diff --git a/interface/main/authorizations/authorizations.php b/interface/main/authorizations/authorizations.php index 9e1172ccc32..7d8235e4880 100644 --- a/interface/main/authorizations/authorizations.php +++ b/interface/main/authorizations/authorizations.php @@ -1,4 +1,13 @@ 2; @@ -24,13 +32,10 @@ if (isset($_GET["mode"]) && $_GET["mode"] == "authorize" && $imauthorized) { $retVal = getProviderId($_SESSION['authUser']); newEvent("authorize", $_SESSION["authUser"], $_SESSION["authProvider"], 1, $_GET["pid"]); - // sqlStatement("update billing set authorized=1, provider_id = '" . - // mysql_real_escape_string($retVal[0]['id']) . - // "' where pid='" . $_GET["pid"] . "'"); - sqlStatement("update billing set authorized=1 where pid='" . $_GET["pid"] . "'"); - sqlStatement("update forms set authorized=1 where pid='" . $_GET["pid"] . "'"); - sqlStatement("update pnotes set authorized=1 where pid='" . $_GET["pid"] . "'"); - sqlStatement("update transactions set authorized=1 where pid='" . $_GET["pid"] . "'"); + sqlStatement("update billing set authorized=1 where pid=?", array($_GET["pid"]) ); + sqlStatement("update forms set authorized=1 where pid=?", array($_GET["pid"]) ); + sqlStatement("update pnotes set authorized=1 where pid=?", array($_GET["pid"]) ); + sqlStatement("update transactions set authorized=1 where pid=?", array($_GET["pid"]) ); } ?> @@ -73,7 +78,7 @@ - + @@ -81,7 +86,7 @@   -() +() @@ -98,70 +103,65 @@ if ($res = sqlStatement("select *, concat(u.fname,' ', u.lname) as user " . "from billing LEFT JOIN users as u on billing.user = u.id where " . "billing.authorized = 0 and billing.activity = 1 and " . - "groupname = '$groupname'")) + "groupname = ?", array($groupname) )) { for ($iter = 0;$row = sqlFetchArray($res);$iter++) $result1[$iter] = $row; if ($result1) { foreach ($result1 as $iter) { $authorize{$iter{"pid"}}{"billing"} .= "" . - $iter{"code_text"} . " " . date("n/j/Y",strtotime($iter{"date"})) . + htmlspecialchars($iter{"code_text"} . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . "
\n"; } - //$authorize[$iter{"pid"}]{"billing"} = substr($authorize[$iter{"pid"}]{"billing"},0,strlen($authorize[$iter{"pid"}]{"billing"})); } } //fetch transaction information: if ($res = sqlStatement("select * from transactions where " . - "authorized = 0 and groupname = '$groupname'")) + "authorized = 0 and groupname = ?", array($groupname) )) { for ($iter = 0;$row = sqlFetchArray($res);$iter++) $result2[$iter] = $row; if ($result2) { foreach ($result2 as $iter) { $authorize{$iter{"pid"}}{"transaction"} .= "" . - $iter{"title"} . ": " . stripslashes(strterm($iter{"body"},25)) . - " " . date("n/j/Y",strtotime($iter{"date"})) . "
\n"; + htmlspecialchars($iter{"title"} . ": " . (strterm($iter{"body"},25)) . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . + "
\n"; } - //$authorize[$iter{"pid"}]{"transaction"} = substr($authorize[$iter{"pid"}]{"transaction"},0,strlen($authorize[$iter{"pid"}]{"transaction"})); } } if (empty($GLOBALS['ignore_pnotes_authorization'])) { //fetch pnotes information: if ($res = sqlStatement("select * from pnotes where authorized = 0 and " . - "groupname = '$groupname'")) + "groupname = ?", array($groupname) )) { for ($iter = 0;$row = sqlFetchArray($res);$iter++) $result3[$iter] = $row; if ($result3) { foreach ($result3 as $iter) { $authorize{$iter{"pid"}}{"pnotes"} .= "" . - stripslashes(strterm($iter{"body"},25)) . " " . - date("n/j/Y",strtotime($iter{"date"})) . "
\n"; + htmlspecialchars((strterm($iter{"body"},25)) . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . + "
