<?php
include ("../../include/session.php");
include ("../../include/db.php");
if(!$session->isRadstoneReceptionUser() && !$session->isAdmin()){
	header("Location: ../../storeMenu.php");
} else {

	$productId = mysql_real_escape_string($_POST['productId']);
	//		$empId = mysql_real_escape_string($_POST['empId']);
	$orderNo = mysql_real_escape_string($_POST['order']);
	$client = mysql_real_escape_string($_POST['client']);
	$quantity = mysql_real_escape_string($_POST['quantity']);
	$price = mysql_real_escape_string($_POST['price']);
	$comments = mysql_real_escape_string($_POST['comments']);
	$delNote = mysql_real_escape_string($_POST['delNote']);
	$date = isset ($_REQUEST["date1"]) ? $_REQUEST["date1"] : "";
	$q2 = "SELECT quantity FROM products WHERE productId = '$productId'";
	$result2 = execsql($q2);
	$totalQuantity = mysql_result($result2, 0, "quantity") - $quantity;
	$q = "";
	$q1 = "UPDATE products SET reserved = reserved + $quantity WHERE productId = '$productId'";
	$q3 = "";

	$q = "INSERT INTO orders (productId, client, orderNo, quantity, price, comments, date, value, reserved) VALUES ('" . $productId . "', '$client','" . $orderNo . "','" . $quantity . "','" . $price . "', '$comments', '" . $date . "', '$client', '$quantity')";
//	$q3 = "INSERT INTO itemhistory (productId, details, quantity, total, date) VALUES ('" . $productId . "', 'Ordered: <a href=\"../Store/displayDelNote.php?delNote=$delNote\">" . $orderNo . "</a>" . "','" . $quantity . "','" . $totalQuantity . "','" . $date . "')";
	$return = mysql_real_escape_string($_POST['submitok']);
	
//	echo $q1;

	$result = execsql($q);
	$resultQ = execsql($q1);
//	$resultH = execsql($q3);
	if ($result && $resultQ) {
		if ($return == "Save and New") {
			$cat = mysql_real_escape_string($_POST['cat']);
//			header("Location: ../storeMenu.php");
			header("Location: ../makeOrders.php?cat=$cat&date=$date&orderNo=$orderNo&client=$client");
		} else {
						header("Location: ../orderByDates.php?orderNo=$orderNo");
		}
	}
}
?>
