,159 +63,141 @@ function reports_schools_shemail(&$report, $field, $text)
 
 $report_schools_fields = array(
 	'school' =>  array(
-		'start_option_group' => 'School Information',
 		'name' => 'School -- Name',
 		'header' => 'School Name',
-		'width' => 57.15 /*mm*/,
+		'width' => 2.25,
 		'table' => 'schools.school' ),
 
 	'schooladdr' => array(
 		'name' => 'School -- Full Address',
 		'header' => 'School Address',
-		'width' => 76.2 /*mm*/,
+		'width' => 3.0,
 		'table' => "CONCAT(schools.address, ', ', schools.city, ', ', schools.province_code, ', ', schools.postalcode)" ),
 
 	'school_phone' => array(
 		'name' => 'School -- Phone',
 		'header' => 'School Phone',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'schools.phone' ),
 
 	'school_fax' => array(
 		'name' => 'School -- Fax',
 		'header' => 'School Fax',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'schools.fax' ),
 
 	'school_email' => array(
 		'name' => 'School -- Email',
 		'header' => 'School Email',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'schools.schoolemail' ),
 
 	'school_address' =>  array(
 		'name' => 'School Address -- Street Address',
 		'header' => 'Address',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => 'schools.address'),
 
 	'school_city' =>  array(
 		'name' => 'School Address -- City',
 		'header' => 'City',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'schools.city' ),
 
 	'school_province' =>  array(
 		'name' => 'School Address -- '.$config['provincestate'],
 		'header' => $config['provincestate'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'schools.province_code' ),
 
 	'school_city_prov' =>  array(
 		'name' => 'School Address -- City, '.$config['provincestate'].' (for mailing)',
 		'header' => 'City',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => "CONCAT(schools.city, ', ', schools.province_code)" ),
 
 	'school_postal' =>  array(
 		'name' => 'School Address -- '.$config['postalzip'],
 		'header' => $config['postalzip'],
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'schools.postalcode' ),
 
 	'school_lang' =>  array(
 		'name' => 'School -- Language Code',
 		'header' => 'Lang',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'schools.schoollang' ),
 
 	'school_level' =>  array(
 		'name' => 'School -- Grade Levels',
 		'header' => 'Level',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'schools.schoollevel' ),
 
 	'school_board' =>  array(
 		'name' => 'School -- Board',
 		'header' => 'Board',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'schools.board' ),
 
 	'school_district' =>  array(
 		'name' => 'School -- District',
 		'header' => 'District',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'schools.district' ),
 
 	'school_principal' => array(
 		'name' => 'School -- Principal',
 		'header' => 'Principal',
-		'width' => 31.75 /*mm*/,
+		'width' => 1.25,
 		'table' => 'schools.principal_uid',
 		'exec_function' => 'reports_schools_principal'),
 
 	'school_sh' => array(
 		'name' => 'School -- Science Head',
 		'header' => 'Science Head',
-		'width' => 31.75 /*mm*/,
+		'width' => 1.25,
 		'table' => 'schools.sciencehead_uid',
 		'exec_function' => 'reports_schools_sciencehead'),
 
 	'school_shphone' => array(
 		'name' => 'School -- Science Head Phone',
 		'header' => 'Science Hd Phone',
-		'width' => 25.4 /*mm*/,
+		'width' => 1,
 		'table' => 'schools.sciencehead_uid',
 		'exec_function' => 'reports_schools_shphone'),
 
 	'school_shemail' => array(
 		'name' => 'School -- Science Head Email',
 		'header' => 'Science Head Email',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'schools.sciencehead_uid',
 		'exec_function' => 'reports_schools_shemail'),
 
 	'school_accesscode' => array(
-		'start_option_group' => 'Access Codes',
 		'name' => 'School -- Access Code',
 		'header' => 'Access Code',
-		'width' => 27.94 /*mm*/,
+		'width' => 1.1,
 		'table' => 'schools.accesscode' ),
 
 	'school_registration_password' => array(
 		'name' => 'School -- Registration Password',
 		'header' => 'Reg Pass',
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'schools.registration_password' ),
 
 	'school_project_limit' => array(
-		'start_option_group' => 'Project Limits',
 		'name' => 'School -- Project Limit',
 		'header' => 'Limit',
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'schools.projectlimit' ),
 
 	'school_project_limit_per' => array(
 		'name' => 'School -- Project Limit Per',
 		'header' => 'Limit Per',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'schools.projectlimitper' ),
 
-	/* The label system depends on each report type having conference_name and conference_logo */
-	'conference_name' =>  array(
-		'start_option_group' => 'Conference Information',
-                'name' => 'Conference -- Name',
-                'header' => 'Conference Name',
-                'width' => 76.2 /*mm*/,
-                'table' => "'".mysql_escape_string($conference['name'])."'"),
-
-	'conference_logo' =>  array(
-		'name' => 'Conference -- Logo (for Labels only)',
-		'header' => '',
-		'width' => 1 /*mm*/,
-		'table' => "CONCAT(' ')"),
-
-
 );
 
  function report_schools_fromwhere($report, $components)
@@ -219,12 +205,12 @@ $report_schools_fields = array(
  	global $config, $report_schools_fields;
 	
 	$fields = $report_schools_fields;
-	$conferences_id = $report['conferences_id'];
+	$year = $report['year'];
 
 	$q = "	FROM
 			schools
 		WHERE
-			schools.conferences_id='$conferences_id'
+			schools.year='$year'
 		";
 
 	return $q;

admin/reports_tours.inc.php

@@ -23,75 +23,59 @@
 
 $report_tours_fields = array(
 	'tour_name' =>  array(
-		'start_option_group' => 'Tour Information',
 		'name' => 'Tour -- Name',
 		'header' => 'Tour Name',
-		'width' => 76.2 /*mm*/,
+		'width' => 3,
 		'table' => 'tours.name' ),
 
 	'tour_num' =>  array(
 		'name' => 'Tour -- Number',
 		'header' => 'Num',
-		'width' => 19.05 /*mm*/,
+		'width' => 0.75,
 		'table' => 'tours.num' ),
 
 	'tour_desc' => array(
 		'name' => 'Tour -- Description',
 		'header' => 'Tour Description',
-		'width' => 76.2 /*mm*/,
+		'width' => 3.0,
 		'table' => 'tours.description'),
 
 	'tour_capacity' => array(
 		'name' => 'Tour -- Capacity',
 		'header' => 'Cap',
-		'width' => 10.16 /*mm*/,
+		'width' => 0.4,
 		'table' => 'tours.capacity' ),
 
 	'tour_mingrade' => array(
 		'name' => 'Tour -- Minimum Grade',
 		'header' => 'Min Gr.',
-		'width' => 10.16 /*mm*/,
+		'width' => 0.4,
 		'table' => 'tours.grade_min' ),
 
 	'tour_maxgrade' => array(
 		'name' => 'Tour -- Maximum Grade',
 		'header' => 'Max Gr.',
-		'width' => 10.16 /*mm*/,
+		'width' => 0.4,
 		'table' => 'tours.grade_max' ),
 
 	'tour_location' =>  array(
 		'name' => 'Tour -- Location',
 		'header' => 'Tour Location',
-		'width' => 50.8 /*mm*/,
+		'width' => 2.0,
 		'table' => 'tours.location'),
 
 	'tour_contact' =>  array(
 		'name' => 'Tour -- Contact',
 		'header' => 'Contact',
-		'width' => 38.1 /*mm*/,
+		'width' => 1.5,
 		'table' => 'tours.contact' ),
 
 	'tour_id' =>  array(
 		'name' => 'Tour -- Database ID',
 		'header' => '#',
-		'width' => 10.16 /*mm*/,
+		'width' => 0.4,
 		'table' => 'tours.id' ),
 
-	/* The label system depends on each report type having conference_name and conference_logo */
-	'conference_name' =>  array(
-		'start_option_group' => 'Conference Information',
-                'name' => 'Conference -- Name',
-                'header' => 'Conference Name',
-                'width' => 76.2 /*mm*/,
-                'table' => "'".mysql_real_escape_string($conference['name'])."'"),
-
-	'conference_logo' =>  array(
-		'name' => 'Conference -- Logo (for Labels only)',
-		'header' => '',
-		'width' => 1 /*mm*/,
-		'table' => "CONCAT(' ')"),
-
-
 );
 
  function report_tours_fromwhere($report, $components)
@@ -99,12 +83,12 @@ $report_tours_fields = array(
  	global $config, $report_tours_fields;
 	
 	$fields = $report_tours_fields;
-	$conferences_id = $report['conferences_id'];
+	$year = $report['year'];
 
 	$q = "	FROM
 			tours
 		WHERE
-			tours.conferences_id='$conferences_id'
+			tours.year='$year'
 		";
 
 	return $q;

admin/reports_volunteers.inc.php

@@ -24,114 +24,114 @@
 $report_volunteers_fields = array(
 
 	'last_name' =>  array(
-		'start_option_group' => 'Volunteer Name Information',
 		'name' => 'Volunteer -- Last Name',
 		'header' => 'Last Name',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'users.lastname' ),
 
 	'first_name' => array(
 		'name' => 'Volunteer -- First Name',
 		'header' => 'First Name',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'users.firstname' ),
 
 	'name' =>  array(
 		'name' => 'Volunteer -- Full Name (last, first)',
 		'header' => 'Name',
-		'width' => 44.45 /*mm*/,
+		'width' => 1.75,
 		'table' => "CONCAT(users.lastname, ', ', users.firstname)",
 		'table_sort'=> 'users.lastname' ),
 
 	'namefl' => array(
 		'name' => 'Volunteer -- Full Name (first last)',
 		'header' => 'Name',
-		'width' => 44.45 /*mm*/,
+		'width' => 1.75,
 		'table' => "CONCAT(users.firstname, ' ', users.lastname)",
 		'table_sort'=> 'users.lastname' ),
 
 	'email' => array(
-		'start_option_group' => 'Volunteer Contact Information',
 		'name' => 'Volunteer -- Email',
 		'header' => 'Email',
-		'width' => 44.45 /*mm*/,
+		'width' => 1.75,
-		'table' => 'accounts.email'),
+		'table' => 'users.email'),
 
 	'phone' => array(
 		'name' => 'Volunteer -- Phone',
 		'header' => 'Phone',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'users.phonehome'),
 
 	'cell' => array(
 		'name' => 'Volunteer -- Cell',
 		'header' => 'Cell',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'users.phonecell'),
 
