Initial commit

hosxp-webservice/core/search_action.php

@@ -0,0 +1,119 @@
+<?php
+// core/search_action.php
+require_once("../config/db.php");
+require_once("../core/utils.php");
+require_once("../core/security.php");
+
+session_start();
+
+// CSRF Validation
+if (!verify_csrf_token($_POST['csrf_token'] ?? '')) {
+    echo "<tr><td colspan='5' class='py-16 text-center text-red-500'>การยืนยันตัวตนล้มเหลว (CSRF) กรุณาโหลดหน้าเว็บใหม่</td></tr>";
+    exit();
+}
+
+$type = $_POST['type'] ?? 'hn';
+$query = $_POST['query'] ?? '';
+
+$rows = [];
+$current_user = $_SESSION['account'] ?? '';
+
+if ($query !== "") {
+    
+    if ($type === 'name') {
+        if (can_search_name($current_user)) {
+            // Split query by spaces to handle first and last name separately
+            $parts = preg_split('/\s+/', trim($query));
+            if (count($parts) >= 2) {
+                // First part is fname, second part is lname
+                $fname = "%" . $parts[0] . "%";
+                $lname = "%" . $parts[1] . "%";
+                $sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE fname LIKE ? AND lname LIKE ? LIMIT 50";
+                
+                $stmt = $conn1->prepare($sql);
+                if ($stmt) {
+                    $stmt->bind_param("ss", $fname, $lname);
+                    $stmt->execute();
+                    $result = $stmt->get_result();
+                    while ($row = $result->fetch_assoc()) {
+                        $rows[] = $row;
+                    }
+                    $stmt->close();
+                }
+            } else {
+                // Just one word, search either fname or lname
+                $data = "%" . trim($query) . "%";
+                $sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE fname LIKE ? OR lname LIKE ? LIMIT 50";
+                
+                $stmt = $conn1->prepare($sql);
+                if ($stmt) {
+                    $stmt->bind_param("ss", $data, $data);
+                    $stmt->execute();
+                    $result = $stmt->get_result();
+                    while ($row = $result->fetch_assoc()) {
+                        $rows[] = $row;
+                    }
+                    $stmt->close();
+                }
+            }
+        } else {
+            echo "<tr><td colspan='5' class='py-16 text-center text-red-500'>คุณไม่มีสิทธิ์ในการค้นหาด้วยชื่อ-สกุล</td></tr>";
+            exit();
+        }
+    } else {
+        require_once("../core/settings.php");
+        $app_settings = get_app_settings();
+        $is_strict = ($app_settings['strict_search_enable'] == '1');
+        
+        $data = $is_strict ? $query : "%" . $query . "%";
+        $operator = $is_strict ? "=" : "LIKE";
+        
+        if ($type === 'hn') {
+            $sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE hn $operator ? LIMIT 20";
+        } else if ($type === 'cid') {
+            $sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE cid $operator ? LIMIT 20";
+        } else if ($type === 'passport') {
+            $sql = "SELECT hn, pname, fname, lname, cid, passport_no FROM patient WHERE passport_no $operator ? LIMIT 20";
+        } else {
+            $sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE hn $operator ? LIMIT 20"; // default
+        }
+        
+        $stmt = $conn1->prepare($sql);
+        if ($stmt) {
+            $stmt->bind_param("s", $data);
+            $stmt->execute();
+            $result = $stmt->get_result();
+            while ($row = $result->fetch_assoc()) {
+                $rows[] = $row;
+            }
+            $stmt->close();
+        }
+    }
+}
+
+if (empty($rows)) {
+    echo "<tr><td colspan='5' class='py-16 text-center text-slate-500'>ไม่พบข้อมูลที่ตรงกับคำค้นหา</td></tr>";
+} else {
+    $num = 1;
+    foreach ($rows as $row) {
+        $encoded_hn = encrypt_param($row['hn']); // No urlencode needed for hidden input
+        echo "<tr class='table-row-hover group'>";
+        echo "<td class='table-cell'>" . $num . "</td>";
+        echo "<td class='table-cell'><span class='inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-emerald-100 text-emerald-800'>" . htmlspecialchars($row['hn']) . "</span></td>";
+        $sort_name = htmlspecialchars($row['fname'] . " " . $row['lname']);
+        $display_name = htmlspecialchars($row['pname'] . $row['fname'] . " " . $row['lname']);
+        echo "<td class='table-cell font-medium text-slate-800' data-order='" . $sort_name . "'>" . $display_name . "</td>";
+        echo "<td class='table-cell text-slate-500'>" . htmlspecialchars($row['cid'] ?? '-') . "</td>";
+        echo "<td class='table-cell text-center'>
+                <form action='patient_detail.php' method='POST' class='m-0 inline'>
+                    <input type='hidden' name='hn' value='" . htmlspecialchars($encoded_hn) . "'>
+                    <button type='submit' class='inline-flex items-center justify-center w-8 h-8 rounded-full bg-emerald-50 text-emerald-600 hover:bg-emerald-500 hover:text-white transition-all shadow-sm ring-1 ring-emerald-500/20' title='เปิดดูข้อมูล'>
+                        <svg class='w-4 h-4' fill='none' stroke='currentColor' viewBox='0 0 24 24'><path stroke-linecap='round' stroke-linejoin='round' stroke-width='2' d='M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z'></path></svg>
+                    </button>
+                </form>
+              </td>";
+        echo "</tr>";
+        $num++;
+    }
+}
+?>