ErrorMsg()); $actsurrows = $actsurresult->FetchRow(); if ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1 || $actsurrows['browse_response']) { $surveyoptions = browsemenubar($clang->gT("Browse Responses")); if (!$surveyid && !$subaction) { //$dataentryoutput .= "\n"; $dataentryoutput .= "
| " .$clang->gT("Data Entry")." | |
| \n"
."".$clang->gT("Error")." \n" .$clang->gT("You have not selected a survey for data-entry.")." \n" ." \n" ." | |
| " .$clang->gT("Data Entry")." | |
| \n";
$lastanswfortoken=''; // check if a previous answer has been submitted or saved
$rlanguage='';
if (isset($_POST['token']) && $_POST['token'])
{
$tokencompleted = "";
$tokentable = db_table_name("tokens_".$surveyid);
$tcquery = "SELECT completed from $tokentable WHERE token='".$_POST['token']."'";
$tcresult = db_execute_assoc($tcquery);
$tccount = $tcresult->RecordCount();
while ($tcrow = $tcresult->FetchRow())
{
$tokencompleted = $tcrow['completed'];
}
if ($tccount < 1)
{ // token doesn't exist in token table
$lastanswfortoken='UnknownToken';
}
elseif ($thissurvey['private'] == "Y")
{ // token exist but survey is anonymous, check completed state
if ($tokencompleted != "" && $tokencompleted != "N")
{ // token is not completed
$lastanswfortoken='PrivacyProtected';
}
}
else
{ // token is valid, survey not anonymous, try to get last recorded response id
$aquery = "SELECT id,startlanguage FROM $surveytable WHERE token='".$_POST['token']."'";
$aresult = db_execute_assoc($aquery);
while ($arow = $aresult->FetchRow())
{
$lastanswfortoken=$arow['id'];
$rlanguage=$arow['startlanguage'];
}
}
}
if (tokenTableExists($thissurvey['sid']) && (!isset($_POST['token']) || !$_POST['token']))
{// First Check if the survey uses tokens and if a token has been provided
$errormsg="".$clang->gT("Error").": ".$clang->gT("This is a closed-access survey, so you must supply a valid token. Please contact the administrator for assistance.")."\n";
}
elseif (tokenTableExists($thissurvey['sid']) && $lastanswfortoken == 'UnknownToken')
{
$errormsg="".$clang->gT("Error").": ".$clang->gT("The token you have provided is not valid or has already been used.")."\n";
}
elseif (tokenTableExists($thissurvey['sid']) && $lastanswfortoken != '')
{
$errormsg="".$clang->gT("Error").": ".$clang->gT("There is already a recorded answer for this token")."\n";
if ($lastanswfortoken != 'PrivacyProtected')
{
$errormsg .= " ".$clang->gT("Follow the following link to update it").":\n" . "gT("Edit this entry", "js")."')\">[id:$lastanswfortoken]"; } else { $errormsg .= " ".$clang->gT("This surveys uses anonymous answers, so you can't update your response.")."\n"; } } else { if (isset($_POST['save']) && $_POST['save'] == "on") { $saver['identifier']=returnglobal('save_identifier'); $saver['language']=returnglobal('save_language'); $saver['password']=returnglobal('save_password'); $saver['passwordconfirm']=returnglobal('save_confirmpassword'); $saver['email']=returnglobal('save_email'); if (!returnglobal('redo')) { $password=md5($saver['password']); } else { $password=$saver['password']; } $errormsg=""; if (!$saver['identifier']) {$errormsg .= $clang->gT("Error").": ".$clang->gT("You must supply a name for this saved session.");} if (!$saver['password']) {$errormsg .= $clang->gT("Error").": ".$clang->gT("You must supply a password for this saved session.");} if ($saver['password'] != $saver['passwordconfirm']) {$errormsg .= $clang->gT("Error").": ".$clang->gT("Your passwords do not match.");} if ($errormsg) { $dataentryoutput .= $errormsg; $dataentryoutput .