<?php
// Kontextwechsel PHP -> HTML
$e = function ($s) { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); };
// Kontextwechsel PHP -> SQL
$sqle = function ($s) { return mysql_real_escape_string($s); };
$temp = (isset($_GET['kdnr'])) ? (int) $_GET['kdnr'] : 0;
if (isset($_GET['writevalues'])) {
send_sql($globalDbName, "
UPDATE
kundentbl
SET
debitor = '" . $sqle($_GET['debitor']) . "',
firma = '" . $sqle($_GET['firma']) . "',
wnr = '" . $sqle($_GET['wnr']) . "',
start_date = '" . $sqle($_GET['start_date']) . "',
end_date = '" . $sqle($_GET['end_date']) . "',
ort = '" . $sqle($_GET['ort']) . "',
bm_abr_zeitr = '" . $sqle($_GET['bm_abr_zeitr']) . "',
fw = '" . $sqle($_GET['fw']) . "',
bm = '" . $sqle($_GET['bm']) . "',
mbk = '" . $sqle($_GET['mbk']) . "',
wp = '" . $sqle($_GET['wp']) . "',
ke = '" . $sqle($_GET['ke']) . "',
splitting = '" . $sqle($_GET['splitting']) . "',
miete = '" . $sqle($_GET['miete']) . "',
webservice = '" . $sqle($_GET['webservice']) . "',
schrankfservice = '" . $sqle($_GET['schrankfservice']) . "',
lp = '" . $sqle($_GET['lp']) . "'
WHERE
debitor = '" . $sqle($temp) . "'
");
header('Location: kundenbearbeiten.php');
exit;
}
$debitors = array();
if ($temp > 0) {
$result = send_sql($globalDbName, "
SELECT *
FROM kundentbl
WHERE debitor = '" . $sqle($temp) . "'
");
while ($row = mysql_fetch_array($result)) {
$debitors[] = $row;
}
}
?>
<form name="readvalues" method="get" action="kundenbearbeiten.php">
Die Enter-Taste bewirkt NUR das Auslesen der Werte<br>
Kundennummer: <input type="text" name="kdnr" maxlength="6" required="required">
<input type="submit" name="readvalues" value="Werte Auslesen">
<input type="submit" name="writevalues" value="Werte in Datenbank schreiben">
<?php foreach ($debitors as $debitor) : ?>
Debitor:<br>
<input type="text" name="debitor" value="<?=$e($debitor['debitor'])?>"><br>
Firma:<br>
<input type="text" name="firma" value="<?=$e($debitor['firma'])?>"><br>
<!-- usw. -->
<?php endforeach; ?>
</form>
