purchasing.php at Total ISP

<?
include "./auth.inc.php";
if ($security<90)
	die();

if ($save){
	if ($SupplierID == '0'){
		if (!$ABN)
			$e.="<P>Please Enter An ABN.";
		if (!$Company)
			$e.="<P>Please Enter a Company Name";
		
		#no names for now..
		$LastName=$Company;

		if (!$e){
			$isql = "INSERT INTO MasterAccounts(FirstName, LastName, Company, ABN, Address,Suburb,Postcode,PhoneWork,VISP,Supplier)
				VALUES('$FirstName','$LastName','$Company','$ABN','$Address','$Suburb','$Postcode','$PhoneWork',1,1)";
			mysql_query($isql);
			if (mysql_error()){
				$e.="<P>";
				$e.=mysql_error();
			}else{
				$ssql = "SELECT LAST_INSERT_ID()";
				$sres = mysql_query($ssql);
				$SupplierID = mysql_result($sres,0);
			}

		}
	}elseif(!$SupplierID){
		$e.="<P>No Supplier Selected!";
	}

	if (!$PurchaseCode || $PurchaseCode=='0'){
		
		if ($CodeID > 0 && $CodeName){
			$cisql = "INSERT INTO PurchaseCodes(CodeID,CodeName) 
					VALUES('$CodeID','$CodeName')";
			mysql_query($cisql);
			if (mysql_error())
				$e.=mysql_error();
			$PurchaseCode=mysql_insert_id();
			
		}else{
			$e.="<P>Please Choose a Purchase Code";
		}
	}

	if (!$e){
		if ($Cost){
			if (!$GST){
				$excost = $Cost;
				$gst=0;
				if ($TotalCost){
					$gst=$TotalCost-$Cost;
				}
			}else{
				$excost=$Cost;
				$gst=$GST;
			}
		}elseif($GST){
			$gst=$GST;
			if ($TotalPrice){
				$excost=$TotalPrice-$GST;
			}else{
				$e.="<P>GST only makes no sense.";
			}

		}elseif($TotalPrice){
			$gst=$TotalPrice/11;
			$excost=$TotalPrice/1.1;
		}else{
			$e.="<P>Please Enter a Price or GST Charges.";
		}
	}

	if (!$e){
		$identity="$REMOTE_ADDR-$PHP_AUTH_USER";

		#if ($ItemOnly)
		#	$ItemOnly=1;

		if ($Date)
			$Date="'".$Date."'";
		else
			$Date='now()';

		$isql = "INSERT INTO Purchases(SupplierID,PurchaseDesc,Cost,GST,PurchaseDate,Identifier,SupplierCode,ChequeID,ItemOnly,PurchaseCode) 
VALUES('$SupplierID','$Purchase','$excost','$gst',$Date,'$identity','$SupplierCode','$ChequeID','$ItemOnly','$PurchaseCode')";
		mysql_query($isql);
		if (mysql_error())
			$e.=mysql_error();
		if (!$e){
			print "Purchase Added<BR>&nbsp;<h1>ID: ";
			print mysql_insert_id();
			print "<BR><BR><A HREF=\"purchasing.php\">Add Another</A>";
			exit;
		}
	}
}

?><HTML>
<HEAD></HEAD>
<BODY bgcolor=white>
<H2>Purchases</H2>
<? if ($e)
	print $e;
?>
<TABLE>
<form>
<TR><TD>Supplier</TD><TD>
<SELECT NAME=SupplierID>
<option value="0">(New Supplier)</option>
<?
$ssql = "SELECT CustomerID, Company, FirstName, LastName 
	FROM MasterAccounts 
	WHERE Supplier>0 
	AND ABN<>''
	ORDER BY Company";
$sres = mysql_query($ssql);

while ($srow = mysql_fetch_row($sres)){
	if (!$srow[1])
		$company="$srow[2] $srow[3]";
	else
		$company = $srow[1];

	print "<option value=\"$srow[0]\"";
	if ($CustomerID == $srow[0])
		print " selected";
	print ">$company</option>";
}
?></SELECT>
</TD></TR>
<? $bg="bgcolor=#DDDDDD" ?>
<TR <? echo $bg ?>>
<TD>New Supplier Company</TD><TD><Input type=text name=Company></TD>
</TR>
<tr <? echo $bg ?>>
<TD align=right>ABN</TD><TD><input type=text name=ABN></TD>
</TR>
<tr <? echo $bg ?>>
<TD align=right>Street Address</TD><TD><input type=text name=Address></TD>
</TR>
<tr <? echo $bg ?>>
<TD align=right>Suburb</TD><TD><input type=text name=Suburb></TD>
</TR>
<tr <? echo $bg ?>>
<TD align=right>Postcode</TD><TD><input type=text name=Postcode></TD>
</TR>
<tr <? echo $bg ?>>
<TD align=right>State</TD><TD><input type=text name=State value="SA"></TD>
</TR>
<TR><TD>&nbsp</TD></TR>
<TR>
<TD><H2>Purchase Description</H2></TD>
<TD colspan=2><TEXTAREA NAME=Purchase rows=5 cols=40></TEXTAREA></TD>
</TR>
<TR>
<TD>ex-GST Price</TD><TD><input type=text name=Cost></TD>
<TD rowspan=3>Please fill out no more than 2 of these boxes</TD>
</TR>
<TR>
<TD>GST Charged</TD><TD><input type=text name=GST></TD>
</TR>
<TR>
<TD>GST.inc.php.php.php.php.php.php price</TD><TD><input type=text name=TotalPrice></TD>
</TR>

<tr>
<TD>Date of Purchase</TD><TD><input type=text name=Date></TD><TD>(YYYY-MM-DD, Blank for today)</TD>
</TR>

<tr>
<TD>Supplier Invoice Number/Code</TD>
<TD><input type=text name=SupplierCode></TD>
</TR>

<tr>
<TD>Cheque Number</TD>
<TD><input type=text name=ChequeID></TD>
</TR>

<tr>
<TD>Itemised Bill</TD>
<TD><SELECT NAME=ItemOnly>
<? $isql = "SELECT PurchaseGroupID, PGName
        FROM PurchaseGroup
        ORDER BY PGName";
$ires = mysql_query($isql);
while ($i = mysql_fetch_row($ires)){
        print "<option value=\"$i[0]\"";
        if ($pr[ItemOnly]==$i[0]){
                print " selected";
        }
        print ">$i[1]</option>\n";
}
?></SELECT>
</TD>
</TR>



<tr>
<td>Purchase Code</td>
<TD><SELECT NAME=PurchaseCode>
    <option value="0">(New Code) -></option>
<?
$csql = "SELECT CodeID, CodeName FROM PurchaseCodes ORDER BY CodeID";
$cres = mysql_query($csql);
while ($crow = mysql_fetch_array($cres)){
	print "<option value=\"$crow[CodeID]\">$crow[CodeID] - $crow[CodeName]</option>\n";
}
?>
</select></td>
<td>Name: <input type=text name=CodeName><br>
Number: <input type=text name=CodeID></td>
</TR>

</TABLE>

<INPUT TYPE=SUBMIT NAME=save VALUE="Save Details">

</FORM>

</BODY>
</HTML>