Fix exposed HTML chars in RX report (#7058)
[openemr.git] / interface / reports / prescriptions_report.php
blob42216fda66b04982296458e4c4ec8026b5897812
1 <?php
3 /**
4 * This report lists prescriptions and their dispensations according
5 * to various input selection criteria.
7 * @package OpenEMR
8 * @link http://www.open-emr.org
9 * @author Rod Roark <rod@sunsetsystems.com>
10 * @author Brady Miller <brady.g.miller@gmail.com>
11 * @copyright Copyright (c) 2005-2016 Rod Roark <rod@sunsetsystems.com>
12 * @copyright Copyright (c) 2017-2018 Brady Miller <brady.g.miller@gmail.com>
13 * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
16 require_once("../globals.php");
17 require_once("$srcdir/patient.inc.php");
18 require_once("$srcdir/options.inc.php");
19 require_once("../drugs/drugs.inc.php");
21 use OpenEMR\Common\Acl\AclMain;
22 use OpenEMR\Common\Csrf\CsrfUtils;
23 use OpenEMR\Common\Twig\TwigContainer;
24 use OpenEMR\Core\Header;
26 if (!AclMain::aclCheckCore('patients', 'rx')) {
27 echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Prescriptions and Dispensations")]);
28 exit;
31 if (!empty($_POST)) {
32 if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
33 CsrfUtils::csrfNotVerified();
37 $form_from_date = (!empty($_POST['form_from_date'])) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-01-01');
38 $form_to_date = (!empty($_POST['form_to_date'])) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
39 $form_patient_id = trim($_POST['form_patient_id'] ?? '');
40 $form_drug_name = trim($_POST['form_drug_name'] ?? '');
41 $form_lot_number = trim($_POST['form_lot_number'] ?? '');
42 $form_facility = isset($_POST['form_facility']) ? $_POST['form_facility'] : '';
44 <html>
45 <head>
47 <title><?php echo xlt('Prescriptions and Dispensations'); ?></title>
49 <?php Header::setupHeader(['datetime-picker', 'report-helper']); ?>
51 <script>
53 $(function () {
54 oeFixedHeaderSetup(document.getElementById('mymaintable'));
55 var win = top.printLogSetup ? top : opener.top;
56 win.printLogSetup(document.getElementById('printbutton'));
58 $('.datepicker').datetimepicker({
59 <?php $datetimepicker_timepicker = false; ?>
60 <?php $datetimepicker_showseconds = false; ?>
61 <?php $datetimepicker_formatInput = true; ?>
62 <?php require($GLOBALS['srcdir'] . '/js/xl/jquery-datetimepicker-2-5-4.js.php'); ?>
63 <?php // can add any additional javascript settings to datetimepicker here; need to prepend first setting with a comma ?>
64 });
65 });
67 // The OnClick handler for receipt display.
68 function show_receipt(payid) {
69 // dlgopen('../patient_file/front_payment.php?receipt=1&payid=' + payid, '_blank', 550, 400);
70 return false;
73 </script>
75 <style>
77 /* specifically include & exclude from printing */
78 @media print {
79 #report_parameters {
80 visibility: hidden;
81 display: none;
83 #report_parameters_daterange {
84 visibility: visible;
85 display: inline;
87 #report_results table {
88 margin-top: 0px;
92 /* specifically exclude some from the screen */
93 @media screen {
94 #report_parameters_daterange {
95 visibility: hidden;
96 display: none;
100 </style>
101 </head>
103 <body class="body_top">
105 <!-- Required for the popup date selectors -->
106 <div id="overDiv" style="position: absolute; visibility: hidden; z-index: 1000;"></div>
108 <span class='title'><?php echo xlt('Report'); ?> - <?php echo xlt('Prescriptions and Dispensations'); ?></span>
110 <div id="report_parameters_daterange">
111 <?php echo text(oeFormatShortDate($form_from_date)) . " &nbsp; " . xlt('to{{Range}}') . " &nbsp; " . text(oeFormatShortDate($form_to_date)); ?>
112 </div>
114 <form name='theform' id='theform' method='post' action='prescriptions_report.php' onsubmit='return top.restoreSession()'>
115 <input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
117 <div id="report_parameters">
