<?php
	include("../../include/session.php");
	include("../../include/db.php");
	if(!$session->isRadstoneStoreUser() && !$session->isAdmin() && !$session->isRadstoneReceptionUser()){
		header("Location: ../storeMenu.php");
	}else{
			
		$productId = mysql_real_escape_string($_GET['productId']);
		if ($productId == "") { 
		        $productId = mysql_real_escape_string($_GET['productId_2']);
		     }
		$empId = mysql_real_escape_string($_GET['empId2']);
		//$orderNo = mysql_real_escape_string($_POST['order']);
		$quantity = mysql_real_escape_string($_GET['quantity']);
		//$price = mysql_real_escape_string($_POST['price']);
		//$delNote = mysql_real_escape_string($_POST['delNote']);
		$comments = mysql_real_escape_string($_GET['comments']);
		$status = mysql_real_escape_string($_GET['statusradiobutton']);
		$return = mysql_real_escape_string($_GET['submitok']);
		$date = isset($_REQUEST["date1"]) ? $_REQUEST["date1"] : "";
		
		//echo "status: ".$status;
		if ($status==0) {
		  $textLine = 'assigned to: ';
		  }
		 else {
		  $textLine = 'given to: ';
		  } 
		  
		$q2 = "SELECT quantity, price FROM nam_products WHERE productId = '$productId'";
		$result2 = execsql($q2);
		$totalQuantity = mysql_result($result2, 0, "quantity") - $quantity;
		$price = mysql_result($result2, 0, "price");
		$q="";
		$q1 = "UPDATE nam_products SET quantity = quantity - '$quantity' WHERE productId = '$productId'";
		$q3 = "";
		   // echo "<br> empID: ".$empId;
			$nameQuery = "SELECT empFName, empLName FROM nam_employees WHERE empId = '$empId'";
			$nameResult = execsql($nameQuery);
			$name = mysql_result($nameResult, 0, "empFName") . " " . mysql_result($nameResult, 0, "empLName");
			//echo "<br>".$nameQuery;
			$q = "INSERT INTO nam_loan (productId, empId, quantity, comments, date, returned, price) VALUES ('".$productId."', '".$empId."', '".$quantity."', '$comments','".$date."','".$status."','".$price."')";
			$q3 = "INSERT INTO nam_itemhistory (productId, details, quantity, total, date) VALUES ('".$productId."','".$textLine." <a href=\"../HR/searchAndDisplayE.php?id=".$empId."\">".$name."</a>','".$quantity."', '".$totalQuantity."','".$date."')";
		
		
echo "<br>query: ". $q;				
echo "<br>query: ". $q3;

	$result = execsql($q);
	$resultQ = execsql($q1);
	$resultH = execsql($q3);
	//echo "<br>it came this far!";
	//echo "return= ".$return;
	//if ($result && $resultQ && $resultH) {
		if ($return == "Save and New") {
			$cat = mysql_real_escape_string($_GET['cat']);
			header("Location: ../give.php?cat=Store Item");
			
		} else {
						header("Location: ../outgoingDisplay.php?productId=$productId&date1=$date&date2=$date&empId=0");
		} 
	
}
	
?>
