and Parent is now $parentID"; // $RID=htmlentities($_REQUEST['ID']); if(isset($_REQUEST['package']) ){ $package=htmlentities($_REQUEST['package']); $regEx='/[^[:digit:]]/'; $numSites=preg_replace($regEx,'',$package); } if(isset($_REQUEST['OUID']) ){ //Client is returning from Confirm page $OLDUUID=htmlentities($_REQUEST['OUID']); //The referral ID from the signupConfirm page (correcting details). //Get the data they entered try { $sql_select_old="SELECT firstName, lastName, companyLegalName, tradingName, businessNumber, BPhone, BEmail, address1, address2, suburb, state, postCode, DEmail, welcomeMessage, numSites, parentID FROM customers WHERE UID = ?"; $sql_check_old = $pdo->prepare($sql_select_old); $sql_check_old->execute([$OLDUUID]); $result_old = $sql_check_old->fetch(PDO::FETCH_ASSOC); // print_r($result_old); } //End Try check site code catch (PDOException $ex) { echo "
" . $ex->getMessage(); } //close catch exception from try $firstName = $result_old["firstName"]; $lastName = $result_old["lastName"]; $companyLegalName = $result_old["companyLegalName"]; $tradingName = $result_old["tradingName"]; $businessNumber = $result_old["businessNumber"]; $BPhone = $result_old["BPhone"]; $BEmail = $result_old["BEmail"]; $address1 = $result_old["address1"]; $address2 = $result_old["address2"]; $suburb = $result_old["suburb"]; $state = $result_old["state"]; $postCode = $result_old["postCode"]; $DEmail = $result_old["DEmail"]; $welcomeMessage = $result_old["welcomeMessage"]; $numSites = $result_old["numSites"]; $parentID = $result_old["parentID"]; // Eliminate record try { $sql_update = 'call removeUUID(?)'; $stmt_update = $pdo->prepare($sql_update); $stmt_update->execute([$OLDUUID]); } catch (PDOException $ex) { echo "
" . $ex->getMessage(); } //close catch exception from try } // // No ID sent through or ID=blank sent through // if(!isset($_REQUEST['ID']) || empty($RID) ){ // echo "

No code provided. Redirecting...

"; // header( "refresh:2;url=https://$host/noSite.php"); // exit(); // } if(isset($_POST['submit'])) { // print_r($_POST); $firstName = htmlentities($_POST['firstName']); $lastName = htmlentities($_POST['lastName']); $companyLegalName = htmlentities($_POST['companyLegalName']); $tradingName = htmlentities($_POST['tradingName']); $businessNumber = htmlentities($_POST['businessNumber']); $BPhone = htmlentities($_POST['BPhone']); $BEmail = htmlentities($_POST['BEmail']); $address1 = htmlentities($_POST['address1']); $address2 = htmlentities($_POST['address2']); $suburb = htmlentities($_POST['suburb']); $state = htmlentities($_POST['state']); $postCode = htmlentities($_POST['postCode']); $DEmail = htmlentities($_POST['DEmail']); $location1 = htmlentities($_POST['companyLegalName']); $location2 = htmlentities($_POST['tradingName']); $numSites = htmlentities($_POST['numSites']); $welcomeMessage = htmlentities($_POST['welcomeMessage']); //This needs to be added below. Restrict # characters. $UID = htmlentities($_POST['UID']); $parentID = $_POST['parentID']; echo("\nPosting parent ID $parentID\n"); ///------------Do Validations------------- if(empty($companyLegalName) || empty($BEmail)) { $errors .= "\n Legal Business Name, Business Number (e.g businessNumber/GST Reg#) and Business email are required fields. "; } if(IsInjected($BEmail)) { $errors .= "\n Bad Business email value!"; } if(IsInjected($DEmail)) { $errors .= "\n Bad Delivery email value!"; } if(empty($errors)) { //Update customers table try { $cust_sql_insert = 'INSERT INTO customers ( firstName, lastName, companyLegalName, tradingName, businessNumber, BPhone, BEmail, address1, address2, suburb, state, postCode, DEmail, welcomeMessage, UID, numSites, regDateYYMM, parentID ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)'; $cust_stmt_insert = $pdo->prepare($cust_sql_insert); $cust_stmt_insert->execute( [ $firstName, $lastName, $companyLegalName, $tradingName, trim($businessNumber), $BPhone, $BEmail, $address1, $address2, $suburb, $state, $postCode, $DEmail, $welcomeMessage, $UID, $numSites, $regYYMM, $parentID ]); } catch (PDOException $cust_ex) { echo "
" . $cust_ex->getMessage(); } //close catch exception from try //Tidy up the inserted data (remove null rows) try { $sql_storedProcedure = 'call updateCustomerCreationData()'; $stmt_storedProcedure = $pdo->prepare($sql_storedProcedure); $stmt_storedProcedure->execute(); } catch (PDOException $storedProcedure_ex) { echo "
" . $storedProcedure_ex->getMessage(); } //close catch exception from try //Close trigger stored procedure // //send the email // $to = $your_email; // $subject="New form submission"; // $from = $your_email; // $ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : ''; // $body = "A user $name submitted the contact form:\n". // "Name: $name\n". // "Email: $visitor_email \n". // "Phone: \n ". // "$visitor_phone\n". // "IP: $ip\n"; // $headers = "From: $from \r\n"; // $headers .= "Reply-To: $visitor_email \r\n"; // mail($to, $subject, $body,$headers); // header("Location: complete.php); } //Close post to customers.customers table header("Location: $host/signupConfirm4.php?UID=$UID"); } //Close ISSET check for POST to SELF // Function to validate against any email injection attempts function IsInjected($str) { $injections = array('(\n+)', '(\r+)', '(\t+)', '(%0A+)', '(%0D+)', '(%08+)', '(%09+)' ); $inject = join('|', $injections); $inject = "/$inject/i"; if(preg_match($inject,$str)) { return true; } //Close return true IsInjected test else { return false; } //Close return false IsInjected test } //Close IsInjected test print_r($errors); //Debug ?>

How to complete:

Fields marked with * are mandatory

Trading name will be used in preference to your legal name on the customer sign-in form. If left blank, legal business name will be used.

Delivery email address can be used as an alternative to receive the daily update file containing your visitor records.

You will be able to enter up to 20 locations on the confirmation page.

Large and Enterprise customers will be sent an Excel/CSV file to complete and return to our Support team.

You can enter a custom welcome message. Visitors will be greeted by '<Trading Name> <welcome message>'

e.g 'Acme welcomes you', or

HR: All visitors must sign-in

All currency amounts are in Australian Dollars, and do not include GST unless stated.

Complete the detials below and confirm the number of sites you need.

Best package will be selected based on the number of requested Sites.

You can confirm the details in the next screen.

"); } else { echo("

Number of Sites: *

"); echo("
"); } ?>

Vistors will see:

<Trading Name><salutation><Site> e.g

Acme welcomes you to Building 42

By clicking NEXT, I agree that data collected via this service will only be used in accordance with privacy principles.