 	'organization' => array(
 		'name' => 'Volunteer -- Phone',
 		'header' => 'Organziation',
-		'width' => 25.4 /*mm*/,
+		'width' => 1.0,
 		'table' => 'users.organization'),
 
 	'firstaid' => array(
-		'start_option_group' => 'Volunteer Miscellaneous',
 		'name' => 'Volunteer -- First Aid Training',
 		'header' => 'F.Aid',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'users.firstaid',
 		'value_map' =>array ('no' => 'no', 'yes' => 'YES')),
 
 	'cpr' => array(
 		'name' => 'Volunteer -- CPR Training',
 		'header' => 'CPR',
-		'width' => 12.7 /*mm*/,
+		'width' => 0.5,
 		'table' => 'users.cpr',
 		'value_map' =>array ('no' => 'no', 'yes' => 'YES')),
 
 	'complete' =>  array(
 		'name' => 'Volunteer -- Registration Complete',
 		'header' => 'Cmpl',
-		'width' => 10.16 /*mm*/,
+		'width' => 0.4,
-		'table' => 'user_roles.complete',
+		'table' => 'users_volunteer.volunteer_complete',
-		'value_map' => array ('no' => 'No', 'yes' => 'Yes')),
+		'value_map' => array ('no' => 'No', 'yes' => 'Yes'),
+		'components' => array('users_volunteer')),
 
 	'position_name' => array (
 		'name' => 'Volunteer Position -- Name',
 		'header' => 'Position',
-		'width' => 76.2 /*mm*/,
+		'width' => 3,
 		'table' => 'volunteer_positions.name',
 		'components' => array('signup')),
 
-	/* The label system depends on each report type having conference_name and conference_logo */
+	'fair_year' => array (
-	'conference_name' =>  array(
+		'name' => 'Fair -- Year',
-		'start_option_group' => 'Conference Information',
+		'header' => 'Year',
-                'name' => 'Conference -- Name',
+		'width' => 0.5,
-                'header' => 'Conference Name',
+		'table' => "{$config['FAIRYEAR']}"),
-                'width' => 76.2 /*mm*/,
-                'table' => "'".mysql_real_escape_string($conference['name'])."'"),
 
-	'conference_logo' =>  array(
+	'fair_name' => array (
-		'name' => 'Conference -- Logo (for Labels only)',
+		'name' => 'Fair -- Name',
-		'header' => '',
+		'header' => 'Fair Name',
-		'width' => 1 /*mm*/,
+		'width' => 3,
-		'table' => "CONCAT(' ')"),
+		'table' => "'".$config['fairname'])."'",
 
 	'static_text' => array (
-		'start_option_group' => 'Special Fields',
 		'name' => 'Static Text (useful for labels)',
 		'header' => '',
-		'width' => 2.54 /*mm*/,
+		'width' => 0.1,
 		'table' => "CONCAT(' ')"),
 
 );
 
  function report_volunteers_fromwhere($report, $components)
  {
- 	global $config;
+ 	global $config, $report_volutneers_fields;
 	
-	$conferences_id = $report['conferences_id'];
+	$fields = $report_volutneers_fields;
+	$year = $report['year'];
+
+	if(in_array('users_volunteer', $components)) {
+		$uv_from = 'LEFT JOIN users_volunteer ON users_volunteer.users_id=users.id';
+	}
 
 	$signup_join = '';
 	$signup_where = '';
@@ -141,17 +141,16 @@ $report_volunteers_fields = array(
 					ON (users.id=volunteer_positions_signup.users_id)
 				LEFT JOIN volunteer_positions 
 					ON (volunteer_positions_signup.volunteer_positions_id=volunteer_positions.id)";
-		$signup_where = "AND (volunteer_positions_signup.conferences_id = '$conferences_id' OR volunteer_positions_signup.conferences_id IS NULL)";
+		$signup_where = "AND (volunteer_positions_signup.year = '$year' OR volunteer_positions_signup.year IS NULL)";
 	} 
 
-	$q = "	FROM 	users 
+	$q = "	FROM 
-			LEFT JOIN user_roles on user_roles.users_id=users.id
+			users 
-			LEFT JOIN accounts ON accounts.id=users.accounts_id
 			$signup_join
 			$uv_from
-		WHEE
+		WHERE
-			user_roles.type='volunteer'
+			users.types LIKE '%volunteer%'
-			AND users.conferences_id='$conferences_id'
+			AND users.year='$year'
 			$signup_where
 		";
 

admin/rerollprizes.php

@@ -15,113 +15,132 @@
 	{
 
 	//make sure the number of awards are identical (aka they havent added any new ones)
-	$nq1=mysql_query("SELECT * FROM award_awards WHERE year='$newfairyear'");
+	$nq1=$pdo->prepare("SELECT * FROM award_awards WHERE year='$newfairyear'");
-	$nq2=mysql_query("SELECT * FROM award_awards WHERE year='$currentfairyear'");
+	$nq1->execute();
-	if(mysql_num_rows($nq1)==mysql_num_rows($nq2)) 
+	$nq2=$pdo->prepare("SELECT * FROM award_awards WHERE year='$currentfairyear'");
+	$nq2->execute();
+	if($nq1->rowCount()==$nq2->rowcount()) 
 	{
-		$npq1=mysql_query("SELECT * FROM award_prizes WHERE year='$newfairyear'");
+		$npq1=$pdo->prepare("SELECT * FROM award_prizes WHERE year='$newfairyear'");
-		$npq2=mysql_query("SELECT * FROM award_prizes WHERE year='$currentfairyear'");
+		$npq1->execute();
+		$npq2=$pdo->prepare("SELECT * FROM award_prizes WHERE year='$currentfairyear'");
+		$npq2->execute();
 
-		if(mysql_num_rows($npq2)>0 && mysql_num_rows($npq1)==0) 
+		if($npq2->rowCount()>0 && $npq1->rowCount()==0) 
 		{
 
 
 	echo "<br />";
 	echo notice(i18n("A BUG WAS IDENTIFIED IN YOUR PREVIOUS YEAR ROLLOVER WHICH CAUSED AWARD PRIZES TO NOT BE ROLLED OVER PROPERLY.  THEY ARE NOW BEING RE-ROLLED OVER WITH THE PROPER PRIZE INFORMATION.  THIS WILL ONLY HAPPEN ONCE."))."<br />";
-	mysql_query("DELETE FROM award_awards WHERE year='$newfairyear'");
+	$stmt = $pdo->prepare("DELETE FROM award_awards WHERE year='$newfairyear'");
-	mysql_query("DELETE FROM award_prizes WHERE year='$newfairyear'");
+	$stmt->execute();
-	mysql_query("DELETE FROM award_contacts WHERE year='$newfairyear'");
+	$stmt = $pdo->prepare("DELETE FROM award_prizes WHERE year='$newfairyear'");
-	mysql_query("DELETE FROM award_types WHERE year='$newfairyear'");
+	$stmt->execute();
-	mysql_query("DELETE FROM award_awards_projectcategories WHERE year='$newfairyear'");
+	$stmt = $pdo->prepare("DELETE FROM award_contacts WHERE year='$newfairyear'");
-	mysql_query("DELETE FROM award_awards_projectdivisions WHERE year='$newfairyear'");
+	$stmt->execute();
+	$stmt = $pdo->prepare("DELETE FROM award_types WHERE year='$newfairyear'");
+	$stmt->execute();
+	$stmt = $pdo->prepare("DELETE FROM award_awards_projectcategories WHERE year='$newfairyear'");
+	$stmt->execute();
+	$stmt = $pdo->prepare("DELETE FROM award_awards_projectdivisions WHERE year='$newfairyear'");
+$stmt->execute();
 
 	echo i18n("Rolling awards")."<br />";
 		//awards
-		$q=mysql_query("SELECT * FROM award_awards WHERE year='$currentfairyear'");
+		$q=$pdo->prepare("SELECT * FROM award_awards WHERE year='$currentfairyear'");
-		echo mysql_error();
+		$q->execute();
-		while($r=mysql_fetch_object($q))
+		echo $pdo->errorInfo();
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 		{
-			mysql_query("INSERT INTO award_awards (award_sponsors_id,award_types_id,name,criteria,presenter,`order`,year,excludefromac,cwsfaward) VALUES (
+			$stmt = $pdo->prepare("INSERT INTO award_awards (award_sponsors_id,award_types_id,name,criteria,presenter,`order`,year,excludefromac,cwsfaward) VALUES (
-				'".mysql_escape_string($r->award_sponsors_id)."',
+				'".$r->award_sponsors_id."',
-				'".mysql_escape_string($r->award_types_id)."',
+				'".$r->award_types_i)."',
-				'".mysql_escape_string($r->name)."',
+				'".$r->name."',
-				'".mysql_escape_string($r->criteria)."',
+				'".$r->criteria."',
-				'".mysql_escape_string($r->presenter)."',
+				'".$r->presenter."',
-				'".mysql_escape_string($r->order)."',
+				'".$r->order."',
-				'".mysql_escape_string($newfairyear)."',
+				'".$newfairyear."',
-				'".mysql_escape_string($r->excludefromac)."',
+				'".$r->excludefromac."',
-				'".mysql_escape_string($r->cwsfaward)."')");
+				'".$r->cwsfaward."')");
-			$award_awards_id=mysql_insert_id();
+			$award_awards_id=$pdo->lastInsertId();
 			
-			$q2=mysql_query("SELECT * FROM award_awards_projectcategories WHERE year='$currentfairyear' AND award_awards_id='$r->id'");
+			$q2=$pdo->prepare("SELECT * FROM award_awards_projectcategories WHERE year='$currentfairyear' AND award_awards_id='$r->id'");
-			echo mysql_error();
+			$q2->execute();
-			while($r2=mysql_fetch_object($q2))
+			echo $pdo->errorInfo();
+			while($r2=$q2->fetch(PDO::FETCH_OBJ))
 			{
-				mysql_query("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,year) VALUES (
+				$stmt = $pdo->prepare("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,year) VALUES (
-				'".mysql_escape_string($award_awards_id)."',
+				'".$award_awards_id."',
-				'".mysql_escape_string($r2->projectcategories_id)."',
+				'".$r2->projectcategories_id."',
-				'".mysql_escape_string($newfairyear)."')");
+				'".$newfairyear."')");
+				$stmt->execute();
 