119 <input type='hidden' name='form_refresh' id='form_refresh' value=''/>
120 <table>
121 <tr>
122 <td width='640px'>
123 <div style='float: left'>
125 <table class='text'>
126 <tr>
127 <td class='col-form-label'>
128 <?php echo xlt('Facility'); ?>:
129 </td>
130 <td>
131 <?php dropdown_facility($form_facility, 'form_facility', true); ?>
132 </td>
133 <td class='col-form-label'>
134 <?php echo xlt('From'); ?>:
135 </td>
136 <td>
137 <input type='text' class='datepicker form-control' name='form_from_date' id="form_from_date" size='10' value='<?php echo attr(oeFormatShortDate($form_from_date)); ?>' />
138 </td>
139 <td class='col-form-label'>
140 <?php echo xlt('To{{Range}}'); ?>:
141 </td>
142 <td>
143 <input type='text' class='datepicker form-control' name='form_to_date' id="form_to_date" size='10' value='<?php echo attr(oeFormatShortDate($form_to_date)); ?>' />
144 </td>
145 </tr>
146 <tr>
147 <td class='col-form-label'>
148 <?php echo xlt('Patient ID'); ?>:
149 </td>
150 <td>
151 <input type='text' class='form-control' name='form_patient_id' size='10' maxlength='20' value='<?php echo attr($form_patient_id); ?>' title='<?php echo xla('Optional numeric patient ID'); ?>' />
152 </td>
153 <td class='col-form-label'>
154 <?php echo xlt('Drug'); ?>:
155 </td>
156 <td>
157 <input type='text' class='form-control' name='form_drug_name' size='10' maxlength='250' value='<?php echo attr($form_drug_name); ?>'
158 title='<?php echo xla('Optional drug name, use % as a wildcard'); ?>' />
159 </td>
160 <td class='col-form-label'>
161 <?php echo xlt('Lot'); ?>:
162 </td>
163 <td>
164 <input type='text' class='form-control' name='form_lot_number' size='10' maxlength='20' value='<?php echo attr($form_lot_number); ?>'
165 title='<?php echo xla('Optional lot number, use % as a wildcard'); ?>' />
166 </td>
167 </tr>
168 </table>
170 </div>
172 </td>
173 <td class='h-100' align='left' valign='middle'>
174 <table class='w-100 h-100' style='border-left:1px solid;'>
175 <tr>
176 <td>
177 <div class="text-center">
178 <div class="btn-group" role="group">
179 <a href='#' class='btn btn-secondary btn-save' onclick='$("#form_refresh").attr("value","true"); $("#theform").submit();'>
180 <?php echo xlt('Submit'); ?>
181 </a>
182 <?php if (!empty($_POST['form_refresh'])) { ?>
183 <a href='#' class='btn btn-secondary btn-print' id='printbutton'>
184 <?php echo xlt('Print'); ?>
185 </a>
186 <?php } ?>
187 </div>
188 </div>
189 </td>
190 </tr>
191 </table>
192 </td>
193 </tr>
194 </table>
195 </div> <!-- end of parameters -->
197 <?php
198 if (!empty($_POST['form_refresh'])) {
200 <div id="report_results">
201 <table class='table' id='mymaintable'>
202 <thead class='thead-light'>
203 <th> <?php echo xlt('Patient'); ?> </th>
204 <th> <?php echo xlt('ID'); ?> </th>
205 <th> <?php echo xlt('RX'); ?> </th>
206 <th> <?php echo xlt('Drug Name'); ?> </th>
207 <th> <?php echo xlt('NDC'); ?> </th>
208 <th> <?php echo xlt('Units'); ?> </th>
209 <th> <?php echo xlt('Refills'); ?> </th>
210 <th> <?php echo xlt('Instructed'); ?> </th>
211 <th> <?php echo xlt('Reactions'); ?> </th>
212 <th> <?php echo xlt('Dispensed'); ?> </th>
213 <th> <?php echo xlt('Qty'); ?> </th>
214 <th> <?php echo xlt('Manufacturer'); ?> </th>
215 <th> <?php echo xlt('Lot'); ?> </th>
216 </thead>
217 <tbody>
218 <?php
219 if ($_POST['form_refresh']) {
220 $sqlBindArray = array();
222 $where = "r.date_modified >= ? AND " .
223 "r.date_modified <= ?";
224 array_push($sqlBindArray, $form_from_date, $form_to_date);
226 if ($form_patient_id) {
227 $where .= " AND p.pubpid = ?";
228 array_push($sqlBindArray, $form_patient_id);
231 if ($form_drug_name) {
232 $where .= " AND (d.name LIKE ? OR r.drug LIKE ?)";
233 array_push($sqlBindArray, $form_drug_name, $form_drug_name);
236 if ($form_lot_number) {
237 $where .= " AND i.lot_number LIKE ?";
238 array_push($sqlBindArray, $form_lot_number);
241 $query = "SELECT r.id, r.patient_id, " .