= $clang->gT("Try again").": \n"; } elseif (returnglobal('redo')=="yes") { //Delete all the existing entries TODO WTF IS REDO? //$delete="DELETE FROM ".db_table_name("saved")." WHERE scid=".$saver['scid']; //$result=$connect->Execute($delete) or safe_die("Couldn't delete old record $delete ".htmlspecialchars($connect->ErrorMsg())); //$delete="DELETE FROM ".db_table_name("saved_control")." WHERE scid=".$surveytable['scid']; //$result=$connect->Execute($delete) or safe_die("Couldn't delete old record $delete ".htmlspecialchars($connect->ErrorMsg())); } } //BUILD THE SQL TO INSERT RESPONSES $baselang = GetBaseLanguageFromSurveyID($surveyid); $iquery = "SELECT * FROM ".db_table_name("questions").", ".db_table_name("groups")." WHERE ".db_table_name("questions").".gid=".db_table_name("groups").".gid AND ".db_table_name("questions").".language = '{$baselang}' AND ".db_table_name("groups").".language = '{$baselang}' AND ".db_table_name("questions").".sid=$surveyid ORDER BY ".db_table_name("groups").".group_order, title"; $iresult = db_execute_assoc($iquery); $col_name=""; $insertqr=""; while ($irow = $iresult->FetchRow()) { if ($irow['type'] != "M" && $irow['type'] != "A" && $irow['type'] != "B" && $irow['type'] != "C" && $irow['type'] != "E" && $irow['type'] != "F" && $irow['type'] != "H" && $irow['type'] != "P" && $irow['type'] != "O" && $irow['type'] != "R" && $irow['type'] != "Q" && $irow['type'] != "J" && $irow['type'] != "K" && $irow['type'] != ":" && $irow['type'] != "1" && $irow['type'] != ";") { $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}"; if (isset($_POST[$fieldname])) { if ($irow['type'] == 'D' && $_POST[$fieldname] == "") { // can't add '' in Date column // Do nothing } elseif ($irow['type'] == 'N' && $_POST[$fieldname] == "") { // can't add '' to numerical column // Do nothing } else { $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname]) . "', \n"; } } // if "!" "L" "W" "Z", and Other ==> add other fieldname if ($irow['type'] == "!" || $irow['type'] == "L" || $irow['type'] == "W" || $irow['type'] == "Z") { $fieldname2=$fieldname."other"; if (isset($_POST[$fieldname2]) && isset($_POST[$fieldname]) && $_POST[$fieldname] == '-oth-' && $_POST[$fieldname2]!= "") { $col_name .= db_quote_id($fieldname2).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname2]) . "', \n"; } } } elseif ($irow['type'] == "O") { $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}"; $fieldname2 = $fieldname . "comment"; $col_name .= db_quote_id($fieldname).", \n".db_quote_id($fieldname2).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname]) . "', \n'" . auto_escape($_POST[$fieldname2]) . "', \n"; } elseif ($irow['type'] == "1") { $i2query = "SELECT ".db_table_name("answers").".*, ".db_table_name("questions").".other FROM ".db_table_name("answers").", ".db_table_name("questions")." WHERE ".db_table_name("answers").".qid=".db_table_name("questions").".qid AND ".db_table_name("questions").".qid={$irow['qid']} AND ".db_table_name("questions").".language = '{$language}' AND ".db_table_name("answers").".language = '{$language}' AND ".db_table_name("questions").".sid=$surveyid ORDER BY ".db_table_name("answers").".sortorder, ".db_table_name("answers").".answer"; $i2result = $connect->Execute($i2query); $i2count = $i2result->RecordCount(); while ($i2answ = $i2result->FetchRow()) { // first scale $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}{$i2answ['code']}#0"; $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST["$fieldname"]) . "', \n"; // second scale $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}{$i2answ['code']}#1"; $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST["$fieldname"]) . "', \n"; } } elseif ($irow['type'] == "R") { $i2query = "SELECT ".db_table_name("answers").".