\n"; } - // $authorize[$iter{"pid"}]{"pnotes"} = substr($authorize[$iter{"pid"}]{"pnotes"},0,strlen($authorize[$iter{"pid"}]{"pnotes"})); } } } //fetch forms information: if ($res = sqlStatement("select * from forms where authorized = 0 and " . - "groupname = '$groupname'")) + "groupname = ?", array($groupname) )) { for ($iter = 0;$row = sqlFetchArray($res);$iter++) $result4[$iter] = $row; if ($result4) { foreach ($result4 as $iter) { $authorize{$iter{"pid"}}{"forms"} .= "" . - $iter{"form_name"} . " " . date("n/j/Y",strtotime($iter{"date"})) . + htmlspecialchars($iter{"form_name"} . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . "
\n"; } - // $authorize[$iter{"pid"}]{"forms"} = substr($authorize[$iter{"pid"}]{"forms"},0,strlen($authorize[$iter{"pid"}]{"forms"})); } } -// echo "HERE"; // what the heck was this for? ?> @@ -183,7 +183,7 @@ print "\n"; break; } @@ -193,42 +193,41 @@ // Clicking the patient name will load both frames for that patient, // as demographics.php takes care of loading the bottom frame. - echo ""; + echo ""; } else { - echo ""; + echo ""; } - echo "" . $name{"fname"} . " " . - $name{"lname"} . "
" . + echo "" . htmlspecialchars($name{"fname"},ENT_NOQUOTES) . " " . + htmlspecialchars($name{"lname"},ENT_NOQUOTES) . "
" . "" . xl('Authorize') . "\n"; + "&pid=" . htmlspecialchars($ppid,ENT_QUOTES) . "'>" . + htmlspecialchars(xl('Authorize'),ENT_NOQUOTES) . "\n"; /**** //Michael A Rowley MD 20041012. // added below 4 lines to add provider to authorizations for ez reference. $providerID = sqlFetchArray(sqlStatement( - "select providerID from patient_data where pid=$ppid")); + "select providerID from patient_data where pid=?", array($ppid) )); $userID=$providerID{"providerID"}; $providerName = sqlFetchArray(sqlStatement( - "select lname from users where id=$userID")); + "select lname from users where id=?", array($userID) )); ****/ // Don't use sqlQuery because there might be no match. $providerName = sqlFetchArray(sqlStatement( - "select lname from users where id = '" . $name['providerID'] . "'")); - /****/ - - echo "\n"; - // ha ha, see if that works....mar. - echo "\n"; + echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; echo "\n"; @@ -288,7 +287,7 @@ // no-op - alert(""); + alert(""); } diff --git a/interface/main/authorizations/authorizations_full.php b/interface/main/authorizations/authorizations_full.php index 551f689daec..b61c5c09778 100644 --- a/interface/main/authorizations/authorizations_full.php +++ b/interface/main/authorizations/authorizations_full.php @@ -1,13 +1,22 @@ @@ -23,8 +32,8 @@ - - + +" . $iter{"user"} . ": " . $iter{"code_text"} . " " . date("n/j/Y",strtotime($iter{"date"})) . "
\n"; +$authorize{$iter{"pid"}}{"billing"} .= "" . + htmlspecialchars($iter{"user"},ENT_NOQUOTES) . ": " . + htmlspecialchars($iter{"code_text"} . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . + "
\n"; } -//$authorize[$iter{"pid"}]{"billing"} = substr($authorize[$iter{"pid"}]{"billing"},0,strlen($authorize[$iter{"pid"}]{"billing"})); - } } //fetch transaction information: -if ($res = sqlStatement("select * from transactions where authorized=0 and groupname='$groupname'")) { +if ($res = sqlStatement("select * from transactions where authorized=0 and groupname=?", array($groupname) )) { for ($iter = 0;$row = sqlFetchArray($res);$iter++) $result2[$iter] = $row; if ($result2) { foreach ($result2 as $iter) { -$authorize{$iter{"pid"}}{"transaction"} .= "" . $iter{"user"} . ": " . $iter{"title"} . ": " . strterm($iter{"body"},25) . " " . date("n/j/Y",strtotime($iter{"date"})) . "
\n"; +$authorize{$iter{"pid"}}{"transaction"} .= "" . + htmlspecialchars($iter{"user"},ENT_NOQUOTES) . ": " . + htmlspecialchars($iter{"title"} . ": " . strterm($iter{"body"},25) . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . + "
\n"; } -//$authorize[$iter{"pid"}]{"transaction"} = substr($authorize[$iter{"pid"}]{"transaction"},0,strlen($authorize[$iter{"pid"}]{"transaction"})); - } } if (empty($GLOBALS['ignore_pnotes_authorization'])) { //fetch pnotes information, exclude ALL deleted notes - if ($res = sqlStatement("select * from pnotes where authorized=0 and deleted!=1 and groupname='$groupname'")) { + if ($res = sqlStatement("select * from pnotes where authorized=0 and deleted!=1 and groupname=?", array($groupname) )) { for ($iter = 0;$row = sqlFetchArray($res);$iter++) $result3[$iter] = $row; if ($result3) { foreach ($result3 as $iter) { $authorize{$iter{"pid"}}{"pnotes"} .= "" . - $iter{"user"} . ": " . - strterm($iter{"body"},25) . " " . - date("n/j/Y",strtotime($iter{"date"})) . "
\n"; + htmlspecialchars($iter{"user"},ENT_NOQUOTES) . ": " . + htmlspecialchars(strterm($iter{"body"},25) . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . + "
\n"; } } } } //fetch forms information: -if ($res = sqlStatement("select * from forms where authorized=0 and groupname='$groupname'")) { +if ($res = sqlStatement("select * from forms where authorized=0 and groupname=?", array($groupname) )) { for ($iter = 0;$row = sqlFetchArray($res);$iter++) $result4[$iter] = $row; if ($result4) { foreach ($result4 as $iter) { -$authorize{$iter{"pid"}}{"forms"} .= "" . $iter{"user"} . ": " . $iter{"form_name"} . " " . date("n/j/Y",strtotime($iter{"date"})) . "
\n"; +$authorize{$iter{"pid"}}{"forms"} .= "" . + htmlspecialchars($iter{"user"},ENT_NOQUOTES) . ": " . + htmlspecialchars($iter{"form_name"} . " " . date("n/j/Y",strtotime($iter{"date"})),ENT_NOQUOTES) . + "
\n"; } -//$authorize[$iter{"pid"}]{"forms"} = substr($authorize[$iter{"pid"}]{"forms"},0,strlen($authorize[$iter{"pid"}]{"forms"})); - } } ?> @@ -110,14 +122,17 @@ $name = getPatientData($ppid); - echo "\n"; - echo "\n"; - - echo "\n"; - - echo "\n"; - - echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; echo "\n"; $count++; } diff --git a/library/patient.inc b/library/patient.inc index c5d75a960fb..371743995cc 100644 --- a/library/patient.inc +++ b/library/patient.inc @@ -266,8 +266,8 @@ function getProviderName($providerID) { } function getProviderId($providerName) { - $query = "select id from users where username = '". mysql_real_escape_string($providerName)."'"; - $rez = sqlStatement($query); + $query = "select id from users where username = ?"; + $rez = sqlStatement($query, array($providerName) ); for($iter=0; $row=sqlFetchArray($rez); $iter++) $returnval[$iter]=$row; return $returnval;
" . - xl('Some authorizations were not displayed. Click here to view all') . + htmlspecialchars(xl('Some authorizations were not displayed. Click here to view all'),ENT_NOQUOTES) . "
".xl('Provider').":
" . - $providerName{"lname"} . "		".xl('Billing').":
" . + "select lname from users where id = ?", array($name['providerID']) )); + + echo "		".htmlspecialchars(xl('Provider'),ENT_NOQUOTES).":
" . + htmlspecialchars($providerName{"lname"},ENT_NOQUOTES) . "		".htmlspecialchars(xl('Billing'),ENT_NOQUOTES).":
" . $patient{"billing"} . "		".xl('Transactions').":
" . + echo "		".htmlspecialchars(xl('Transactions'),ENT_NOQUOTES).":
" . $patient{"transaction"} . "		".xl('Patient Notes').":
" . + echo "		".htmlspecialchars(xl('Patient Notes'),ENT_NOQUOTES).":
" . $patient{"pnotes"} . "		".xl('Encounter Forms').":
" . + echo "		".htmlspecialchars(xl('Encounter Forms'),ENT_NOQUOTES).":
" . $patient{"forms"} . "
". $name{"fname"} . " " . $name{"lname"} ."
".xl('Authorize')."		".xl('Billing').":
" . $patient{"billing"} . "		".xl('Transactions').":
" . $patient{"transaction"} . "		".xl('Patient Notes').":
" . $patient{"pnotes"} . "		".xl('Encounter Forms').":
" . $patient{"forms"} . "
". htmlspecialchars($name{"fname"} . " " . $name{"lname"},ENT_NOQUOTES) . + "
" . htmlspecialchars(xl('Authorize'),ENT_NOQUOTES) . "		".htmlspecialchars(xl('Billing'),ENT_NOQUOTES). + ":
" . $patient{"billing"} . "		".htmlspecialchars(xl('Transactions'),ENT_NOQUOTES). + ":
" . $patient{"transaction"} . "		".htmlspecialchars(xl('Patient Notes'),ENT_NOQUOTES). + ":
" . $patient{"pnotes"} . "		".htmlspecialchars(xl('Encounter Forms'),ENT_NOQUOTES). + ":
" . $patient{"forms"} . "