<?
//---------------------------------------------------------------------------------
// Unit to insert/update data in a MYSQL database from the Nozicle client
//
// (c)2003 Nozicle Ltd
//
// Change Log:
// 20/04/2003 JR Initial Implementation
// 08/10/2003 JR Remove Decryption temporarily as times out when uploading large blobs
//
//---------------------------------------------------------------------------------

include('user_vars.inc');
include('funcs.php');

// open the database
$db = mysql_connect($db_host,$db_login,$db_password);
if (mysql_error() != ''):
  exit(mysql_error());
endif;

mysql_select_db($db_name, $db);
if (mysql_error() != ''):
  exit(mysql_error());
endif;

// initialise variables
$outstring = '';

//read the post variables sent from the client
$user_login = $_POST['user_login'];
$user_password = get_password($db, $user_login);

if (validate_user($db, $user_login, $user_password) < 1):
  mysql_close($db);
  exit('01Unknown user and/or password...');
endif;

$full_key = $secret_key.$user_password;

// read the sql statement from the uploaded file
$tmp_file = $_FILES['sql_file']['tmp_name'];

$zd = gzopen($tmp_file, "rb");
$encrypted_sql_statement = gzread($zd, 9999999);
gzclose ($zd);

$sql_statement = DecryptString($encrypted_sql_statement, $full_key);

// only allow insert and update
$select_str = strtolower(substr($sql_statement, 0, 6)); // returns "update" or "insert"
if (($select_str != 'update') && ($select_str != 'insert')):
  exit('Only update/insert statements permitted...['.$select_str.']');
endif;

// run the SQL
$sql_result = mysql_query($sql_statement, $db);

if (mysql_error() != ''):
  exit(mysql_error());
endif;

// get the data parameters
$num_rows = mysql_affected_rows($db);

$outstring = 'ok';

// close database
mysql_close($db);

// send message to the client
Header("Content-Length: " . strlen($outstring));
echo $outstring;

?>