diff --git a/public/list.php b/public/list.php
index e51166c..b822356 100644
--- a/public/list.php
+++ b/public/list.php
@@ -1,279 +1,411 @@
$_SESSION['expire']) {
- session_destroy();
- header("Location: login.php");
- exit;
- }
-} else {
- header("Location: login.php");
+
+if (!isset($_SESSION['user_id'], $_SESSION['admin']) || $_SESSION['admin'] !== 'yes') {
+ header('Location: login.php');
+ exit;
+}
+
+if (!isset($_SESSION['expire']) || time() > (int)$_SESSION['expire']) {
+ session_destroy();
+ header('Location: login.php');
exit;
}
include 'header.php';
-// Get & sanitize inputs
-$beginurl = $_GET['begin'] ?? '';
-$endurl = $_GET['end'] ?? '';
-$search = isset($_GET['search']) ? htmlspecialchars(trim($_GET['search'])) : '';
-$order = $_GET['order'] ?? 'ptraylocation';
-$sort = $_GET['sort'] ?? 'ASC';
-$date = $_GET['date'] ?? '';
-$sort2 = $sort === 'ASC' ? 'DESC' : 'ASC';
-$searchurl= $search ? "&search={$search}" : '';
-
-// Date-range SQL
-if ($beginurl && $endurl) {
- $b = date("Y-m-d", strtotime($beginurl)) . ' 00:00:00';
- $e = date("Y-m-d", strtotime($endurl)) . ' 23:59:59';
- $daterange = " AND (ptimestamp BETWEEN \"$b\" AND \"$e\") ";
-} else {
- $daterange = '';
+if (!isset($conn) || !($conn instanceof mysqli)) {
+ die('Database connection not available.');
}
-// WHERE-clause
-if ($search) {
- $searchstring = "WHERE ptraylocation LIKE '%{$search}%' ";
-} elseif ($date) {
- $searchstring = "WHERE ptimestamp >= DATE_SUB(CURRENT_DATE, INTERVAL 1 {$date}) ";
-} else {
- $searchstring = '';
+date_default_timezone_set('America/New_York');
+
+function h($value)
+{
+ return htmlspecialchars((string)($value ?? ''), ENT_QUOTES, 'UTF-8');
}
-// Run query
-$sql = "SELECT * FROM ProcessingAll {$searchstring} {$daterange} ORDER BY {$order} {$sort}";
-$query = mysqli_query($conn, $sql);
-$row_cnt = mysqli_num_rows($query);
-?>
-
-
-
+$beginurl = isset($_GET['begin']) ? trim((string)$_GET['begin']) : '';
+$endurl = isset($_GET['end']) ? trim((string)$_GET['end']) : '';
+$search = isset($_GET['search']) ? trim((string)$_GET['search']) : '';
+$order = isset($_GET['order']) ? trim((string)$_GET['order']) : 'ptraylocation';
+$sort = isset($_GET['sort']) ? strtoupper(trim((string)$_GET['sort'])) : 'ASC';
+$date = isset($_GET['date']) ? strtoupper(trim((string)$_GET['date'])) : '';
-
+}
+
+$sql .= " ORDER BY {$order} {$sort}";
+$stmt = mysqli_prepare($conn, $sql);
+if (!$stmt) {
+ die('Query preparation failed: ' . h($conn->error));
+}
+
+if ($types !== '') {
+ mysqli_stmt_bind_param($stmt, $types, ...$params);
+}
+
+mysqli_stmt_execute($stmt);
+$result = mysqli_stmt_get_result($stmt);
+$row_cnt = ($result instanceof mysqli_result) ? mysqli_num_rows($result) : 0;
+?>
+
+
+
+
-
SCF Tray Processing List
-
-
-
+