 			}
 
-			$q2=mysql_query("SELECT * FROM award_awards_projectdivisions WHERE year='$currentfairyear' AND award_awards_id='$r->id'");
+			$q2=$pdo->prepare("SELECT * FROM award_awards_projectdivisions WHERE year='$currentfairyear' AND award_awards_id='$r->id'");
-			echo mysql_error();
+			$q2->execute();
-			while($r2=mysql_fetch_object($q2))
+			echo $pdo->errorInfo();
+			while($r2=$q2->fetch(PDO::FETCH_OBJ))
 			{
-				mysql_query("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,year) VALUES (
+				$stmt = $pdo->prepare("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,year) VALUES (
-				'".mysql_escape_string($award_awards_id)."',
+				'".$award_awards_id."',
-				'".mysql_escape_string($r2->projectdivisions_id)."',
+				'".$r2->projectdivisions_id."',
-				'".mysql_escape_string($newfairyear)."')");
+				'".$newfairyear."')");
+				$stmt->execute();
 
 			}
 
 			echo i18n("&nbsp; Rolling award prizes")."<br />";
-			$q2=mysql_query("SELECT * FROM award_prizes WHERE year='$currentfairyear' AND award_awards_id='$r->id'");
+			$q2=$pdo->prepare("SELECT * FROM award_prizes WHERE year='$currentfairyear' AND award_awards_id='$r->id'");
-			echo mysql_error();
+			$q2->execute();
-			while($r2=mysql_fetch_object($q2))
+			echo $pdo->errorInfo();
+			while($r2=$q2->fetch(PDO::FETCH_OBJ))
 			{
-				mysql_query("INSERT INTO award_prizes (award_awards_id,cash,scholarship,`value`,prize,number,`order`,year,excludefromac) VALUES (
+				$stmt = $pdo->prepare("INSERT INTO award_prizes (award_awards_id,cash,scholarship,`value`,prize,number,`order`,year,excludefromac) VALUES (
-				'".mysql_escape_string($award_awards_id)."',
+				'".$award_awards_id."',
-				'".mysql_escape_string($r2->cash)."',
+				'".$r2->cash."',
-				'".mysql_escape_string($r2->scholarship)."',
+				'".$r2->scholarship."',
-				'".mysql_escape_string($r2->value)."',
+				'".$r2->value."',
-				'".mysql_escape_string($r2->prize)."',
+				'".$r2->prize."',
-				'".mysql_escape_string($r2->number)."',
+				'".$r2->number."',
-				'".mysql_escape_string($r2->order)."',
+				'".$r2->order."',
-				'".mysql_escape_string($newfairyear)."',
+				'".$newfairyear."',
-				'".mysql_escape_string($r2->excludefromac)."')");
+				'".$r2->excludefromac."')");
 			}
 		}
 
 		echo i18n("Rolling award contacts")."<br />";
 		//award contacts
-		$q=mysql_query("SELECT * FROM award_contacts WHERE year='$currentfairyear'");
+		$q=$pdo->prepare("SELECT * FROM award_contacts WHERE year='$currentfairyear'");
-		echo mysql_error();
+		$q->execute();
-		while($r=mysql_fetch_object($q))
+		echo $pdo->errorInfo();
-			mysql_query("INSERT INTO award_contacts (award_sponsors_id,salutation,firstname,lastname,position,email,phonehome,phonework,phonecell,fax,notes,year) VALUES (
+		while($r=$q->fetch(PDO::FETCH_OBJ))
-				'".mysql_escape_string($r->award_sponsors_id)."',
+			$stmt = $pdo->prepare("INSERT INTO award_contacts (award_sponsors_id,salutation,firstname,lastname,position,email,phonehome,phonework,phonecell,fax,notes,year) VALUES (
-				'".mysql_escape_string($r->salutation)."',
+				'".$r->award_sponsors_id."',
-				'".mysql_escape_string($r->firstname)."',
+				'".$r->salutation."',
-				'".mysql_escape_string($r->lastname)."',
+				'".$r->firstname."',
-				'".mysql_escape_string($r->position)."',
+				'".$r->lastname."',
-				'".mysql_escape_string($r->email)."',
+				'".$r->position."',
-				'".mysql_escape_string($r->phonehome)."',
+				'".$r->email."',
-				'".mysql_escape_string($r->phonework)."',
+				'".$r->phonehome."',
-				'".mysql_escape_string($r->phonecell)."',
+				'".$r->phonework."',
-				'".mysql_escape_string($r->fax)."',
+				'".$r->phonecell."',
-				'".mysql_escape_string($r->notes)."',
+				'".$r->fax."',
-				'".mysql_escape_string($newfairyear)."')");
+				'".$r->notes."',
+				'".$newfairyear."')");
 
 		echo i18n("Rolling award types")."<br />";
 		//award types
-		$q=mysql_query("SELECT * FROM award_types WHERE year='$currentfairyear'");
+		$q=$pdo->prepare("SELECT * FROM award_types WHERE year='$currentfairyear'");
-		echo mysql_error();
+		$q->execute();
-		while($r=mysql_fetch_object($q))
+		echo $pdo->errorInfo();
-			mysql_query("INSERT INTO award_types (id,type,`order`,year) VALUES (
+		while($r=$q->fetch(PDO::FETCH_OBJ))
-				'".mysql_escape_string($r->id)."',
+			$stmt = $pdo->prepare("INSERT INTO award_types (id,type,`order`,year) VALUES (
-				'".mysql_escape_string($r->type)."',
+				'".$r->id."',
-				'".mysql_escape_string($r->order)."',
+				'".$r->type."',
-				'".mysql_escape_string($newfairyear)."')");
+				'".$r->order."',
+				'".$newfairyear."')");
+			$stmt->execute();
 
