alert('Safety Code Error !!!'); window.location.href='hosxp_cost.php';";
exit();
}
if ($unitcost === "" || $sks_coverage_price === "" || $icode === "") {
echo "";
exit();
}
$price = floatval($unitcost) * 1.3;
$price2 = $price * 1.3;
$price3 = $price;
// Convert $icode to array and validate to prevent SQL injection
$icode_array = explode(',', $icode);
$safe_icodes = [];
foreach ($icode_array as $code) {
$code = trim($code);
if (!empty($code) && preg_match('/^[0-9a-zA-Z_-]+$/', $code)) {
$safe_icodes[] = $code;
}
}
if (empty($safe_icodes)) {
echo "";
exit();
}
// Create prepared statement placeholders
$placeholders = implode(',', array_fill(0, count($safe_icodes), '?'));
$sql = "UPDATE nondrugitems SET
unitcost = ?,
price = ?,
price2 = ?,
price3 = ?,
ipd_price = ?,
ipd_price2 = ?,
ipd_price3 = ?,
sks_coverage_price = ?
WHERE income = '02' AND icode IN ($placeholders)";
$stmt = $conn1->prepare($sql);
if ($stmt) {
// Bind parameters: 8 doubles + N strings for icodes
$types = str_repeat('d', 8) . str_repeat('s', count($safe_icodes));
$params = [
$unitcost, $price, $price2, $price3,
$price, $price2, $price3, $sks_coverage_price
];
$params = array_merge($params, $safe_icodes);
$stmt->bind_param($types, ...$params);
$result = $stmt->execute();
if ($result) {
echo "";
} else {
header("Location: error.php?message=" . urlencode("SQL ERROR"));
}
$stmt->close();
} else {
header("Location: error.php?message=" . urlencode("Prepare Statement Error"));
}
?>