RenameTableSQL($oldtable, $newtable);
return $result[0];
}
/*
* Gets the maximum question_order field value for a group
* @gid: The id of the group
*/
function get_max_question_order($gid)
{
global $connect ;
global $dbprefix ;
$query="SELECT MAX(question_order) as maxorder FROM {$dbprefix}questions where gid=".$gid ;
// echo $query;
$result = db_execute_assoc($query);
$gv = $result->FetchRow();
return $gv['maxorder'];
}
$databaseoutput ='';
if(isset($surveyid))
{
$actsurquery = "SELECT define_questions, edit_survey_property, delete_survey FROM {$dbprefix}surveys_rights WHERE sid=$surveyid AND uid = ".$_SESSION['loginID']; //Getting rights for this survey
$actsurresult = db_execute_assoc($actsurquery);
$actsurrows = $actsurresult->FetchRow();
if ($action == "delattribute" && ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1 || $actsurrows['define_questions']))
{
$query = "DELETE FROM ".db_table_name('question_attributes')."
WHERE qaid={$postqaid} AND qid={$postqid}";
$result=$connect->Execute($query) or safe_die("Couldn't delete attribute
".$query."
".$connect->ErrorMsg());
}
elseif ($action == "addattribute" && ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1 || $actsurrows['define_questions']))
{
if (isset($_POST['attribute_value']) && $_POST['attribute_value'])
{
if ($_POST['attribute_name']=='dropdown_separators' || $_POST['attribute_name']=='dualscale_headerA' || $_POST['attribute_name']=='dualscale_headerB' ||
$_POST['attribute_name']=='dropdown_prepostfix' || $_POST['attribute_name']=='prefix' || $_POST['attribute_name']=='suffix')
{
if ($filterxsshtml)
{
require_once("../classes/inputfilter/class.inputfilter_clean.php");
$myFilter = new InputFilter('','',1,1,1);
$_POST['attribute_value']=$myFilter->process($_POST['attribute_value']);
}
else
{
$_POST['attribute_value'] = html_entity_decode_php4($_POST['attribute_value'], ENT_QUOTES, "UTF-8");
}
}
$_POST = array_map('db_quote', $_POST);
$query = "INSERT INTO ".db_table_name('question_attributes')."
(qid, attribute, value)
VALUES ('{$postqid}', '{$_POST['attribute_name']}', '{$_POST['attribute_value']}')";
$result = $connect->Execute($query) or safe_die("Error
".$query."
".$connect->ErrorMsg());
}
}
elseif ($action == "editattribute" && ( $_SESSION['USER_RIGHT_SUPERADMIN'] == 1 || $actsurrows['define_questions']))
{
if (isset($_POST['attribute_value']) && $_POST['attribute_value'])
{
$query = "UPDATE ".db_table_name('question_attributes')."
SET value='{$_POST['attribute_value']}' WHERE qaid=".$postqaid." AND qid=".returnglobal('qid');
$result = $connect->Execute($query) or safe_die("Error
".$query."
".$connect->ErrorMsg());
}
}
elseif ($action == "insertnewgroup" && ( $_SESSION['USER_RIGHT_SUPERADMIN'] == 1 || $actsurrows['define_questions']))
{
$grplangs = GetAdditionalLanguagesFromSurveyID($postsid);
$baselang = GetBaseLanguageFromSurveyID($postsid);
$grplangs[] = $baselang;
$errorstring = '';
foreach ($grplangs as $grouplang)
{
if (!$_POST['group_name_'.$grouplang]) { $errorstring.= GetLanguageNameFromCode($grouplang,false)."\\n";}
}
if ($errorstring!='')
{
$databaseoutput .= "\n";
}
else
{
$first=true;
require_once("../classes/inputfilter/class.inputfilter_clean.php");
$myFilter = new InputFilter('','',1,1,1);
foreach ($grplangs as $grouplang)
{
//Clean XSS
if ($filterxsshtml)
{
$_POST['group_name_'.$grouplang]=$myFilter->process($_POST['group_name_'.$grouplang]);
$_POST['description_'.$grouplang]=$myFilter->process($_POST['description_'.$grouplang]);
}
else
{
$_POST['group_name_'.$grouplang] = html_entity_decode_php4($_POST['group_name_'.$grouplang], ENT_QUOTES, "UTF-8");
$_POST['description_'.$grouplang] = html_entity_decode_php4($_POST['description_'.$grouplang], ENT_QUOTES, "UTF-8");
}
// Fix bug with FCKEditor saving strange BR types
$_POST['group_name_'.$grouplang]=str_replace('
','',$_POST['group_name_'.$grouplang]);
$_POST['description_'.$grouplang]=str_replace('
','',$_POST['description_'.$grouplang]);
if ($_POST['group_name_'.$grouplang] == "
")
{
$_POST['group_name_'.$grouplang] = '';
}
if ($_POST['description_'.$grouplang] == "
")
{
$_POST['description_'.$grouplang] = '';
}
//$_POST = array_map('db_quote', $_POST);
if ($first)
{
$query = "INSERT INTO ".db_table_name('groups')." (sid, group_name, description,group_order,language) VALUES ('".db_quote($postsid)."', '".db_quote($_POST['group_name_'.$grouplang])."', '".db_quote($_POST['description_'.$grouplang])."',".getMaxgrouporder(returnglobal('sid')).",'{$grouplang}')";
$result = $connect->Execute($query);
$groupid=$connect->Insert_Id(db_table_name_nq('groups'),"gid");
$first=false;
}
else{
$query = "INSERT INTO ".db_table_name('groups')." (gid, sid, group_name, description,group_order,language) VALUES ('{$groupid}','{$postsid}', '{$_POST['group_name_'.$grouplang]}', '{$_POST['description_'.$grouplang]}',".getMaxgrouporder(returnglobal('sid')).",'{$grouplang}')";
if ($connect->databaseType == 'odbc_mssql') $query = "SET IDENTITY_INSERT ".db_table_name('groups')." ON; " . $query . "SET IDENTITY_INSERT ".db_table_name('groups')." OFF;";
$result = $connect->Execute($query) or safe_die("Error
".$query."
".$connect->ErrorMsg());
}
if (!$result)
{
$databaseoutput .= $clang->gT("Error: The database reported the following error:")."
\n";
$databaseoutput .= "" . htmlspecialchars($connect->ErrorMsg()) . "\n";
$databaseoutput .= "".htmlspecialchars($query)."
\n";
$databaseoutput .= " \n