 		}
 	}

admin/schedule.php

@@ -1,429 +0,0 @@
-<?
-/* 
-   This file is part of the 'Science Fair In A Box' project
-   SFIAB Website: http://www.sfiab.ca
-
-   Copyright (C) 2010 Youth Science Ontario <info@scitechontario.org>
-   Copyright (C) 2010 James Grant <james@lightbox.org>
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public
-   License as published by the Free Software Foundation, version 2.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; see the file COPYING.  If not, write to
-   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-*/
-?>
-<?
- require("../common.inc.php");
- require_once("../user.inc.php");
- require_once("../schedule.inc.php");
-
- user_auth_required('admin');
-
- if($_GET['action']=="loadschedule") {
-	 $date=$_POST['date'];
-	 $starthour=$_POST['starthour'];
-	 $endhour=$_POST['endhour'];
-
-	 //do some sanity checks
-	 if($starthour<0 || $starthour>24) $starthour=8;
-	 if($endhour<$starthour)
-		 $endhour=$starthour+10;
-	 if($endhour<0 || $endhour>24) $endhour=15;
-
-	 //minute increment
-	 $increment=15;
-
-	 if(!eregi("[0-9]{4}-[0-9]{2}-[0-9]{2}",$date)) {
-		 echo "Invalid date";
-		 exit;
-	 }
-	 echo "<h3>".i18n("Schedule for %1",array(format_date($date)))."</h3>";
-	 $q=mysql_query("SELECT * FROM locations WHERE conferences_id='{$conference['id']}' ORDER BY name");
-	 while($r=mysql_fetch_object($q)) {
-		 $locations[$r->id]=$r->name;
-	 }
-	 if(!count($locations)) {
-		 echo error(i18n("There are no locations defined.  Please set up your locations first"));
-		 echo "<a href=\"locations.php\">".i18n("Location Editor")."</a>\n";
-		 exit;
-	 }
-
-	echo "<table class=\"schedule\" id=\"schedule\">\n";
-	echo "<tr>";
-	echo "<th style=\"width: 50px;\">&nbsp;</th>";
-	foreach($locations AS $id=>$name) {
-		echo " <th>$name</th>\n";
-	}
-	for($h=$starthour;$h<$endhour;$h++) {
-		for($m=0;$m<60;$m+=$increment) {
-			echo "<tr>";
-			echo " <td class=\"scheduletime\">";
-			if($m==0) {
-				echo format_time("$h:$m");
-			}
-			echo "</td>";
-			foreach($locations AS $id=>$name) {
-				echo "<td id=\"{$h}_{$m}_{$id}\" onclick=\"clickTableCell(this)\"><div>";
-				echo "</div></td>";
-			}
-			echo "</tr>";
-		}
-	}
-	echo "</table>\n";
-
-	$js="var eventdivs=new Array();\n";
-	
-	//now make all our DIV's for the events that are scheduled in the database
-	$x=0;
-	//they will be moved by javascript after the fact
-	$q=mysql_query("SELECT schedule.*, events.name, events.eventtype FROM schedule JOIN events ON schedule.events_id=events.id WHERE schedule.conferences_id='{$conference['id']}' AND date='{$date}'");
-	echo mysql_error();
-	while($r=mysql_fetch_object($q)) {
-		echo "<div class=\"scheduleevent scheduleevent_{$r->eventtype}\" id=\"event_{$r->id}\" onclick=\"editEvent($r->id)\">";
-		echo "<div style=\"width: 99%; text-align: right;\"><a href=\"#\" onclick=\"return deleteEvent(event,$r->id)\"><img style=\"border: 0px;\" src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.{$config['icon_extension']}\"></a></div>\n";
-		echo "<span class=\"scheduleevent_title\">";
-		echo $r->title;
-		echo "</span>";
-		echo "<br />";
-		$starttime=strtotime($r->hour.":".$r->minute);
-		$endtime=$starttime+$r->duration*60;
-		echo format_time($starttime);
-		echo " to ";
-		echo format_time($endtime);
-		echo "<br />";
-
-		if($r->eventtype=="scienceolympic") {
-
-			$regteams=getNumRegistrations($r->id);
-			$minteams=$r->sominteams;
-			$maxteams=$r->somaxteams;
-			if($regteams<$minteams || $regteams >$maxteams) 
-				$cl="class=\"error\"";
-			else $cl="";
-			echo "<span $cl>";
-			echo i18n("Teams")." : ";
-			echo i18n("%1 of %2-%3",array($regteams,$minteams,$maxteams));
-			echo "</span>";
-			echo "<br />";
-
-			$regjudges=getNumJudges($r->id);
-			$minjudges=$r->sominjudges;
-			$maxjudges=$r->somaxjudges;
-			if($regjudges<$minjudges || $regjudges >$maxjudges) 
-				$cl="class=\"error\"";
-			else $cl="";
-			echo "<span $cl>";
-			echo i18n("Judges")." : ";
-			echo i18n("%1 of %2-%3",array($regjudges,$minjudges,$maxjudges));
-			echo "</span>";
-			echo "<br />";
-
-			$regvolunteers=getNumVolunteers($r->id);
-			$minvolunteers=$r->sominvolunteers;
-			$maxvolunteers=$r->somaxvolunteers;
-			if($regvolunteers<$minvolunteers || $regvolunteers>$maxvolunteers) 
-				$cl="class=\"error\"";
-			else $cl="";
-			echo "<span $cl>";
-			echo i18n("Volunteers")." : ";
-			echo i18n("%1 of %2-%3",array($regvolunteers,$minvolunteers,$maxvolunteers));
-			echo "</span>";
-		}
-
-		echo "</div>";
-		$js.="eventdivs[$r->id]={hour:$r->hour,minute:$r->minute,location:$r->locations_id,duration:$r->duration};\n";
-		$x++;
-	}
-	$js.="\n\nvar eventdefaults=new Array();\n";
-	$q=mysql_query("SELECT events.* FROM events WHERE conferences_id='{$conference['id']}'");
-	while($r=mysql_fetch_array($q)) {
-		$js.="eventdefaults[{$r['id']}]=".json_encode($r)."\n";
-	}
-
-	echo "<script type=\"text/javascript\">\n";
-	echo $js;
-	echo "</script>";
- }
- else if($_GET['action']=="loadevent") {
-	 $id=intval($_GET['id']);
-	 $q=mysql_query("SELECT schedule.*, events.name, events.eventtype FROM schedule, events WHERE schedule.id='$id' AND schedule.conferences_id='{$conference['id']}' AND schedule.events_id=events.id");
-	 echo mysql_error();
-	 if($r=mysql_fetch_assoc($q)) {
-		 $r['idtype']=$r['events_id'].":".$r['eventtype'];
-		 $teams=array();
-		 $teamq=mysql_query("SELECT so_teams.id,
-		 						so_teams.name AS teamname,
-		 						schools.school AS schoolname
-							FROM 
-								so_teams
-								JOIN schedule_registrations ON so_teams.id=schedule_registrations.so_teams_id
-								JOIN schools ON so_teams.schools_id=schools.id
-							 WHERE 
-							 	schedule_registrations.conferences_id='{$conference['id']}' 
-							 	AND so_teams.conferences_id='{$conference['id']}' 
-								AND schedule_registrations.schedule_id='$id'");
-		 echo mysql_error();
-		 while($teamr=mysql_fetch_assoc($teamq)) {
-			 $teams[]=$teamr;
-		 }
-		 $r['teams']=$teams;
-		 echo json_encode($r);
-	 }
-	 else 
-		 echo json_encode(array("id"=>0));
-	 exit;
- }
- else if($_GET['action']=="saveevent") {
-	 $id=intval($_POST['id']);
-	 list($event_id,$event_type)=explode(":",$_POST['event_id']);
-	 if($event_id>0) {
-		 if(!$id) {
-			 mysql_query("INSERT INTO schedule (conferences_id) VALUES ('{$conference['id']}')");
-			 $id=mysql_insert_id();
-		 }
-		 mysql_query("UPDATE schedule SET
-			title='".mysql_real_escape_string($_POST['title'])."',
-			date='".mysql_real_escape_string($_POST['date'])."',
-			hour='".mysql_real_escape_string($_POST['hour'])."',
-			minute='".mysql_real_escape_string($_POST['minute'])."',
-			duration='".mysql_real_escape_string($_POST['duration'])."',
-			events_id='$event_id',
-			locations_id='".mysql_real_escape_string($_POST['location_id'])."',
-			sominteams='".mysql_real_escape_string($_POST['sominteams'])."',
-			somaxteams='".mysql_real_escape_string($_POST['somaxteams'])."',
-			sominjudges='".mysql_real_escape_string($_POST['sominjudges'])."',
-			somaxjudges='".mysql_real_escape_string($_POST['somaxjudges'])."',
-			sominvolunteers='".mysql_real_escape_string($_POST['sominvolunteers'])."',
-			somaxvolunteers='".mysql_real_escape_string($_POST['somaxvolunteers'])."',
-			sominteamsize='".mysql_real_escape_string($_POST['sominteamsize'])."',
-			somaxteamsize='".mysql_real_escape_string($_POST['somaxteamsize'])."'
-			WHERE id='$id' AND conferences_id='{$conference['id']}'");
-		 echo mysql_error();
-		 happy_("Event successfully saved");
-	 } else {
-		 error_("Error saving event - You must select an event");
-	 }
-	 exit;
- }
- else if($_GET['action']=="deleteevent") {
-	 $id=intval($_POST['id']);
-	 $q=mysql_query("SELECT * FROM schedule_registrations WHERE schedule_id='{$id}' AND conferences_id='{$conference['id']}'");
-	 if(mysql_num_rows($q)) {
-		 error_("Cannot remove an event that has teams registered for it.  Remove the teams first");
-	 }
-	 else {
-		 mysql_query("DELETE FROM schedule WHERE conferences_id='{$conference['id']}' AND id='{$id}'");
-		 happy_("Event successfully removed from the schedule");
-	 }
-	 exit;
- }
- else {
-
- send_header("Schedule Management", 
- 	array('Committee Main' => 'committee_main.php',
-		'Administration' => 'admin/index.php',
-		'Events & Scheduling' => 'admin/eventsscheduling.php'),
-        "events_scheduling" );
- echo "<br />";
- ?>
- <script type="text/javascript">
- $(document).ready(function() {
-	$(".date").datepicker({ dateFormat: 'yy-mm-dd' });
-	changeDate();
-
-	/* Setup the editor dialog */
-	$("#event_editor_dialog").dialog({
-			bgiframe: true, autoOpen: false,
-			modal: true, resizable: false,
-			draggable: false,
-			buttons: { 
-				"<?=i18n('Cancel')?>": function() { 
-					$(this).dialog("close"); 
-				},
-				"<?=i18n('Save')?>": function() { 
-					saveEvent();	
-					$(this).dialog("close"); 
-				} 
-			} 
-		});
-	$(window).resize(function() {
-		placeEvents();
-	}
-	);
- });
-
- function changeDate() {
-	 $("#schedulediv").load("schedule.php?action=loadschedule",{date:$("#date").val(),starthour:$("#starthour").val(),endhour:$("#endhour").val()},function() {
-		 placeEvents();
-	 });
- }
-
- function clickTableCell(t) {
-	 var p=$("#"+t.id).offset();
-	 editEvent(null,t.id);
-
-
- }
-
- function placeEvents() {
-	 $('.scheduleevent').each(function(idx,item) {
-		 var eventid=item.id.substr(6);
-		 var eventobj=eventdivs[eventid];
-
-		 var tablecellid=eventobj.hour+'_'+eventobj.minute+'_'+eventobj.location;
-
-		 if($("#"+tablecellid).length) {
-			 var eheight=((eventobj.duration/15)*<?=$ROWHEIGHT?>)-<? echo $BORDERSIZE*2; ?>;
-			 var ewidth=$("#"+tablecellid).width()-<? echo $BORDERSIZE*2; ?>;
-			 var p=$("#"+tablecellid).offset();
-			 $("#"+item.id).css(p);
-			 $("#"+item.id).show();
-			 $("#"+item.id).height(eheight);
-			 $("#"+item.id).width(ewidth);
-		 }
-		 else {
-			 $("#"+item.id).hide();
-		 }
-	 }
-	 );
- }
-
- function editEvent(id,cell) {
-	if(id) {
-		var eventobj=eventdivs[id];
-		$("#event_editor_dialog").dialog('option','title','Edit Event');
-
-		$.getJSON("schedule.php?action=loadevent&id="+id,function(json) {
-			$("#edit_event").val(json.idtype);
-			event_change();
-
-			//general tab
-			$("#edit_schedule_id").val(json.id);
-			$("#edit_title").val(json.title);
-			$("#edit_date").val(json.date);
-			$("#edit_hour").val(json.hour);
-			$("#edit_minute").val(json.minute);
-			$("#edit_duration").val(json.duration);
-			$("#edit_location").val(json.locations_id);
-
-			//we do this here to set the tabs properly, becuase it also sets the defaults, then we'll override the defaults wth
-			//teh real values below
-
-			if(json.eventtype=="scienceolympic") {
-				//science olympics tab
-				$("#edit_sominteams").val(json.sominteams);
-				$("#edit_somaxteams").val(json.somaxteams);
-
-				$("#edit_sominjudges").val(json.sominjudges);
-				$("#edit_somaxjudges").val(json.somaxjudges);
-
-				$("#edit_sominvolunteers").val(json.sominvolunteers);
-				$("#edit_somaxvolunteers").val(json.somaxvolunteers);
-
-				$("#edit_sominteamsize").val(json.sominteamsize);
-				$("#edit_somaxteamsize").val(json.somaxteamsize);
-
-				var s='<table class="summarytable"><tr><th><?=i18n("Team Name")?></th><th><?=i18n("School Name")?></th></tr>';
-
-				for(var i=0;i<json.teams.length;i++) {
-					var t=json.teams[i];
-					s+='<tr><td>'+t.teamname+'</td><td>'+t.schoolname+'</td></tr>';
-				}
-				s+='</table>';
-				$("#event_editor_tab_scienceolympics_registeredteams").html(s);
-			}
-
-			$("#schedule_tabs").tabs('select',0);
-		});
-	}
-	else {
-	 $("#event_editor_dialog").dialog('option','title','Create Event');
-	 	var a=cell.split("_");
-			$("#edit_event").val("");
-			event_change();
-			$("#edit_schedule_id").val(0);
-			$("#edit_title").val("");
-			$("#edit_date").val($("#date").val());
-			$("#edit_hour").val(a[0]);
-			$("#edit_minute").val(a[1]);
-			$("#edit_duration").val(60);
-			$("#edit_location").val(a[2]);
-
-			//science olympics tab
-			$("#edit_somaxteams").val("");
-			$("#edit_sominteams").val("");
-
-			$("#edit_somaxjudges").val("");
-			$("#edit_sominjudges").val("");
-
-			$("#edit_somaxvolunteers").val("");
-			$("#edit_sominvolunteers").val("");
-
-			$("#edit_sominteamsize").val("");
-			$("#edit_somaxteamsize").val("");
-
-			$("#schedule_tabs").tabs('select',0);
-
-			$("#event_editor_tab_scienceolympics_registeredteams").html("");
-
-	}
-	$("#event_editor_dialog").dialog('option','width',600);
-	$("#event_editor_dialog").dialog('option','height',400);
-	$("#event_editor_dialog").dialog('open');
-
- }
-
- function saveEvent() {
-	 var o=$("#edit_event_form").serializeArray();
-	 //alert(o);
-	 $("#debug").load("schedule.php?action=saveevent",o,function() {
-		 changeDate();
-	 });
- }
- function deleteEvent(event,id) {
-	 event.stopPropagation();
-
-	 if(confirmClick('Are you sure you want to remove this event from the schedule?')) {
-		 $("#debug").load('schedule.php?action=deleteevent',{id:id},function() {
-			 changeDate();
-		 });
-	 }
-	 return false;
- }
- </script>
-
- <?
- if(!$editdate) {
-	 list($editdate,$bla)=explode(" ",$config['dates']['fairdate']);
- }
- ?>
-<form method="post">
-<?  echo i18n("Schedule date"); ?>
- <input id="date" class="date" type="text" name="date" value="<?=$editdate?>" size="15" onchange="changeDate()">
-<?  echo i18n("Start hour")." ";
-	emit_hour_selector("starthour",8,"id=\"starthour\" onchange=\"changeDate()\"");
-    echo i18n("End hour")." ";
-	emit_hour_selector("endhour",15,"id=\"endhour\" onchange=\"changeDate()\"");
-?>
- </form>
- <hr />
- <div id="schedulediv">
- </div>
- <div id="event_editor_dialog">
- <? include "schedule_edit_dialog.php"; ?>
- </div>
- <?
-
- send_footer();
-
- }
-?>

