120 lines
5.5 KiB
PHP
120 lines
5.5 KiB
PHP
<?php
|
|
// core/search_action.php
|
|
require_once("../config/db.php");
|
|
require_once("../core/utils.php");
|
|
require_once("../core/security.php");
|
|
|
|
session_start();
|
|
|
|
// CSRF Validation
|
|
if (!verify_csrf_token($_POST['csrf_token'] ?? '')) {
|
|
echo "<tr><td colspan='5' class='py-16 text-center text-red-500'>การยืนยันตัวตนล้มเหลว (CSRF) กรุณาโหลดหน้าเว็บใหม่</td></tr>";
|
|
exit();
|
|
}
|
|
|
|
$type = $_POST['type'] ?? 'hn';
|
|
$query = $_POST['query'] ?? '';
|
|
|
|
$rows = [];
|
|
$current_user = $_SESSION['account'] ?? '';
|
|
|
|
if ($query !== "") {
|
|
|
|
if ($type === 'name') {
|
|
if (can_search_name($current_user)) {
|
|
// Split query by spaces to handle first and last name separately
|
|
$parts = preg_split('/\s+/', trim($query));
|
|
if (count($parts) >= 2) {
|
|
// First part is fname, second part is lname
|
|
$fname = "%" . $parts[0] . "%";
|
|
$lname = "%" . $parts[1] . "%";
|
|
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE fname LIKE ? AND lname LIKE ? LIMIT 50";
|
|
|
|
$stmt = $conn1->prepare($sql);
|
|
if ($stmt) {
|
|
$stmt->bind_param("ss", $fname, $lname);
|
|
$stmt->execute();
|
|
$result = $stmt->get_result();
|
|
while ($row = $result->fetch_assoc()) {
|
|
$rows[] = $row;
|
|
}
|
|
$stmt->close();
|
|
}
|
|
} else {
|
|
// Just one word, search either fname or lname
|
|
$data = "%" . trim($query) . "%";
|
|
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE fname LIKE ? OR lname LIKE ? LIMIT 50";
|
|
|
|
$stmt = $conn1->prepare($sql);
|
|
if ($stmt) {
|
|
$stmt->bind_param("ss", $data, $data);
|
|
$stmt->execute();
|
|
$result = $stmt->get_result();
|
|
while ($row = $result->fetch_assoc()) {
|
|
$rows[] = $row;
|
|
}
|
|
$stmt->close();
|
|
}
|
|
}
|
|
} else {
|
|
echo "<tr><td colspan='5' class='py-16 text-center text-red-500'>คุณไม่มีสิทธิ์ในการค้นหาด้วยชื่อ-สกุล</td></tr>";
|
|
exit();
|
|
}
|
|
} else {
|
|
require_once("../core/settings.php");
|
|
$app_settings = get_app_settings();
|
|
$is_strict = ($app_settings['strict_search_enable'] == '1');
|
|
|
|
$data = $is_strict ? $query : "%" . $query . "%";
|
|
$operator = $is_strict ? "=" : "LIKE";
|
|
|
|
if ($type === 'hn') {
|
|
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE hn $operator ? LIMIT 20";
|
|
} else if ($type === 'cid') {
|
|
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE cid $operator ? LIMIT 20";
|
|
} else if ($type === 'passport') {
|
|
$sql = "SELECT hn, pname, fname, lname, cid, passport_no FROM patient WHERE passport_no $operator ? LIMIT 20";
|
|
} else {
|
|
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE hn $operator ? LIMIT 20"; // default
|
|
}
|
|
|
|
$stmt = $conn1->prepare($sql);
|
|
if ($stmt) {
|
|
$stmt->bind_param("s", $data);
|
|
$stmt->execute();
|
|
$result = $stmt->get_result();
|
|
while ($row = $result->fetch_assoc()) {
|
|
$rows[] = $row;
|
|
}
|
|
$stmt->close();
|
|
}
|
|
}
|
|
}
|
|
|
|
if (empty($rows)) {
|
|
echo "<tr><td colspan='5' class='py-16 text-center text-slate-500'>ไม่พบข้อมูลที่ตรงกับคำค้นหา</td></tr>";
|
|
} else {
|
|
$num = 1;
|
|
foreach ($rows as $row) {
|
|
$encoded_hn = encrypt_param($row['hn']); // No urlencode needed for hidden input
|
|
echo "<tr class='table-row-hover group'>";
|
|
echo "<td class='table-cell'>" . $num . "</td>";
|
|
echo "<td class='table-cell'><span class='inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-emerald-100 text-emerald-800'>" . htmlspecialchars($row['hn']) . "</span></td>";
|
|
$sort_name = htmlspecialchars($row['fname'] . " " . $row['lname']);
|
|
$display_name = htmlspecialchars($row['pname'] . $row['fname'] . " " . $row['lname']);
|
|
echo "<td class='table-cell font-medium text-slate-800' data-order='" . $sort_name . "'>" . $display_name . "</td>";
|
|
echo "<td class='table-cell text-slate-500'>" . htmlspecialchars($row['cid'] ?? '-') . "</td>";
|
|
echo "<td class='table-cell text-center'>
|
|
<form action='patient_detail.php' method='POST' class='m-0 inline'>
|
|
<input type='hidden' name='hn' value='" . htmlspecialchars($encoded_hn) . "'>
|
|
<button type='submit' class='inline-flex items-center justify-center w-8 h-8 rounded-full bg-emerald-50 text-emerald-600 hover:bg-emerald-500 hover:text-white transition-all shadow-sm ring-1 ring-emerald-500/20' title='เปิดดูข้อมูล'>
|
|
<svg class='w-4 h-4' fill='none' stroke='currentColor' viewBox='0 0 24 24'><path stroke-linecap='round' stroke-linejoin='round' stroke-width='2' d='M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z'></path></svg>
|
|
</button>
|
|
</form>
|
|
</td>";
|
|
echo "</tr>";
|
|
$num++;
|
|
}
|
|
}
|
|
?>
|