create_object.php at OpenCabling

<?php

$id_object=$_REQUEST['id_object'];
$parent_object=$_REQUEST['parent_object_id'];
$position=$_REQUEST['obj_position'];
$name=mysql_escape_string($_REQUEST['obj_name']);
$type=$_REQUEST['obj_type'];
$description=mysql_escape_string($_REQUEST['obj_description']);
$extravalues=$_REQUEST['obj_extravalues'];
$action=$_REQUEST['action'];
$link=$_REQUEST['obj_links'];
$towards=$_REQUEST['obj_towards'];

include "opendb.php";

if ($action=="Create Object") {
  $action="create";
} else {
  $action="update";
}
     

if ($parent_object=="") {
  $parent_object=0;
} else {
  
  // Recover nospan option
  
  $sql="select * from objects,objtypes where id_obj_type=obj_type and id_object=".$parent_object;
  $query=mysql_query($sql,$mysql_conn);
  $result=mysql_fetch_assoc($query);
  $option=$result['options'];
  $nospan=stristr($option,"nospan");

  // Test for position 0
  if ( $position==0 and $parent_object<>0) {
    echo  "<html><body><h1>Error!</h1><p>Unable to ".$action." the requested object: position zero is only available as root element (inside element 0).</p><p><a href=\"javascript: history.go(-1)\">Back</a></p></body></html>";
    die();
  }

  // Test if another object already present in such position and with the same towards

  if ( $position<>0 and $parent_object<>0 ) { 
    $sql="select * from objects where parent_obj='".$parent_object."' and position='".$position."' and id_object<>'".$id_object."' and towards='".$towards."'";
    $query=mysql_query($sql,$mysql_conn);
    if (mysql_num_rows($query)>0) {
      echo "<html><body><h1>Error!</h1><p>Unable to ".$action." the requested object: there is already an object in the position specified and with the same towards.</p><p><a href=\"javascript: history.go(-1)\">Back</a></p></body></html>";
      die();
    }
  }
  
  if ($nospan==false) {
  // Test if the current object is too big for the space available
    
    $sql="select * from objtypes where id_obj_type='".$type."'";
    $query=mysql_query($sql,$mysql_conn);
    $result=mysql_fetch_assoc($query);
    $height=$result['vpos_used'];
    
    $sql="select * from objects where parent_obj='".$parent_object."' and position<'".$position."' and position>'".($position-$height)."' and id_object<>'".$id_object."'";
    $query=mysql_query($sql,$mysql_conn);
    if (mysql_num_rows($query)>0) {
    echo "<html><body><h1>Error!</h1><p>Unable to ".$action." the requested object: the height of the object choosen is too big for the space available.</p><p><a href=\"javascript: history.go(-1)\">Back</a></p></body></html>";
    die();
    }
  }
  
  // Test if the current object is out of position range in the parent object
  
  $sql="select * from objtypes where id_obj_type='".$type."'";
  $query=mysql_query($sql,$mysql_conn);
$result=mysql_fetch_assoc($query);
 $height=$result['vpos_used'];
 
 $sql="select * from objects where id_object='".$parent_object."'";
 $query=mysql_query($sql,$mysql_conn);
 $result=mysql_fetch_assoc($query);
 $parent_type=$result['obj_type'];
 $sql="select * from objtypes where id_obj_type='".$parent_type."'";
$query=mysql_query($sql,$mysql_conn);
 $result=mysql_fetch_assoc($query);
 $pos_available=($result['hpos_available']*$result['vpos_available']);
 
 if ($position<=0 and $parent_object<>0) {
   echo "<html><body><h1>Error!</h1><p>Unable to ".$action." the requested object: position must be a positive integer.</p><p><a href=\"javascript: history.go(-1)\">Back</a></p></body></html>";
   die();
 }
 
 if ($nospan==false) {
   if ($position-$height<0 and $parent_object<>0) {
     echo "<html><body><h1>Error!</h1><p>Unable to ".$action." the requested object: the height of the object is too big for the space available, you cannot go under the last element of the parent object.</p><p><a href=\"javascript: history.go(-1)\">Back</a></p></body></html>";
    die();
   }
 }
 
 if ($position>$pos_available and $parent_object<>0) {
   echo "<html><body><h1>Error!</h1><p>Unable to ".$action." the requested object: only ".$pos_available." position are available in the parent object.</p><p><a href=\"javascript: history.go(-1)\">Back</a></p></body></html>";
   die();
 }
  
}
// All is ok, proceed in creating the object

$sql="select * from objects where id_object='".$parent_object."'";
$query=mysql_query($sql,$mysql_conn); 
if (mysql_num_rows($query)>0) {
  $result=mysql_fetch_assoc($query);
  $level=$result['level']+1;
}

// Test if name is empty, replace with object brand and type
if ($name=="") {
  $sql="select * from objtypes where id_obj_type='".$type."'";
  $query=mysql_query($sql,$mysql_conn); 
  $result=mysql_fetch_assoc($query);
  $name=$result['brand']." - ".$result['type'];
}
if ($action=="create") {
  $sql="insert into objects(name,obj_description,obj_extravalues,obj_type,parent_obj,position,towards,level) values('$name','$description','$extravalues','$type','$parent_object','$position','$towards','$level')";
  $query=mysql_query($sql,$mysql_conn);
  echo "<script lang=javascript>top.frames[\"left\"].collapse(".$parent_object.")</script>";
  echo "<script lang=javascript>top.frames[\"left\"].expand(".$parent_object.")</script>";
  echo "<script lang=javascript>top.frames[\"left\"].select(".mysql_insert_id($mysql_conn).")</script>";
} else {
  $sql="update objects set  name = '$name', obj_description = '$description', obj_extravalues = '$extravalues', obj_type = '$type', parent_obj = '$parent_object', position = '$position', towards = '$towards', level='$level', obj_links='$link' where id_object='$id_object'";
  $query=mysql_query($sql,$mysql_conn);
  echo "<script lang=javascript>location.href = 'show_detail.php?object=".$id_object."';</script>";

} 

?>