admin/schedule_edit_dialog.php

@@ -1,209 +0,0 @@
-<script type="text/javascript">
-$(document).ready(function() {
-	$("#schedule_tabs").tabs({ 
-		show: function(event, ui) { 
-		switch(ui.panel.id) { 
-			case 'schedule_tab_general': 
-				update_tab_general(); 
-			break; 
-			case 'schedule_tab_scienceolympics': 
-				update_tab_scienceolympics(); 
-			break; 
-			} 
-		}, 
-		selected: 0 
-	});
-	event_change();
-});
-
-function update_tab_general() {
-}
-
-function update_tab_scienceolympics() {
-}
-
-function event_change() {
-	var ea=$("#edit_event").val().split(":");
-	//if its not set, we must be on "choose" still, so disable the other tabs until they choose something
-	//then get the heck out of here
-	if(!ea[1]) {
-		$("#schedule_tabs").tabs("option","disabled",[1,2,3]);
-		return;
-	}
-	//ea[1] is the type
-	switch(ea[1]) {
-		case "":
-		case "general":
-		$("#schedule_tabs").tabs("option","disabled",[1,2,3]);
-		break;
-		case "scienceolympic":
-		$("#schedule_tabs").tabs("option","disabled",[2,3]);
-		break;
-		case "sciencefairjudging":
-		$("#schedule_tabs").tabs("option","disabled",[1,3]);
-		break;
-		case "tour":
-		$("#schedule_tabs").tabs("option","disabled",[1,2]);
-		break;
-		default:
-		return;
-	}
-
-/*
-	if($("#edit_title").val().length) {
-		//umm if it already exists, dont change it
-		//no, screw it, change it anyways
-	}
-	else
-	{
-		*/
-		if($("#edit_event").val())
-			$("#edit_title").val($("#edit_event option:selected").text());
-	//}
-	var ed=eventdefaults[ea[0]];
-	$("#edit_sominteams").val(ed.default_min_teams);
-	$("#edit_somaxteams").val(ed.default_max_teams);
-
-	$("#edit_sominjudges").val(ed.default_min_judges);
-	$("#edit_somaxjudges").val(ed.default_max_judges);
-
-	$("#edit_sominvolunteers").val(ed.default_min_volunteers);
-	$("#edit_somaxvolunteers").val(ed.default_max_volunteers);
-
-	$("#edit_somaxteamsize").val(ed.default_max_team_size);
-	$("#edit_sominteamsize").val(ed.default_min_team_size);
-}
-
-</script>
-    <div id="schedule_tabs">
-        <ul>
-            <li><a href="#schedule_tab_general"><span><?=i18n('General')?></span></a></li>
-            <li><a href="#schedule_tab_scienceolympics"><span><?=i18n('Science Olympics')?></span></a></li>
-            <li><a href="#schedule_tab_sciencefairjudging"><span><?=i18n('Science Fair Judging')?></span></a></li>
-            <li><a href="#schedule_tab_tour"><span><?=i18n('Tour')?></span></a></li>
-        </ul>
-		<form method="post" id="edit_event_form">
-        <div id="schedule_tab_general">
-
-<?
-
-
-
-echo "<input type=\"hidden\" name=\"id\" id=\"edit_schedule_id\">";
-echo "<table style=\"width: 95%;\">";
-echo "<tr><td>";
-echo i18n("Event").": ";
-echo "</td><td>";
-echo "<select name=\"event_id\" id=\"edit_event\" onchange=\"event_change()\">";
-echo "<option value=\"\">".i18n("Choose")."</option>\n";
-$q=mysql_query("SELECT * FROM events WHERE conferences_id='{$conference['id']}' ORDER BY name");
-while($r=mysql_fetch_object($q)) {
-	echo "<option value=\"$r->id:$r->eventtype\">$r->name</option>\n";
-}
-echo "</select>\n";
-echo "</td><td>";
-echo i18n("Location").": ";
-echo "</td><td>";
-echo "<select name=\"location_id\" id=\"edit_location\">";
-echo "<option value=\"\">".i18n("Choose")."</option>\n";
-$q=mysql_query("SELECT * FROM locations WHERE conferences_id='{$conference['id']}' ORDER BY name");
-while($r=mysql_fetch_object($q)) {
-	echo "<option value=\"$r->id\">$r->name</option>\n";
-}
-echo "</select>\n";
-echo "</td></tr>\n";
-
-
-echo "<tr><td>";
-echo i18n("Title").": ";
-echo "</td><td>";
-echo "<input id=\"edit_title\" type=\"text\" name=\"title\" size=\"20\">";
-
-echo "</td><td>";
-
-echo i18n("Date").": ";
-echo "</td><td>";
-echo "<input id=\"edit_date\" type=\"text\" name=\"date\" class=\"date\" size=\"12\">";
-echo "</td><td>";
-echo "</td><td>";
-echo "</td></tr>\n";
-
-echo "<tr><td>";
-
-echo i18n("Start at").": ";
-echo "</td><td>";
-emit_hour_selector('hour',"","id=\"edit_hour\"");
-echo ":";
-emit_minute_selector('minute',"","id=\"edit_minute\"",15);
-
-
-echo "</td><td>";
-
-echo i18n("Duration").": ";
-echo "</td><td>";
-echo "<input id=\"edit_duration\" type=\"text\" name=\"duration\" size=\"4\">";
-echo "minutes";
-echo "</td></tr>\n";
-echo "</table>";
-
-?>
-
-        </div>
-        <div id="schedule_tab_scienceolympics">
-<table>
-<tr>
- <th></th>
- <th><?=i18n("Minimum")?></th>
- <th><?=i18n("Maximum")?></th>
-</tr>
-
-<tr>
- <td><?=i18n("Number of Teams")?></td>
- <td><input type="text" name="sominteams" id="edit_sominteams" size="4"></td>
- <td><input type="text" name="somaxteams" id="edit_somaxteams" size="4"></td>
-</tr>
-
-<tr>
- <td><?=i18n("Team Member Size")?></td>
- <td><input type="text" name="sominteamsize" id="edit_sominteamsize" size="4"></td>
- <td><input type="text" name="somaxteamsize" id="edit_somaxteamsize" size="4"></td>
-</tr>
-
-<tr>
- <td><?=i18n("Number of Judges")?></td>
- <td><input type="text" name="sominjudges" id="edit_sominjudges" size="4"></td>
- <td><input type="text" name="somaxjudges" id="edit_somaxjudges" size="4"></td>
-</tr>
-
-<tr>
- <td><?=i18n("Number of Volunteers")?></td>
- <td><input type="text" name="sominvolunteers" id="edit_sominvolunteers" size="4"></td>
- <td><input type="text" name="somaxvolunteers" id="edit_somaxvolunteers" size="4"></td>
-</tr>
-
-</table>
-<?
-
-echo "<h4>".i18n("Judges")."</h4>";
-echo "<table style=\"width: 95%;\">";
-echo "<tr>";
-echo "<td>";
-echo "</td><td>";
-echo "FIXME: show list of registered judges to choose from";
-echo "</td></tr>";
-echo "</table>";
-
-echo "<h4>".i18n("Registered Teams")."</h4>";
-echo "<div id=\"event_editor_tab_scienceolympics_registeredteams\"></div>";
-echo "</div>\n";
-
-
-?>
-        </div>
-        <div id="schedule_tab_sciencefairjudging">
-        </div>
-        <div id="schedule_tab_tour">
-        </div>
-		</form>
-    </div>
-

admin/schools.php

@@ -24,319 +24,178 @@
 <?
  require("../common.inc.php");
  require_once("../user.inc.php");
- user_auth_required('admin');
+ user_auth_required('committee', 'admin');
-
-function output_user_summary($userid) {
-	$user = user_load($userid);
-	$account = account_load($user['accounts_id']);
-	if(!$user || !$account) {
-		echo "Invalid User ID ($userid)";
-		return;
-	}
-	echo i18n("Account").": ";
-	if($account['username']==$account['email']) {
-		echo $account['username'];
-	} else {
-		echo $account['username'];
-		if($account['email']) echo " / ".$account['email'];
-	}
-	echo "<br />";
-	echo i18n("Name").": ";
-	echo $user['firstname']." ".$user['lastname']."<br />";
-	if($user['phonework'] || $user['phonehome'] || $user['phonecell']) {
-		echo i18n("Phone").": ";
-		if($user['phonework']) echo "(W)".$user['phonework']." ";  
-		if($user['phonehome']) echo "(H)".$user['phonehome']." ";  
-		if($user['phonecell']) echo "(C)".$user['phonecell']." ";  
-		echo "<br />";
-	}
-}
 
