TechTrader/products.php at master · mattfeury/TechTrader · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
<?php
	include 'db_helper.php';

  // helper
  function idForCurrentUser() {
    global $_USER;

    if (! isset($_USER['uid'])) {
  		$GLOBALS["_PLATFORM"]->sandboxHeader("HTTP/1.1 500 Internal Server Error");
	  	die();
    }

    return $_USER['uid'];
  }

  function listProducts($catId) {
    $dbQuery = sprintf("SELECT * FROM products WHERE category_id = '%s' ORDER BY date_created DESC",
      mysql_real_escape_string($catId));
		$result = getDBResultsArray($dbQuery);
		header("Content-type: application/json");
    echo json_encode($result);
	}

  function listUserProducts() {
    $dbQuery = sprintf("SELECT * FROM products WHERE user_id = '%s' ORDER BY date_created DESC",
      mysql_real_escape_string(idForCurrentUser()));
		$result = getDBResultsArray($dbQuery);
		header("Content-type: application/json");
    echo json_encode($result);
	}

  function getProduct($id) {
    $dbQuery = sprintf("SELECT * FROM products WHERE id = '%s'",
    mysql_real_escape_string($id));
    $result=getDBResultRecord($dbQuery);
    header("Content-type: application/json");
    echo json_encode($result);
  }

  function addProduct($title, $description, $price, $categoryId) {

    $userId = idForCurrentUser();

		$dbQuery = sprintf("INSERT INTO products (user_id, title, description, price, category_id) VALUES ('%s', '%s', '%s', '%s', '%s')",
      mysql_real_escape_string($userId),
      mysql_real_escape_string($title),
      mysql_real_escape_string($description),
      mysql_real_escape_string($price),
      mysql_real_escape_string($categoryId));

		$result = getDBResultInserted($dbQuery,'productId');

		header("Content-type: application/json");
    echo json_encode($result);
  }


  function updateProduct($id, $description, $price, $categoryId) {
		$dbQuery = sprintf("UPDATE products SET description = '%s', price = '%s', category_id = '%s' WHERE id = '%s' AND user_id = '%s'",
			mysql_real_escape_string($description),
			mysql_real_escape_string($price),
			mysql_real_escape_string($categoryId),
      mysql_real_escape_string($id),
      mysql_real_escape_string(idForCurrentUser()));

		$result = getDBResultAffected($dbQuery);

		header("Content-type: application/json");
		echo json_encode($result);
	}

	function deleteProduct($id) {
		$dbQuery = sprintf("DELETE FROM products WHERE id = '%s' AND user_id = '%s'",
      mysql_real_escape_string($id),
      mysql_real_escape_string(idForCurrentUser()));

		$result = getDBResultAffected($dbQuery);

		header("Content-type: application/json");
		echo json_encode($result);
  }
?>