242 "r.date_modified, r.dosage, r.route, r.interval, r.refills, r.drug, " .
243 "d.name, d.ndc_number, d.form, d.size, d.unit, d.reactions, " .
244 "s.sale_id, s.sale_date, s.quantity, " .
245 "i.manufacturer, i.lot_number, i.expiration, " .
246 "p.pubpid, " .
247 "p.fname, p.lname, p.mname, u.facility_id " .
248 "FROM prescriptions AS r " .
249 "LEFT OUTER JOIN drugs AS d ON d.drug_id = r.drug_id " .
250 "LEFT OUTER JOIN drug_sales AS s ON s.prescription_id = r.id " .
251 "LEFT OUTER JOIN drug_inventory AS i ON i.inventory_id = s.inventory_id " .
252 "LEFT OUTER JOIN patient_data AS p ON p.pid = r.patient_id " .
253 "LEFT OUTER JOIN users AS u ON u.id = r.provider_id " .
254 "WHERE $where " .
255 "ORDER BY p.lname, p.fname, p.pubpid, r.id, s.sale_id";
257 $res = sqlStatement($query, $sqlBindArray);
259 $last_patient_id = 0;
260 $last_prescription_id = 0;
261 while ($row = sqlFetchArray($res)) {
262 // If a facility is specified, ignore rows that do not match.
263 if ($form_facility !== '') {
264 if ($form_facility) {
265 if ($row['facility_id'] != $form_facility) {
266 continue;
268 } else {
269 if (!empty($row['facility_id'])) {
270 continue;
275 $patient_name = $row['lname'] . ', ' . $row['fname'] . ' ' . $row['mname'];
276 $patient_id = $row['pubpid'];
277 $prescription_id = $row['id'];
278 $drug_name = empty($row['name']) ? $row['drug'] : $row['name'];
279 $ndc_number = $row['ndc_number'];
280 $drug_units = text($row['size']) . ' ' .
281 generate_display_field(array('data_type' => '1','list_id' => 'drug_units'), $row['unit']);
282 $refills = $row['refills'];
283 $reactions = $row['reactions'];
284 $instructed = text($row['dosage']) . ' ' .
285 generate_display_field(array('data_type' => '1','list_id' => 'drug_form'), $row['form']) .
286 ' ' .
287 generate_display_field(array('data_type' => '1','list_id' => 'drug_interval'), $row['interval']);
288 //if ($row['patient_id'] == $last_patient_id) {
289 if (strcmp($row['pubpid'], $last_patient_id) == 0) {
290 $patient_name = $patient_id = '';
291 if ($row['id'] == $last_prescription_id) {
292 $prescription_id = $drug_name = $ndc_number = $drug_units = $refills = $reactions = $instructed = '';
296 <tr>
297 <td>
298 <?php echo text($patient_name); ?>
299 </td>
300 <td>
301 <?php echo text($patient_id); ?>
302 </td>
303 <td>
304 <?php echo text($prescription_id); ?>
305 </td>
306 <td>
307 <?php echo text($drug_name); ?>
308 </td>
309 <td>
310 <?php echo text($ndc_number); ?>
311 </td>
312 <td>
313 <?php echo $drug_units; ?>
314 </td>
315 <td>
316 <?php echo text($refills); ?>
317 </td>
318 <td>
319 <?php echo $instructed; ?>
320 </td>
321 <td>
322 <?php echo text($reactions); ?>
323 </td>
324 <td>
325 <a href='../drugs/dispense_drug.php?sale_id=<?php echo attr_url($row['sale_id']); ?>'
326 style='color:#0000ff' target='_blank'>
327 <?php echo text(oeFormatShortDate($row['sale_date'])); ?>
328 </a>
329 </td>
330 <td>
331 <?php echo text($row['quantity']); ?>
332 </td>
333 <td>
334 <?php echo text($row['manufacturer']); ?>
335 </td>
336 <td>
337 <?php echo text($row['lot_number']); ?>
338 </td>
339 </tr>
340 <?php
341 $last_prescription_id = $row['id'];
342 //$last_patient_id = $row['patient_id'];
343 $last_patient_id = $row['pubpid'];
344 } // end while
345 } // end if
347 </tbody>
348 </table>
349 </div> <!-- end of results -->
350 <?php } else { ?>
351 <div class='text'>
352 <?php echo xlt('Please input search criteria above, and click Submit to view results.'); ?>
353 </div>
354 <?php } ?>
355 </form>
356 </body>
358 </html>