*, ".db_table_name("questions").".other FROM ".db_table_name("answers").", ".db_table_name("questions")." WHERE ".db_table_name("answers").".qid=".db_table_name("questions").".qid AND ".db_table_name("questions").".qid={$irow['qid']} AND ".db_table_name("questions").".language = '{$language}' AND ".db_table_name("answers").".language = '{$language}' AND ".db_table_name("questions").".sid=$surveyid ORDER BY ".db_table_name("answers").".sortorder, ".db_table_name("answers").".answer"; $i2result = $connect->Execute($i2query); $i2count = $i2result->RecordCount(); for ($i=1; $i<=$i2count; $i++) { $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}$i"; $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST["d$fieldname"]) . "', \n"; } } elseif ($irow['type'] == ":" || $irow['type'] == ";") { $i2query = "SELECT ".db_table_name("answers").".*, ".db_table_name("questions").".other FROM ".db_table_name("answers").", ".db_table_name("questions")." WHERE ".db_table_name("answers").".qid=".db_table_name("questions").".qid AND ".db_table_name("answers").".language='{$language}' AND ".db_table_name("questions").".language='{$language}' AND ".db_table_name("questions").".qid={$irow['qid']} AND ".db_table_name("questions").".sid=$surveyid ORDER BY ".db_table_name("answers").".sortorder, ".db_table_name("answers").".answer"; $i2result = db_execute_assoc($i2query); $ab2query = "SELECT ".db_table_name('labels').".* FROM ".db_table_name('questions').", ".db_table_name('labels')." WHERE sid=$surveyid AND ".db_table_name('labels').".lid=".db_table_name('questions').".lid AND ".db_table_name('questions').".language='".$language."' AND ".db_table_name('labels').".language='".$language."' AND ".db_table_name('questions').".qid=".$irow['qid']." ORDER BY ".db_table_name('labels').".sortorder, ".db_table_name('labels').".title"; $ab2result=db_execute_assoc($ab2query) or die("Couldn't get list of labels in createFieldMap function (case :) $ab2query ".htmlspecialchars($connection->ErrorMsg())); while($ab2row=$ab2result->FetchRow()) { $lset[]=$ab2row; } while ($i2row = $i2result->FetchRow()) { foreach($lset as $ls) { $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}{$i2row['code']}_{$ls['code']}"; $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname]) . "', \n"; } } unset($lset); } else { $i2query = "SELECT ".db_table_name("answers").".*, ".db_table_name("questions").".other FROM ".db_table_name("answers").", ".db_table_name("questions")." WHERE ".db_table_name("answers").".qid=".db_table_name("questions").".qid AND ".db_table_name("questions").".language = '{$language}' AND ".db_table_name("answers").".language = '{$language}' AND ".db_table_name("questions").".qid={$irow['qid']} AND ".db_table_name("questions").".sid=$surveyid ORDER BY ".db_table_name("answers").".sortorder, ".db_table_name("answers").".answer"; $i2result = db_execute_assoc($i2query); while ($i2row = $i2result->FetchRow()) { $otherexists = ""; if ($i2row['other'] == "Y" and ($irow['type']=="!" or $irow['type']=="L" or $irow['type']=="M" or $irow['type']=="P" or $irow['type'] == "W" or $irow['type'] == "Z")) {$otherexists = "Y";} $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}{$i2row['code']}"; if (isset($_POST[$fieldname])) { if ($irow['type'] == 'K' && $_POST[$fieldname] == "") { // can't add '' in a numerical column // Do nothing } else { $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname]) . "', \n"; } if ($irow['type'] == "P") { $fieldname2 = $fieldname."comment"; $col_name .