 
-if($_POST['action']=="removeuser") {
+	if($_POST['save']=="edit" || $_POST['save']=="add")
-	$schoolid=intval($_POST['schoolid']);
+	{
-	if($_POST['role']=="principal") {
+		if($_POST['save']=="add")
-		$f="principal_uid";
+		{
-	} else if($_POST['role']=="teacher") {
+			$q=$pdo->prepare("INSERT INTO schools (year) VALUES ('".$config['FAIRYEAR']."')");
-		$f="sciencehead_uid";
+			$q->execute();
-	}
+			$id=$pdo->lastInsertId();
-	if($f) {
-		mysql_query("UPDATE schools SET $f=NULL WHERE id='$schoolid'");
-	}
-	echo "ok";
-	exit;
-}
-else if($_POST['action']=="adduser") {
-	/* we have the following to work with:
-		accounts_id, conferenceid, field, role, username, users_id
-		*/
-	
-	//if accounts_id is 0, it means its a new user
-	$accounts_id=intval($_POST['accounts_id']);
-	$conferenceid=intval($_POST['conferenceid']);
-	$schoolid=intval($_POST['schoolid']);
-
-	if($accounts_id==0) {
-		$a=account_create($_POST['username']);
-		if(isEmailAddress($_POST['username']))
-			account_set_email($a['id'],$_POST['username']);
-		//and load it again, just so we have the most up-to-date
-		$a=account_load($a['id']);
-	}
-	else
-		$a=account_load($accounts_id);
-
-	//now lets add the role -- this fails gracefully if they already have the role, or if its added, in both cases it returns 'ok'
-	$ret=account_add_role($a['id'],$_POST['role'],$conferenceid);
-
-	//we still need the user id
-	$u=user_load_by_accounts_id($a['id']);
-
-	if($ret=='ok' && $u['id']) {
-		mysql_query("UPDATE schools SET `".mysql_real_escape_string($_POST['field'])."`='{$u['id']}' WHERE id='$schoolid'");
-		echo mysql_error();
-		//and update the users schools_id, yes, maybe we should use the user object and user_save() but the single query here is easier and probably waaaaaay faster
-		mysql_query("UPDATE users SET schools_id='$schoolid' WHERE id='{$u['id']}'");
-		echo mysql_error();
-		echo "ok";
-	}
-	else {
-		echo "error\n";
-		echo "ret=$ret\n";
-		echo "u="; print_r($u);
-		//error ?
-	}
-	exit;
-}
-
-if($_GET['action']=='loaduser') {
-	$schoolid=intval($_GET['schoolid']);
-	$role=$_GET['role'];
-
-	if($role=="principal") {
-		$f="principal_uid";
-	} else if($role=="teacher") {
-		$f="sciencehead_uid";
-	}
-	$q=mysql_query("SELECT $f AS userid FROM schools WHERE id='$schoolid'");
-	$r=mysql_fetch_object($q);
-
-	if($r->userid > 0) {
-		//we already have one, so just display teh details, with the option to remove or edit
-		echo "<td align=\"right\">";
-		echo "<a onclick=\"return openeditor($r->userid); return false;\" href=\"#\"><img border=\"0\" src=\"".$config['SFIABDIRECTORY']."/images/16/edit.".$config['icon_extension']."\"></a>";
-		echo "&nbsp;";
-		echo "<a onclick=\"return removeUserFromSchool('$role',$schoolid)\"
-		href=\"#\"><img border=0 src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\"></a>";
-		echo "</td><td>";
-		output_user_summary($r->userid);
-		echo "</td>";
-
-		echo "</tr>";
-	}
-	else {
-		echo "<td align=\"right\">".i18n("Email/username")." </td>";
-		echo "<td>";
-		emit_user_selector($f,$conference['id'],$role);
-		echo "</td>";
-	}
-	exit;
-
-}
-
-
-
-function emit_user_selector($name,$conferenceid,$role,$allowcreate=true) {
-	echo "<!--begin emit_user_selector ($name,$conferenceid,$role,$allowcreate)-->\n";
-	echo "<input type=\"hidden\" id=\"{$name}_role\" name=\"{$name}_role\" value=\"$role\">";
-	echo "<input type=\"hidden\" id=\"{$name}_conferenceid\" name=\"{$name}_conferenceid\" value=\"$conferenceid\">";
-	echo "<input type=\"text\" class=\"user_select_autocomplete\" size=\"45\" id=\"{$name}\" name=\"{$name}\">";
-	echo "<!--end emit_user_selector-->\n";
-}
-
-
-	if($_POST['save']=="edit" || $_POST['save']=="add") {
-		if($_POST['save']=="add") {
-			$q=mysql_query("INSERT INTO schools (conferences_id) VALUES ('".$conference['id']."')");
-			$id=mysql_insert_id();
 		}
 		else
 			$id=intval($_POST['id']);
 
 		$atrisk = $_POST['atrisk'] == 'yes' ? 'yes' : 'no';
 
+/*
+			"sciencehead='".mysql_escape_string(stripslashes($_POST['sciencehead']))."', ".
+			"scienceheadphone='".mysql_escape_string(stripslashes($_POST['scienceheadphone']))."', ".
+			"scienceheademail='".mysql_escape_string(stripslashes($_POST['scienceheademail']))."', ".
+			"principal='".mysql_escape_string(stripslashes($_POST['principal']))."', ".
+*/
+
+		/* Get the uids for principal/science head */
+		$q = $pdo->prepare("SELECT principal_uid,sciencehead_uid FROM schools WHERE id='$id'");
+		$q->execute();
+		$i = $q->fetch(PDO::FETCH_ASSOC);
+
+		$principal_update = '';
+		$sciencehead_update = '';
+		list($first, $last) = split(' ', $_POST['principal'], 2);
+		/* Load existing entry if it exists, else make an entry if
+		 * there is data, else, do nothing */
+		if($i['principal_uid'] > 0) 
+			$pl = user_load_by_uid($i['principal_uid']);
+		else if($first != '' && $last != '') {
+			$pl = user_create('principal', "*$first$last".user_generate_password());
+			$principal_update = "principal_uid='{$pl['uid']}',";
+		} else 
+			$pl = false;
+
+		$em = $_POST['principalemail'];
+
+		/* If we loaded or created an entry, either
+		 * update and save, or purge it */
+		if(is_array($pl)) {
+			if($first == '' && $last == '') {
+				user_purge($pl, 'principal');
+				$principal_update = 'principal_uid=NULL,';
+			} else {
+				$pl['firstname'] = $first;
+				$pl['lastname'] = $last;
+				$pl['email'] = $em;
+				user_save($pl);
+			}
+		} 
+
+
+		/* Get info about science head */
+		list($first, $last) = split(' ', $_POST['sciencehead'], 2);
+		$em = $_POST['scienceheademail'];
+		if($em == '' && ($first != '' || $last != '')) $em = "*$first$last".user_generate_password();
+		/* Load existing record, or create new if there's something
+		 * to insert */
+		$sh = false;
+		if($i['sciencehead_uid'] > 0) {
+			$sh = user_load_by_uid($i['sciencehead_uid']);
+			/* It's possile for sh to be false now, happens when the user is
+			 * deleted outside the school editor, this condition needs to be
+			 * fixed.  If we let it go, the saving the teacher info will
+			 * silently fail.  So let's just create a new teacher */
+
+			if(is_array($sh) && ($em != $sh['email'] || $em=='')) {
+				/* If the emails don't match we have no way of knowing if we're creating a different
+				 * user, or doing a correction, assume it's a different user */
+				 user_purge($sh, 'teacher');
+				 $sh = false;
+			}
+		}
+
+		/* If there was no teacher loaded, or if we just purged it, create a new one
+		 * if there's an email address */
+		if($sh == false && $em != '')  {
+			$sh = user_create('teacher', $em);
+			$sciencehead_update = "sciencehead_uid='{$sh['uid']}',";
+		}
+
+		/* If we have a record update it */
+		if(is_array($sh)) {
+			$sh['firstname'] = $first;
+			$sh['lastname'] = $last;
+			$sh['phonework'] = $_POST['scienceheadphone'];
+			$sh['email'] = $em; 
+			$sh['username'] = $em; 
+			user_save($sh);
+		}
+
 		$exec="UPDATE schools SET ".
-			"school='".mysql_escape_string(stripslashes($_POST['school']))."', ".
+			"school='".stripslashes($_POST['school'])."', ".
-			"schoollang='".mysql_escape_string(stripslashes($_POST['schoollang']))."', ".
+			"schoollang='".stripslashes($_POST['schoollang'])."', ".
-			"designate='".mysql_escape_string(stripslashes($_POST['schooldesignate']))."', ".
+			"designate='".stripslashes($_POST['schooldesignate'])."', ".
-			"schoollevel='".mysql_escape_string(stripslashes($_POST['schoollevel']))."', ".
+			"schoollevel='".stripslashes($_POST['schoollevel'])."', ".
-			"school='".mysql_escape_string(stripslashes($_POST['school']))."', ".
+			"school='".stripslashes($_POST['school'])."', ".
-			"board='".mysql_escape_string(stripslashes($_POST['board']))."', ".
+			"board='".stripslashes($_POST['board'])."', ".
-			"district='".mysql_escape_string(stripslashes($_POST['district']))."', ".
+			"district='".stripslashes($_POST['district'])."', ".
-			"address='".mysql_escape_string(stripslashes($_POST['address']))."', ".
+			"address='".stripslashes($_POST['address'])."', ".
-			"city='".mysql_escape_string(stripslashes($_POST['city']))."', ".
+			"city='".stripslashes($_POST['city'])."', ".
-			"province_code='".mysql_escape_string(stripslashes($_POST['province_code']))."', ".
+			"province_code='".stripslashes($_POST['province_code'])."', ".
-			"postalcode='".mysql_escape_string(stripslashes($_POST['postalcode']))."', ".
+			"postalcode='".stripslashes($_POST['postalcode'])."', ".
-			"schoolemail='".mysql_escape_string(stripslashes($_POST['schoolemail']))."', ".
+			"schoolemail='".stripslashes($_POST['schoolemail'])."', ".
-			"phone='".mysql_escape_string(stripslashes($_POST['phone']))."', ".
+			"phone='".stripslashes($_POST['phone'])."', ".
-			"fax='".mysql_escape_string(stripslashes($_POST['fax']))."', ".
+			"fax='".stripslashes($_POST['fax'])."', ".
-			"registration_password='".mysql_escape_string(stripslashes($_POST['registration_password']))."', ".
+			"registration_password='".stripslashes($_POST['registration_password'])."', ".
-			"projectlimit='".mysql_escape_string(stripslashes($_POST['projectlimit']))."', ".
+			"projectlimit='".stripslashes($_POST['projectlimit'])."', ".
-			"projectlimitper='".mysql_escape_string(stripslashes($_POST['projectlimitper']))."', ".
+			"projectlimitper='".stripslashes($_POST['projectlimitper'])."', ".
-			"accesscode='".mysql_escape_string(stripslashes($_POST['accesscode']))."', ".
+			"accesscode='".stripslashes($_POST['accesscode'])."', ".
+			$sciencehead_update.$principal_update.
 			"atrisk='$atrisk' ".
 			"WHERE id='$id'";
-		mysql_query($exec);
+		$stmt = $pdo->prepare($exec);
-		echo mysql_error();
+		$stmt->execute();
+		echo $pdo->errorInfo();
 
