<?php
// check the input 管理对药品信息的增删
function check($value)
{
    if (get_magic_quotes_gpc()) {
        $value = htmlspecialchars(trim($value));
    } else {
        $value = addslashes(htmlspecialchars(trim($value)));
    }
    return $value;
}

session_start();

if (!isset($_SESSION['username']) or !isset($_SESSION['identity']) or $_SESSION['identity'] != 2) {
    header("Location:login.php");
    exit();
}

$Drugno = check($_POST['DrugNo']);

$Drugname = check($_POST['DrugName']);

$operation = $_POST['operation_choice'];

if ($operation == 1) {  // insert
    if ($Drugno == "" || $Drugname == "") {
        echo "
            <script>
                alert('药品信息不能为空！！');
                window.location.href = 'admin_drug.php';
            </script>
	    ";
        exit();
    } else {
        $db = @mysqli_connect("localhost", "root", "123456", "MIS");
        if (!$db) {
            die("Fail to connect the database!!" . mysqli_connect_error());
        }
        mysqli_query($db, "begin");
        mysqli_query($db, "set names utf8");

        $check_Drugno = mysqli_query($db, "SELECT * FROM Drug WHERE DrugNo='$Drugno' for update");
        if (mysqli_fetch_array($check_Drugno)) { //fetch_array
            mysqli_query($db, "commit");
			mysqli_close($db);
            echo "
                <script>
                    alert('药品号已存在！！');
                    window.location.href = 'admin_drug.php';
                </script>
            ";
            exit();
        } else {
           
            //else {
            //     $name = mysqli_fetch_array($check_username)['Dname'];
            // }
            $result = mysqli_query($db, "INSERT INTO Drug(DrugNo, DrugName) VALUES ('$Drugno', '$Drugname')");
            if ($result) {
                mysqli_query($db, "commit");
                mysqli_close($db);
                echo "
                    <script>
                        alert('添加药品成功!!');
                        window.location.href = 'admin_drug.php';
                    </script>
                ";
                exit();
            } else {
                echo '添加失败!!', mysqli_error($db), '<br />';
                echo 'Click here to <a href="javascript:history.back(-1);">go back</a> and retry..';
                mysqli_query($db, "rollback");
                mysqli_close($db);
                exit();
            }
        }
    }
} elseif ($operation == -1) {   // delete
    if ($Drugno == "") {
        echo "
            <script>
                alert('药品号不能为空!!');
                window.location.href = 'admin_drug.php';
            </script>
	    ";
        exit();
    } else {
        $db = @mysqli_connect("localhost", "root", "123456", "MIS");
        if (!$db) {
            die("Fail to connect the database!!" . mysqli_connect_error());
        }
        mysqli_query($db, "begin");
        mysqli_query($db, "set names utf8");

        $check_Drugno = mysqli_query($db, "SELECT * FROM Drug WHERE DrugNo='$Drugno' for update");
        if (mysqli_fetch_array($check_Drugno)) {
            $result = mysqli_query($db, "DELETE FROM Drug WHERE DrugNo='$Drugno'");
            if ($result) {
                mysqli_query($db, "commit");
                mysqli_close($db);
                echo "
                    <script>
                        alert('删除药品成功!!');
                        window.location.href = 'admin_drug.php';
                    </script>
                ";
                exit();
            } else {
                echo '删除失败！！', mysqli_error($db), '<br />';
                echo 'Click here to <a href="javascript:history.back(-1);">go back</a> and retry..';
                mysqli_query($db, "rollback");
                mysqli_close($db);
                exit();
            }
        } else {
            mysqli_query($db, "commit");
			mysqli_close($db);
            echo "
                <script>
                    alert('药品号不存在！！');
                    window.location.href = 'admin_drug.php';
                </script>
            ";
            exit();
        }
    }
}
?>