Additional Sql-injection functions and techniques for escaping;
[openemr.git] / interface / forms / note / view.php
blobc88d4c8777bfb9a9c167a9e300a23779259ab788
1 <!-- Work/School Note Form created by Nikolai Vitsyn: 2004/02/13 and update 2005/03/30
2 Copyright (C) Open Source Medical Software
4 This program is free software; you can redistribute it and/or
5 modify it under the terms of the GNU General Public License
6 as published by the Free Software Foundation; either version 2
7 of the License, or (at your option) any later version.
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
14 You should have received a copy of the GNU General Public License
15 along with this program; if not, write to the Free Software
16 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -->
18 <?php
20 $fake_register_globals=false;
21 $sanitize_all_escapes=true;
23 include_once("../../globals.php");
24 include_once("$srcdir/api.inc");
25 formHeader("Form: note");
26 $returnurl = $GLOBALS['concurrent_layout'] ? 'encounter_top.php' : 'patient_encounter.php';
27 $provider_results = sqlQuery("select fname, lname from users where username=?",array($_SESSION{"authUser"}));
29 /* name of this form */
30 $form_name = "note";
32 // get the record from the database
33 if ($_GET['id'] != "") $obj = formFetch("form_".$form_name, $_GET["id"]);
34 /* remove the time-of-day from the date fields */
35 if ($obj['date_of_signature'] != "") {
36 $dateparts = split(" ", $obj['date_of_signature']);
37 $obj['date_of_signature'] = $dateparts[0];
40 <html><head>
41 <?php html_header_show();?>
42 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
44 <!-- supporting javascript code -->
45 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery.js"></script>
46 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/textformat.js"></script>
48 <!-- pop up calendar -->
49 <style type="text/css">@import url(<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar.css);</style>
50 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar.js"></script>
51 <?php include_once("{$GLOBALS['srcdir']}/dynarch_calendar_en.inc.php"); ?>
52 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar_setup.js"></script>
54 <script language="JavaScript">
55 // required for textbox date verification
56 var mypcc = '<?php echo $GLOBALS['phone_country_code'] ?>';
58 function PrintForm() {
59 newwin = window.open("<?php echo $rootdir."/forms/".$form_name."/print.php?id=".attr($_GET["id"]); ?>","mywin");
62 </script>
64 </head>
65 <body class="body_top">
67 <form method=post action="<?php echo $rootdir."/forms/".$form_name."/save.php?mode=update&id=".attr($_GET["id"]);?>" name="my_form" id="my_form">
68 <span class="title"><?php echo xlt('Work/School Note'); ?></span><br></br>
70 <div style="margin: 10px;">
71 <input type="button" class="save" value=" <?php echo xla('Save'); ?> "> &nbsp;
72 <input type="button" class="dontsave" value="<?php echo xla('Don\'t Save'); ?>"> &nbsp;
73 <input type="button" class="printform" value="<?php echo xla('Print'); ?>"> &nbsp;
74 </div>
76 <select name="note_type">
77 <option value="WORK NOTE" <?php if ($obj['note_type']=="WORK NOTE") echo " SELECTED"; ?>><?php echo xlt('WORK NOTE'); ?></option>
78 <option value="SCHOOL NOTE" <?php if ($obj['note_type']=="SCHOOL NOTE") echo " SELECTED"; ?>><?php echo xlt('SCHOOL NOTE'); ?></option>
79 </select>
80 <br>
81 <b><?php echo xlt('MESSAGE:'); ?></b>
82 <br>
83 <textarea name="message" id="message" cols ="67" rows="4"><?php echo text($obj["message"]);?></textarea>
84 <br> <br>
86 <table>
87 <tr><td>
88 <span class=text><?php echo xlt('Doctor:'); ?> </span><input type=entry name="doctor" value="<?php echo attr($obj["doctor"]);?>">
89 </td><td>
90 <span class="text"><?php echo xlt('Date'); ?></span>
91 <input type='text' size='10' name='date_of_signature' id='date_of_signature'
92 value='<?php echo attr($obj['date_of_signature']); ?>'
93 title='<?php echo xla('yyyy-mm-dd'); ?>'
94 onkeyup='datekeyup(this,mypcc)' onblur='dateblur(this,mypcc)' />
95 <img src='../../pic/show_calendar.gif' align='absbottom' width='24' height='22'
96 id='img_date_of_signature' border='0' alt='[?]' style='cursor:pointer;cursor:hand'
97 title='<?php echo xla('Click here to choose a date'); ?>'>
98 </td></tr>
99 </table>
101 <div style="margin: 10px;">
102 <input type="button" class="save" value=" <?php echo xla('Save'); ?> "> &nbsp;
103 <input type="button" class="dontsave" value="<?php echo xla('Don\'t Save'); ?>"> &nbsp;
104 <input type="button" class="printform" value="<?php echo xla('Print'); ?>"> &nbsp;
105 </div>
107 </form>
109 </body>
111 <script language="javascript">
112 /* required for popup calendar */
113 Calendar.setup({inputField:"date_of_signature", ifFormat:"%Y-%m-%d", button:"img_date_of_signature"});
115 // jQuery stuff to make the page a little easier to use
117 $(document).ready(function(){
118 $(".save").click(function() { top.restoreSession(); $("#my_form").submit(); });
119 $(".dontsave").click(function() { location.href='<?php echo "$rootdir/patient_file/encounter/$returnurl";?>'; });
120 $(".printform").click(function() { PrintForm(); });
122 // disable the Print ability if the form has changed
123 // this forces the user to save their changes prior to printing
124 $("#img_date_of_signature").click(function() { $(".printform").attr("disabled","disabled"); });
125 $("input").keydown(function() { $(".printform").attr("disabled","disabled"); });
126 $("select").change(function() { $(".printform").attr("disabled","disabled"); });
127 $("textarea").keydown(function() { $(".printform").attr("disabled","disabled"); });
130 </script>
132 </html>