 		if($_POST['save']=="add")
 			$notice = 'added';
 		else
 			$notice = 'saved';
 	}
-	else if($_POST['action'] == "save_participation") {
-		// update the schools' participation in fairs an olympics to reflect the settings submitted
-		$olympicSet = array();
-		$fairSet = array();
-		foreach($_POST as $idx => $value){
-			if(preg_match('/_olympics$/', $idx)){
-				$parts = explode('_', $idx);
-				$olympicSet[] = $parts[0];
-			}else if(preg_match('/_fairs$/', $idx)){
-				$parts = explode('_', $idx);
-				$fairSet[] = $parts[0];
-			}
-		}
-		$fairString = '(' . implode(',', $fairSet) . ')';
-		$olympicString = '(' . implode(',', $olympicSet) . ')';
-		mysql_query("UPDATE schools SET include_fairs = TRUE WHERE id IN $fairString");
-		mysql_query("UPDATE schools SET include_fairs = FALSE WHERE id NOT IN $fairString");
-		mysql_query("UPDATE schools SET include_olympics = TRUE WHERE id IN $olympicString");
-		mysql_query("UPDATE schools SET include_olympics = FALSE WHERE id NOT IN $olympicString");
-	}
-	else if($_POST['action']=="copy") {
-		$oldConfId=intval($_POST['copyconference']);
-		$newConfId=intval($conference['id']);
-		if($oldConfId && $newConfId) {
 
-			$q=mysql_query("SELECT * FROM schools WHERE conferences_id=$oldConfId");
+	if($_GET['action']=="delete" && $_GET['delete'])
-
+	{
-			while($r=mysql_fetch_object($q)) {
+		$stmt = $pdo->prepare("DELETE FROM schools WHERE id='".$_GET['delete']."'");
-				//FIXME: we need to roll the userid's to new ones for the new conference, if we use the same ones its not gonna work
+		$stmt->execute();
-				//nobody should be copying for now, so we should be safe for a few months
-				//2011-02-22
-				$puid = ($r->principal_uid == null) ? 'NULL' : ("'".intval($r->principal_uid)."'");
-				$shuid = ($r->sciencehead_uid == null) ? 'NULL' : ("'".intval($r->sciencehead_uid)."'");
-
-				mysql_query("INSERT INTO schools (school,schoollang,schoollevel,board,district,phone,fax,address,city,province_code,postalcode,principal_uid,schoolemail,sciencehead_uid,accesscode,lastlogin,junior,intermediate,senior,registration_password,projectlimit,projectlimitper,conferences_id) VALUES (
-					'".mysql_real_escape_string($r->school)."',
-					'".mysql_real_escape_string($r->schoollang)."',
-					'".mysql_real_escape_string($r->schoollevel)."',
-					'".mysql_real_escape_string($r->board)."',
-					'".mysql_real_escape_string($r->district)."',
-					'".mysql_real_escape_string($r->phone)."',
-					'".mysql_real_escape_string($r->fax)."',
-					'".mysql_real_escape_string($r->address)."',
-					'".mysql_real_escape_string($r->city)."',
-					'".mysql_real_escape_string($r->province_code)."',
-					'".mysql_real_escape_string($r->postalcode)."',$puid,
-					'".mysql_real_escape_string($r->schoolemail)."',$shuid,
-					'".mysql_real_escape_string($r->accesscode)."',
-					NULL,
-					'".mysql_real_escape_string($r->junior)."',
-					'".mysql_real_escape_string($r->intermediate)."',
-					'".mysql_real_escape_string($r->senior)."',
-					'".mysql_real_escape_string($r->registration_password)."',
-					'".mysql_real_escape_string($r->projectlimit)."',
-					'".mysql_real_escape_string($r->projectlimitper)."',
-					'".mysql_real_escape_string($newConfId)."')");
-			}
-			$notice="copied";
-		}
-	}
-
-	if($_GET['action']=="delete" && $_GET['delete']) {
-		mysql_query("DELETE FROM schools WHERE id='".$_GET['delete']."'");
 		$notice = 'deleted';
 	}
 
-	if($_GET['action']=="clearaccesscodes") {
+	if($_GET['action']=="clearaccesscodes")
-		mysql_query("UPDATE schools SET accesscode=NULL WHERE conferences_id='{$conference['id']}'");
+	{
+		$stmt = $pdo->prepare("UPDATE schools SET accesscode=NULL WHERE year='{$config['FAIRYEAR']}'");
+		$stmt->execute();
 		$notice = 'clearaccess';
 	}
 
-	if($_GET['action']=="makeaccesscodes") {
+	if($_GET['action']=="makeaccesscodes")
-		$q=mysql_query("SELECT id FROM schools WHERE conferences_id='{$conference['id']}' AND (accesscode IS NULL OR accesscode='')");
+	{
-		while($r=mysql_fetch_object($q)) {
+		$q=$pdo->prepare("SELECT id FROM schools WHERE year='{$config['FAIRYEAR']}' AND (accesscode IS NULL OR accesscode='')");
+		$q->execute();
+		while($r=$q->fetch(PDO::FETCH_OBJ))
+		{
 			$ac=generatePassword(5);
-			mysql_query("UPDATE schools SET accesscode='$ac' WHERE id='$r->id' AND conferences_id='{$conference['id']}'");
+			$stmt = $pdo->prepare("UPDATE schools SET accesscode='$ac' WHERE id='$r->id' AND year='{$config['FAIRYEAR']}'");
+			$stmt->execute();
 
 		}
 		$notice = 'makeaccess';
 	}
 
-	if($_GET['action']=="edit" || $_GET['action']=="add") {
+	if($_GET['action']=="edit" || $_GET['action']=="add")
- 		send_header(($_GET['action']=='edit') ? "Edit School" : "Add New School",
+	{
 
+ 		send_header(($_GET['action']=='edit') ? "Edit School" : "Add New School",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php',
 			'School Management' => 'admin/schools.php'),
             "schools_management"
 				);
-		$schoolid=intval($_GET['edit']);
+		if($_GET['action']=="edit")
-
+		{
-?>
-<script type="text/javascript">
-function removeUserFromSchool(role,schoolid) {
-	if(!confirmClick('Are you sure you want to remove this '+role+' from the school?'))
-		return false;
-	else {
-		$.post('schools.php',{action: 'removeuser', role: role, schoolid: schoolid},function() { updateUser(role,schoolid); });
-		return false;
-	}
-}
-
-var global_schoolid;
-
-function updateUser(role,schoolid) {
-	global_schoolid=schoolid;
-
-	$("#"+role+"_row").load('schools.php?action=loaduser&role='+role+'&schoolid='+schoolid,null,function() {
-		$(".user_select_autocomplete").autocomplete({ 
-		source: "user_select_autocomplete.php",
-		select: function(event,ui) {
-			var accounts_id=ui.item.accounts_id;
-			var users_id=ui.item.users_id;
-			var username=$(this).val();
-			var field=$(this).attr("name");
-			var conferenceid=$("#"+field+'_conferenceid').val();
-			var role=$("#"+field+'_role').val();
-
-			var options={action: 'adduser', accounts_id: accounts_id, users_id: users_id, username: username, field: field, conferenceid: conferenceid, schoolid: global_schoolid, role: role };
-
-			$.post("schools.php",options,function() {
-				updateUser(role,global_schoolid);
-				});
-			}
-		});
-	});
-}
-
-$(document).ready(function() {
-	updateUser('principal',<?=$schoolid?>);
-	updateUser('teacher',<?=$schoolid?>);
-
-});
-
-</script>
-
-<?
-
-
-		if($_GET['action']=="edit") {
 			$buttontext="Save School";
-			$q=mysql_query("SELECT * FROM schools WHERE id='$schoolid'");
+			$q=$pdo->prepare("SELECT * FROM schools WHERE id='".$_GET['edit']."'");
-			$r=mysql_fetch_object($q);
+			$q->execute();
+			$r=$q->fetch(PDO::FETCH_OBJ);
 		}
 		else if($_GET['action']=="add")
 		{
@@ -348,7 +207,7 @@ $(document).ready(function() {
 		echo "<input type=\"hidden\" name=\"save\" value=\"".$_GET['action']."\">\n";
 
 		if($_GET['action']=="edit")
-			echo "<input type=\"hidden\" name=\"id\" value=\"".$schoolid."\">\n";
+			echo "<input type=\"hidden\" name=\"id\" value=\"".$_GET['edit']."\">\n";
 
 		echo "<table>\n";
 		echo "<tr><td>".i18n("School Name")."</td><td><input type=\"text\" name=\"school\" value=\"".htmlspecialchars($r->school)."\" size=\"60\" maxlength=\"64\" /></td></tr>\n";
@@ -385,25 +244,36 @@ $(document).ready(function() {
 		echo "<tr><td>".i18n("Phone")."</td><td><input type=\"text\" name=\"phone\" value=\"".htmlspecialchars($r->phone)."\" size=\"16\" maxlength=\"16\" /></td></tr>\n";
 		echo "<tr><td>".i18n("Fax")."</td><td><input type=\"text\" name=\"fax\" value=\"".htmlspecialchars($r->fax)."\" size=\"16\" maxlength=\"16\" /></td></tr>\n";
 
