80 lines
2.4 KiB
PHP
80 lines
2.4 KiB
PHP
<?php
|
|
session_start();
|
|
if (empty($_SESSION['sess_userid']) || $_SESSION['sess_userid'] !== session_id()) {
|
|
header("Location: index.php");
|
|
exit();
|
|
}
|
|
|
|
require_once("config/db.php");
|
|
|
|
$unitcost = $_POST['unitcost'] ?? '';
|
|
$sks_coverage_price = $_POST['sks_coverage_price'] ?? '';
|
|
$icode = $_POST['icode'] ?? '';
|
|
$safety_code = $_POST['safety_code'] ?? '';
|
|
|
|
if ($safety_code !== "10742") {
|
|
echo "<script>alert('Safety Code Error !!!'); window.location.href='hosxp_cost.php';</script>";
|
|
exit();
|
|
}
|
|
|
|
if ($unitcost === "" || $sks_coverage_price === "" || $icode === "") {
|
|
echo "<script>alert('Data Not Complete'); window.location.href='hosxp_cost.php';</script>";
|
|
exit();
|
|
}
|
|
|
|
$price = floatval($unitcost) * 1.3;
|
|
$price2 = $price * 1.3;
|
|
$price3 = $price;
|
|
|
|
// Convert $icode to array and validate to prevent SQL injection
|
|
$icode_array = explode(',', $icode);
|
|
$safe_icodes = [];
|
|
foreach ($icode_array as $code) {
|
|
$code = trim($code);
|
|
if (!empty($code) && preg_match('/^[0-9a-zA-Z_-]+$/', $code)) {
|
|
$safe_icodes[] = $code;
|
|
}
|
|
}
|
|
|
|
if (empty($safe_icodes)) {
|
|
echo "<script>alert('รูปแบบ icode ไม่ถูกต้อง'); window.location.href='hosxp_cost.php';</script>";
|
|
exit();
|
|
}
|
|
|
|
// Create prepared statement placeholders
|
|
$placeholders = implode(',', array_fill(0, count($safe_icodes), '?'));
|
|
|
|
$sql = "UPDATE nondrugitems SET
|
|
unitcost = ?,
|
|
price = ?,
|
|
price2 = ?,
|
|
price3 = ?,
|
|
ipd_price = ?,
|
|
ipd_price2 = ?,
|
|
ipd_price3 = ?,
|
|
sks_coverage_price = ?
|
|
WHERE income = '02' AND icode IN ($placeholders)";
|
|
|
|
$stmt = $conn1->prepare($sql);
|
|
if ($stmt) {
|
|
// Bind parameters: 8 doubles + N strings for icodes
|
|
$types = str_repeat('d', 8) . str_repeat('s', count($safe_icodes));
|
|
$params = [
|
|
$unitcost, $price, $price2, $price3,
|
|
$price, $price2, $price3, $sks_coverage_price
|
|
];
|
|
$params = array_merge($params, $safe_icodes);
|
|
|
|
$stmt->bind_param($types, ...$params);
|
|
$result = $stmt->execute();
|
|
|
|
if ($result) {
|
|
echo "<script>alert('Successfull !!!'); window.location.href='hosxp_cost.php';</script>";
|
|
} else {
|
|
header("Location: error.php?message=" . urlencode("SQL ERROR"));
|
|
}
|
|
$stmt->close();
|
|
} else {
|
|
header("Location: error.php?message=" . urlencode("Prepare Statement Error"));
|
|
}
|
|
?>
|