= db_quote_id($fieldname2).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname2]) . "', \n"; } } } if (isset($otherexists) && $otherexists == "Y") { $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}other"; $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname]) . "', \n"; if ($irow['type']=="P") { $fieldname = "{$irow['sid']}X{$irow['gid']}X{$irow['qid']}othercomment"; $col_name .= db_quote_id($fieldname).", \n"; $insertqr .= "'" . auto_escape($_POST[$fieldname]) . "', \n"; } } } } $stripCommaColName = false; if ($col_name == "") { // if cold_name is empty, set a flag so that we delete the beginning "," $stripCommaColName = true; } $stripCommaInsertqr = false; if ($insertqr =="") { // if insertqr is empty, set a flag so that we delete the beginning "," $stripCommaInsertqr = true; } $col_name = substr($col_name, 0, -3); //Strip off the last comma-space $insertqr = substr($insertqr, 0, -3); //Strip off the last comma-space //NOW SHOW SCREEN if (tokenTableExists($thissurvey['sid']) && isset($_POST['token']) && $_POST['token'] && $thissurvey['private'] == 'N') //handle tokens if survey needs them { $col_name .= ", token\n"; $insertqr .= ", '{$_POST['token']}'"; } if (isset($_POST['datestamp']) && $_POST['datestamp']) //handle datestamp if needed { $col_name .= ", datestamp\n"; $insertqr .= ", '{$_POST['datestamp']}'"; $col_name .= ", startdate\n"; $insertqr .= ", '{$_POST['datestamp']}'"; } if (isset($_POST['ipaddr']) && $_POST['ipaddr']) //handle datestamp if needed { $col_name .= ", ipaddr\n"; $insertqr .= ", '{$_POST['ipaddr']}'"; } if (isset($_POST['language']) && $_POST['language']) // handle language { $col_name .= ", startlanguage\n"; $insertqr .= ", '{$_POST['language']}'"; } if (isset($_POST['closerecord'])) // handle Submidate if required { if ($thissurvey['private'] =="Y" && $thissurvey['datestamp'] =="N") { $col_name .= ", submitdate\n"; $insertqr .= ", '".date("Y-m-d H:i:s",mktime(0,0,0,1,1,1980))."'"; } elseif (isset($_POST['closedate']) && $_POST['closedate'] != '') { $col_name .= ", submitdate\n"; $insertqr .= ", '{$_POST['closedate']}'"; } } if ($stripCommaColName === true) { $col_name=substr($col_name, 1); } if ($stripCommaInsertqr === true) { $insertqr=substr($insertqr, 1); } // $dataentryoutput .= "\tInserting data \n" // ."SID: $surveyid, ($surveytable) \n"; $SQL = "INSERT INTO $surveytable ($col_name) VALUES ($insertqr)"; //$dataentryoutput .= $SQL; //Debugging line $iinsert = $connect->Execute($SQL) or safe_die ("Could not insert your data: $SQL \n" .$connect->ErrorMsg()); /*if (returnglobal('redo')=="yes") { //This submission of data came from a saved session. Must delete the //saved session now that it has been recorded in the responses table $dquery = "DELETE FROM ".db_table_name("saved_control")." WHERE scid=".$saver['scid']; if ($dresult=$connect->Execute($dquery)) { $dquery = "DELETE FROM ".db_table_name("saved")." WHERE scid=".$saver['scid']; $dresult=$connect->Execute($dquery) or safe_die("Couldn't delete saved data $dquery ".htmlspecialchars($connect->ErrorMsg())); } else { $dataentryoutput .= "Couldn't delete saved data $dquery ".htmlspecialchars($connect->ErrorMsg()); } }*/ if (isset($_POST['closerecord']) && isset($_POST['token']) && $_POST['token'] != '') // submittoken { $today = date_shift(date("Y-m-d H:i:s"), "Y-m-d", $timeadjust); $utquery = "UPDATE {$dbprefix}tokens_$surveyid\n"; if (bIsTokenCompletedDatestamped($thissurvey)) { $utquery .= "SET completed='$today'\n"; } else { $utquery .