+		if($r->principal_uid > 0) 
+			$pl = user_load_by_uid($r->principal_uid);
+		else
+			$pl = array();
+		/* Don't show autogenerated emails */
+		$e = $pl['email'][0] == '*' ? '' : $pl['email'];
+		echo "<tr><td>".i18n("Principal")."</td><td><input type=\"text\" name=\"principal\" value=\"".htmlspecialchars($pl['name'])."\" size=\"60\" maxlength=\"64\" /></td></tr>\n";
+		echo "<tr><td>".i18n("Principal Email")."</td><td><input type=\"text\" name=\"principalemail\" value=\"".htmlspecialchars($e)."\" size=\"60\" maxlength=\"128\" /></td></tr>\n";
+
 		echo "<tr><td>".i18n("School Email")."</td><td><input type=\"text\" name=\"schoolemail\" value=\"".htmlspecialchars($r->schoolemail)."\" size=\"60\" maxlength=\"128\" /></td></tr>\n";
 		echo "<tr><td>".i18n("Access Code")."</td><td><input type=\"text\" name=\"accesscode\" value=\"".htmlspecialchars($r->accesscode)."\" size=\"32\" maxlength=\"32\" /></td></tr>\n";
-
-		echo "<tr><td colspan=2><br /><b>".i18n("Principal")."</b></td></tr>";
-		echo "<tr id=\"principal_row\">";
-		//this gets filled in by javascript/jquery
-		echo "</tr>";
-
 		echo "<tr><td colspan=2><br /><b>".i18n("Science head/teacher or science fair contact at school")."</b></td></tr>";
-		echo "<tr id=\"teacher_row\">";
+		if($r->sciencehead_uid > 0) 
-		//this gets filled in by javascript/jquery
+			$sh = user_load_by_uid($r->sciencehead_uid);
-		echo "</tr>";
+		else 
+			$sh = array();
+		/* Don't show autogenerated emails */
+		$e = $sh['email'][0] == '*' ? '' : $sh['email'];
+		echo "<tr><td>".i18n("Email")."</td><td><input type=\"text\" name=\"scienceheademail\" value=\"".htmlspecialchars($e)."\" size=\"60\" maxlength=\"128\" /></td></tr>\n";
+		echo "<tr><td>".i18n("Name")."</td><td><input type=\"text\" name=\"sciencehead\" value=\"".htmlspecialchars($sh['name'])."\" size=\"60\" maxlength=\"64\" /></td></tr>\n";
+		echo "<tr><td>".i18n("Phone")."</td><td><input type=\"text\" name=\"scienceheadphone\" value=\"".htmlspecialchars($sh['phonework'])."\" size=\"16\" maxlength=\"16\" /></td></tr>\n";
 
-		if($config['participant_registration_type']=="schoolpassword") {
+		if($config['participant_registration_type']=="schoolpassword")
+		{
 			echo "<tr><td colspan=2><br /><b>".i18n("Participant Registration Password")."</b></td></tr>";
 			echo "<tr><td>".i18n("Password")."</td><td><input type=\"text\" name=\"registration_password\" value=\"".htmlspecialchars($r->registration_password)."\" size=\"32\" maxlength=\"32\" /></td></tr>\n";
 		}
 		echo "<tr><td colspan=2><br /><b>".i18n("Participant Registration Limits")."</b></td></tr>";
-		if($config['participant_registration_type']=="invite") {
+		if($config['participant_registration_type']=="invite")
+		{
 			echo "<tr><td colspan=2>".i18n("Set to 0 to have no registration limit")."</td></tr>";
 			echo "<tr><td colspan=2>".i18n("Maximum of")."&nbsp;";
 			echo "<input type=\"text\" name=\"projectlimit\" value=\"".htmlspecialchars($r->projectlimit)."\" size=\"4\" maxlength=\"4\" />";
@@ -437,71 +307,8 @@ $(document).ready(function() {
 
 
 	}
-	else if($_GET['action'] == 'participation')
+	else
 	{
-		send_header(
-			"Conference Participation",
-	 		array(
-				'Committee Main' => 'committee_main.php',
-				'Administration' => 'admin/index.php',
-				'School Management' => 'admin/schools.php'
-			),
-			"participation"
-		);
-
-		echo "<form method=\"post\" action=\"schools.php\">\n";
-		echo "<table class=\"tableview\">";
-		echo "<thead><tr>";
-		echo " <th>".i18n("School")."</th>";
-		echo " <th>".i18n("Participation")."</th>";
-		echo "</tr></thead>\n";
-
-		$query = mysql_query("SELECT id, school, include_fairs, include_olympics  FROM schools WHERE conferences_id='".$conference['id']."' ORDER BY school");
-		while($record = mysql_fetch_array($query)){
-			echo "<tr><td>" . $record['school'] . "</td>";
-			echo "<td><label style=\"margin-right: 2em\">";
-			echo '<input type="checkbox" name="' . $record['id'] . '_fairs' . '"';
-			if($record['include_fairs'] == true) echo " CHECKED";
-			echo "> " . i18n("fairs") . "</label>";
-
-			echo "<label>";
-			echo '<input type="checkbox" name="' . $record['id'] . '_olympics' . '"';
-			if($record['include_olympics'] == true) echo " CHECKED";
-			echo "> " . i18n("olympics") . "</label>";
-			echo "</td></tr>";
-		}
-		echo "<tr><td colspan=\"2\" align=\"center\"><input type=\"submit\" value=\"" . i18n('Save') . "\" /></td></tr>\n";
-		echo "</table>\n";
-		echo '<input type="hidden" name="action" value="save_participation"></input>' . "\n";
-		echo "</form>\n";
-
-	}
-	else if($_GET['action']=="copy") {
- 		send_header("School Management",
- 		array('Committee Main' => 'committee_main.php',
-			'Administration' => 'admin/index.php'),
-            "schools_management"
-				);
-		echo "<form method=\"post\" action=\"schools.php\">";
-		echo "<input type=\"hidden\" name=\"action\" value=\"copy\">\n";
-		echo i18n("Choose a conference to copy schools from");
-		echo "<br />";
-		$q=mysql_query("SELECT * FROM conferences WHERE id!='{$conference['id']}' ORDER BY id DESC");
-		echo mysql_error();
-		echo "<select name=\"copyconference\">";
-		echo "<option value=\"\">".i18n("Choose a Conference")."</option>\n";
-		while($r=mysql_fetch_object($q)) {
-			$numq=mysql_query("SELECT COUNT(*) AS c FROM schools WHERE conferences_id='{$r->id}'");
-			$numr=mysql_fetch_object($numq);
-			echo "<option value=\"{$r->id}\">{$r->name} ($numr->c schools)</option>\n";
-		}
-		echo "</select>\n";
-		echo "<input type=\"submit\" value=\"".i18n("Copy Schools")."\">";
-		echo "</form>\n";
-
-	}
-
-	else {
  		send_header("School Management",
  		array('Committee Main' => 'committee_main.php',
 			'Administration' => 'admin/index.php'),
@@ -510,82 +317,58 @@ $(document).ready(function() {
 
 		switch($notice) {
 		case 'added':
-			echo happy(i18n("School successfully added"));
+			echo happy("School successfully added");
 			break;
 		case 'saved':
-			echo happy(i18n("Successfully saved changes to school"));
+			echo happy("Successfully saved changes to school");
 			break;
 		case 'deleted':
-			echo happy(i18n("School successfully deleted"));
+			echo happy("School successfully deleted");
 			break;
 		case 'clearaccess':
-			echo happy(i18n("Access Codes successfully cleared from all schools"));
+			echo happy("Access Codes successfully cleared from all schools");
 			break;
 		case 'makeaccess':
-			echo happy(i18n("Access Codes successfully set for schools that didn't have one"));
+			echo happy("Access Codes successfully set for schools that didn't have one");
-			break;
-		case 'copied':
-			echo happy(i18n("Schools successfully copied from other conference"));
 			break;
 		}
 
 		echo "<br />";
 		echo "<a href=\"schools.php?action=add\">".i18n("Add new school")."</a>\n";
 		echo "<br />";
-		echo "<a href=\"schools.php?action=copy\">".i18n("Copy schools from a difference conference")."</a>\n";
-		echo "<br />";
 		echo "<a href=\"schoolsimport.php?action=add\">".i18n("Import schools from CSV")."</a>\n";
 		echo "<br />";
 		echo "<a href=\"schools.php?action=makeaccesscodes\">".i18n("Create Access Code for any school without one")."</a>\n";
 		echo "<br />";
 		echo "<a onclick=\"return confirmClick('".i18n("Are you sure you want to remove all access codes from all schools?")."')\" href=\"schools.php?action=clearaccesscodes\">".i18n("Remove Access Codes from all schools")."</a>\n";
 		echo "<br />";
-		// we only need to see this option if we are managing both types of conferences
-		$q = mysql_fetch_array(mysql_query('SELECT COUNT(DISTINCT(`type`)) as taly FROM conferences'));
-		if($q['tally'] > 1){
-			echo "<a href=\"schools.php?action=participation\">".i18n("Set SFIAB/SOIAB participation")."</a>\n";
-			echo "<br />";
-		}
 		echo "<table class=\"tableview\">";
 		echo "<thead><tr>";
 		echo " <th>".i18n("School")."</th>";
 		echo " <th>".i18n("Address")."</th>";
 		echo " <th>".i18n("Phone")."</th>";
-		echo " <th>".i18n("Science Head")."</th>";
+		echo " <th>".i18n("Contact")."</th>";
-		echo " <th>".i18n("Science Head Email")."</th>";
 		if($config['participant_registration_type']=="schoolpassword")
 			echo " <th>".i18n("Reg Pass")."</th>";
 		echo " <th>".i18n("Access Code")."</th>";
 		echo " <th>".i18n("Action")."</th>";
 		echo "</tr></thead>\n";
 
-		$q=mysql_query("SELECT * FROM schools WHERE conferences_id='".$conference['id']."' ORDER BY school");
+		$q = $pdo->prepare("SELECT * FROM schools WHERE year='".$config['FAIRYEAR']."' ORDER BY school");
-		while($r=mysql_fetch_object($q))
+		$q->execute();
+		while($r=$q->fetch(PDO::FETCH_OBJ))
 		{
 			echo "<tr>\n";
 			echo " <td>$r->school</td>\n";
 			echo " <td>$r->address, $r->city, $r->postalcode</td>\n";
 			echo " <td>$r->phone</td>\n";
-			$sciencehead = '';
-			$scienceheademail = '';
-			if($r->sciencehead_uid > 0) {
-				$sh = user_load($r->sciencehead_uid);
-				$sciencehead = $sh['name'];
-				if(!$sciencehead) $sciencehead="<i>no name set</i>";
-//				print_r($sh);
-				$sha=account_load($sh['accounts_id']);
-				if($sha['email']) {
-					$scienceheademail=$sha['email'];
-					$pending="";
-				}
-				else {
-					$scienceheademail=$sha['pendingemail'];
-					$pending="(unconfirmed)";
-				}
 
+			$sciencehead = '';
+			if($r->sciencehead_uid > 0) {
+				$sh = user_load_by_uid($r->sciencehead_uid);
+				$sciencehead = $sh['name'];
 			}
 			echo " <td>$sciencehead</td>\n";
-			echo " <td><a href=\"mailto:$scienceheademail\">$scienceheademail</a> $pending</td>\n";
 			if($config['participant_registration_type']=="schoolpassword")
 				echo " <td>$r->registration_password</td>\n";
 			echo " <td>$r->accesscode</td>\n";