Files
Facilitor/APPL/Shared/loadBtwTabel.asp
Jos Groot Lipman 92e0fa1b3c FSN#37620 FALSE-positive SQL-injection en XSS duidelijker maken
svn path=/Website/trunk/; revision=30557
2016-09-05 15:05:58 +00:00

78 lines
2.1 KiB
Plaintext

<%@language = "javascript" %>
<% /*
$Revision$
$Id$
*/ %>
<%
DOCTYPE_Disable = true;
%>
<!-- #include file="../Shared/common.inc" -->
<!-- #include file="../Shared/selector.inc" -->
<%
// Build a group list
var fieldname = getFParam("fieldname", null);
var selectfield = getFParam("sel_key", "key");
var btw_key = getFParamInt("btw_key", null);
var label = getFParam("label", null);
var extraclass = getFParam("extraclass", null);
var bedrijf_key = getFParamInt("bedrijf_key", -1);
var selectjustone = getFParam("selectjustone", true);
var emptyOption = getFParam("emptyOption", null);
var onChange = getFParam("onChange", null);
var required = getFParam("required", false);
var btwtabel_key = -1;
var sql = "SELECT b.fin_btwtabel_key"
+ " FROM prs_bedrijf b"
+ " WHERE b.prs_bedrijf_key = " + bedrijf_key;
var oRs = Oracle.Execute(sql);
if (!oRs.eof)
btwtabel_key = oRs("fin_btwtabel_key").Value || -1;
oRs.Close();
if (btwtabel_key == -1)
{
sql = "SELECT fin_btwtabel_key"
+ " FROM fin_btwtabel "
+ " WHERE fin_btwtabel_verwijder IS NULL"
+ " AND fin_btwtabel_default = 1"
oRs = Oracle.Execute(sql);
if (!oRs.eof)
btwtabel_key = oRs("fin_btwtabel_key").Value || -1;
oRs.Close();
}
var sql = "SELECT " + (selectfield == "key"? "fin_btwtabelwaarde_key" : "fin_btwtabelwaarde_perc")
+ " , fin_btwtabelwaarde_oms"
+ " FROM fin_btwtabelwaarde"
+ " WHERE fin_btwtabel_key = " + btwtabel_key
+ " AND fin_btwtabelwaarde_verwijder IS NULL"
+ " ORDER BY fin_btwtabelwaarde_perc";
var params = { required: required,
selectjustone: selectjustone
}
if (btw_key != null)
params.initKey = btw_key;
if (label != null)
params.label = label;
if (emptyOption != null)
params.emptyOption = emptyOption;
if (extraclass != null)
params.extraclass = extraclass;
if (onChange != null)
params.onChange = onChange;
if (fieldname)
FCLTselector(fieldname,
sql,
params);
else
FCLTselectorOptions(sql,
params);
%>