prepare($sql_select_old);
$sql_check_old->execute([$OLDUUID]);
$result_old = $sql_check_old->fetch(PDO::FETCH_ASSOC); //$result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
} //End Try check site code
catch (PDOException $ex) {
echo "
" . $ex->getMessage();
} //close catch exception from try
$name = $result_old["name"] ;
$visitor_email = $result_old['visitor_email'];
$custom1 = $result_old['custom1'];
$custom2 = $result_old['custom2'];
$custom3 = $result_old['custom3'];
$CCode = $result_old['CCode'];
$visitor_phone = $result_old['visitor_phone'];
// Eliminate record
try
{
$sql_update = 'call removeUUID(?)';
$stmt_update = $pdo1->prepare($sql_update);
$stmt_update->execute([$OLDUUID]);
}
catch (PDOException $ex)
{
echo "
" . $ex->getMessage();
} //close catch exception from try
}
// No ID sent through or ID=blank sent through
if(!isset($_REQUEST['ID']) && !isset($_REQUEST['id']) && !isset($_REQUEST['iD']) && !isset($_REQUEST['Id']) || empty($RID) ){
echo "No code provided. Redirecting...
";
header( "refresh:2;url=https://$host/noSite.php");
exit();
}
//ID has some value
if(isset($RID))
{
// echo "Using $RID for processing...";
if($RID == "1a2b3c4d"){
echo "You have used the example code rather than the site code.
";
echo "Please use the eight digit code specific to the place you are visiting.
";
echo "Redirecting you in 5 seconds...
";
header( "refresh:3;url=https://$host/noSite.php" );
exit();
}
//Get parentID from siteID
try {
$sql_site="SELECT parentID, siteName FROM customerSites WHERE siteID = ?";
$sql_site_check = $pdo2->prepare($sql_site);
$sql_site_check->execute([$RID]);
$site_result = $sql_site_check->fetch(PDO::FETCH_ASSOC); //$result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
} //End Try check site code
catch (PDOException $ex) {
echo "
" . $ex->getMessage();
} //close catch exception from try
if(empty($site_result)){
echo "No registered business or place matches \"$RID\"
";
echo "Please use the eight digit code specific to the place you are visiting.
";
echo "Redirecting you in 5 seconds.
";
header( "refresh:5;url=https://$host/noSite.php" );
exit();
}
//print_r($site_result);
$siteName = $site_result["siteName"] ;
$parentID = $site_result["parentID"] ;
try {
$sql_select="SELECT tradingName, registerLogo FROM customers WHERE parentID = ?";
$sql_check = $pdo2->prepare($sql_select);
$sql_check->execute([$parentID]);
$result = $sql_check->fetch(PDO::FETCH_ASSOC); //$result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
} //End Try check site code
catch (PDOException $ex) {
echo "
" . $ex->getMessage();
} //close catch exception from try
// print_r($result). "\n";
$tradingName = $result["tradingName"] ;
$registerLogo = $result["registerLogo"];
// echo "Site Name is".$siteName."\n";
// $redirectURL = $result["redirectURL"] ;
// echo "URL is $rediredURL\n";
} //Close Site code sent check
// // select a particular user by id
// $stmt = $pdo->prepare("SELECT * FROM users WHERE id=?");
// $stmt->execute([$id]);
// $user = $stmt->fetch();
if(isset($_POST['submit']))
{
$RID = $_POST['ID']; //This is correct. "ID" is the form variable name.
$name = $_POST['name'];
$visitor_email = $_POST['visitor_email'];
$custom1 = $_POST['custom1'] ?? ''; //da261e98:Profession
$custom2 = $_POST['custom2'] ?? ''; //da261e98:Specialty
$custom3 = $_POST['custom3'] ?? ''; //da261e98:Address
$CCode = $_POST['CCode'];
// print_r($_POST['CCode']);
$visitor_phone = $_POST['visitor_phone'];
$numlength = strlen((string)$visitor_phone);
$signInOut = $_POST['submit'];
// $UID = bin2hex(random_bytes(16));
// echo $UID."-".strlen($UID)."\n";
///------------Do Validations-------------
if($parentID!='da261e98' && (empty($visitor_email) && empty($visitor_phone) ) )
{
$errors .= "\n Name and one of either Email or Phone Number are required fields. ";
}
if($parentID=='da261e98' )
{
if (empty($visitor_email)) {
$errors .= "\n Email is a required field. ";
}
if (empty($custom1)) {
$errors .= "\n Profession is a required field. ";
}
if (empty($custom2)) {
$errors .= "\n Specialty is a required field. ";
}
}
if (empty($name) )
{
$errors .= "\n Name is a required field. ";
}
if ( !empty($visitor_phone) && !is_numeric($visitor_phone) )
{
$errors .= "\n Numbers only for phone please. ";
}
if(!empty($visitor_phone) && $numlength <= "4")
{
$errors .= "\n Please enter the correct number of digits for your phone number.";
}
if(IsInjected($visitor_email))
{
$errors .= "\n Bad email value!";
}
if(empty($errors))
{
try {
$sql_insert =
'INSERT INTO
register (
site,
parentID,
name,
visitor_email,
custom1,
custom2,
custom3,
CCode,
visitor_phone,
UID,
signInOut
)
VALUES (?,?,?,?,?,?,?,?,?,?,?)';
$stmt_insert = $pdo1->prepare($sql_insert);
$stmt_insert->execute(
[$RID,
$parentID,
$name,
$visitor_email,
$custom1,
$custom2,
$custom3,
$CCode,
$visitor_phone,
$UID,
$signInOut
]);
}
catch (PDOException $ex) {
echo "
" . $ex->getMessage();
} //close catch exception from try
//Close INSERT register data
header("Location: https://$host/confirm.php?UID=$UID");
}
}
// Function to validate against any email injection attempts
function IsInjected($str)
{
$injections = array('(\n+)',
'(\r+)',
'(\t+)',
'(%0A+)',
'(%0D+)',
'(%08+)',
'(%09+)'
);
$inject = join('|', $injections);
$inject = "/$inject/i";
if(preg_match($inject,$str))
{
return true;
}
else
{
return false;
}
}
?>
Register
Contact
' ; } ?>
Welcome to
Please enter your details:
".nl2br($errors)."";
}
?>
";
}else if ($parentID=='99035b4a') {
echo "
";
} else if ($parentID=='da261e98') {
echo "
";
}
?>