= "SET completed='Y'\n"; } $utquery .= "WHERE token='{$_POST['token']}'"; $utresult = $connect->Execute($utquery) or safe_die ("Couldn't update tokens table! \n$utquery \n".$connect->ErrorMsg()); } if (isset($_POST['save']) && $_POST['save'] == "on") { $srid = $connect->Insert_ID(); //CREATE ENTRY INTO "saved_control" $scdata = array("sid"=>$surveyid, "srid"=>$srid, "identifier"=>$saver['identifier'], "access_code"=>$password, "email"=>$saver['email'], "ip"=>$_SERVER['REMOTE_ADDR'], "refurl"=>getenv("HTTP_REFERER"), 'saved_thisstep' => 0, "status"=>"S", "saved_date"=>date_shift(date("Y-m-d H:i:s"), "Y-m-d H:i:s", $timeadjust)); if ($connect->AutoExecute("{$dbprefix}saved_control", $scdata,'INSERT')) { $scid = $connect->Insert_ID("{$dbprefix}saved_control","scid"); $dataentryoutput .= "".$clang->gT("Your survey responses have been saved successfully. You will be sent a confirmation e-mail. Please make sure to save your password, since we will not be able to retrieve it for you.")." \n"; $tkquery = "SELECT * FROM ".db_table_name("tokens_$surveyid"); if ($tkresult = $connect->Execute($tkquery)) //If the query fails, assume no tokens table exists { $tokendata = array ( "firstname"=> $saver['identifier'], "lastname"=> $saver['identifier'], "email"=>$saver['email'], "token"=>randomkey(15), "language"=>$saver['language'], "sent"=>date_shift(date("Y-m-d H:i:s"), "Y-m-d H:i", $timeadjust), "completed"=>"N"); $connect->AutoExecute(db_table_name("tokens_".$surveyid), $tokendata,'INSERT'); $dataentryoutput .= "".$clang->gT("A token entry for the saved survey has been created too.")." \n"; } if ($saver['email']) { //Send email if (validate_email($saver['email']) && !returnglobal('redo')) { $subject=$clang->gT("Saved Survey Details"); $message=$clang->gT("Thank you for saving your survey in progress. The following details can be used to return to this survey and continue where you left off. Please keep this e-mail for your reference - we cannot retrieve the password for you."); $message.="\n\n".$thissurvey['name']."\n\n"; $message.=$clang->gT("Name").": ".$saver['identifier']."\n"; $message.=$clang->gT("Password").": ".$saver['password']."\n\n"; $message.=$clang->gT("Reload your survey by clicking on the following link (or pasting it into your browser):").":\n"; $message.=$publicurl."/index.php?sid=$surveyid&loadall=reload&scid=".$scid."&lang=".urlencode($saver['language'])."&loadname=".urlencode($saver['identifier'])."&loadpass=".urlencode($saver['password']); if (isset($tokendata['token'])) {$message.="&token=".$tokendata['token'];} $from = $thissurvey['adminemail']; if (MailTextMessage($message, $subject, $saver['email'], $from, $sitename, false, getBounceEmail($surveyid))) { $emailsent="Y"; $dataentryoutput .= "".$clang->gT("An email has been sent with details about your saved survey")." \n"; } } } } else { safe_die("Unable to insert record into saved_control table. ".$connect->ErrorMsg()); } } $dataentryoutput .= "\t".$clang->gT("Success")." \n"; $thisid=$connect->Insert_ID(); $dataentryoutput .= "\t".$clang->gT("The entry was assigned the following record id: ")." {$thisid} \n"; } $dataentryoutput .= $errormsg; $dataentryoutput .= "\t [".$clang->gT("Add Another Record")."] \n"; $dataentryoutput .= "[".$clang->gT("Return to Survey Administration")."] \n"; if (isset($thisid)) { $dataentryoutput .= "\t[".$clang->gT("View This Record")."] \n"; } if (isset($_POST['save']) && $_POST['save'] == "on") { $dataentryoutput .= "\t[".$clang->gT("Browse Saved Responses")."] \n"; } $dataentryoutput .= "\t[".$clang->gT("Browse Responses")."] \n" ."\t | |