function objectInfo($object_array)
 {
     reset($object_array);
     while (list($key, $value) = each($object_array)) {
         $this->{$key} = xtc_db_prepare_input($value);
     }
 }

function xtc_db_prepare_input($string)
{
    if (is_string($string)) {
        return trim(stripslashes($string));
    } elseif (is_array($string)) {
        reset($string);
        while (list($key, $value) = each($string)) {
            $string[$key] = xtc_db_prepare_input($value);
        }
        return $string;
    } else {
        return $string;
    }
}

function xtc_get_categories($categories_array = '', $parent_id = '0', $indent = '')
{
    $parent_id = xtc_db_prepare_input($parent_id);
    if (!is_array($categories_array)) {
        $categories_array = array();
    }
    $categories_query = "select\n                                      c.categories_id,\n                                      cd.categories_name\n                                      from " . TABLE_CATEGORIES . " c,\n                                       " . TABLE_CATEGORIES_DESCRIPTION . " cd\n                                       where parent_id = '" . xtc_db_input((int) $parent_id) . "'\n                                       and c.categories_id = cd.categories_id\n                                       and c.categories_status != 0\n                                       and cd.language_id = '" . xtc_db_input((int) $_SESSION['languages_id']) . "'\n                                       order by sort_order, cd.categories_name";
    $categories_query = xtDBquery($categories_query);
    while ($categories = xtc_db_fetch_array($categories_query, true)) {
        $categories_array[] = array('id' => $categories['categories_id'], 'text' => $indent . $categories['categories_name']);
        if ($categories['categories_id'] != $parent_id) {
            $categories_array = xtc_get_categories($categories_array, $categories['categories_id'], $indent . '  ');
        }
    }
    return $categories_array;
}

function xtc_update_whos_online()
{
    $crawler = 0;
    if (isset($_SESSION['customer_id'])) {
        $wo_customer_id = (int) $_SESSION['customer_id'];
        $customer_query = xtc_db_query("select\n                                      customers_firstname,\n                                      customers_lastname\n                                      from " . TABLE_CUSTOMERS . "\n                                      where customers_id = '" . $wo_customer_id . "'");
        $customer = xtc_db_fetch_array($customer_query);
        $wo_full_name = xtc_db_prepare_input($customer['customers_firstname'] . ' ' . $customer['customers_lastname']);
    } else {
        $wo_customer_id = '';
        $crawler = xtc_check_agent();
        if ($crawler !== 0) {
            $wo_full_name = '[' . TEXT_SEARCH_ENGINE_AGENT . ']';
        } else {
            $wo_full_name = TEXT_GUEST;
        }
    }
    if ($crawler !== 0) {
        $wo_session_id = '';
    } else {
        $wo_session_id = xtc_session_id();
    }
    $wo_ip_address = xtc_db_prepare_input($_SESSION['tracking']['ip']);
    $wo_last_page_url = xtc_db_prepare_input(strip_tags($_SERVER['REQUEST_URI']));
    $wo_referer = xtc_db_prepare_input(isset($_SERVER['HTTP_REFERER']) ? strip_tags($_SERVER['HTTP_REFERER']) : '---');
    $current_time = time();
    $time_last_click = 900;
    if (defined('WHOS_ONLINE_TIME_LAST_CLICK')) {
        $time_last_click = (int) WHOS_ONLINE_TIME_LAST_CLICK;
    }
    $xx_mins_ago = time() - $time_last_click;
    // remove entries that have expired
    xtc_db_query("delete from " . TABLE_WHOS_ONLINE . " where time_last_click < '" . $xx_mins_ago . "'");
    $stored_customer_query = xtc_db_query("select count(*) as count from " . TABLE_WHOS_ONLINE . " where session_id = '" . $wo_session_id . "'");
    $stored_customer = xtc_db_fetch_array($stored_customer_query);
    $sql_data_array = array('customer_id' => $wo_customer_id, 'full_name' => xtc_db_prepare_input($wo_full_name), 'ip_address' => $wo_ip_address, 'time_last_click' => $current_time, 'last_page_url' => $wo_last_page_url);
    if ($stored_customer['count'] > 0) {
        xtc_db_perform(TABLE_WHOS_ONLINE, $sql_data_array, 'update', "session_id = '" . $wo_session_id . "'");
    } else {
        $sql_data_array['time_entry'] = $current_time;
        $sql_data_array['session_id'] = $wo_session_id;
        $sql_data_array['http_referer'] = $wo_referer;
        xtc_db_perform(TABLE_WHOS_ONLINE, $sql_data_array);
    }
}

 function xtc_cfg_save_max_display_results($cfg_key)
 {
     if (isset($_POST[$cfg_key])) {
         $configuration_value = preg_replace('/[^0-9-]/', '', $_POST[$cfg_key]);
         $configuration_value = xtc_db_prepare_input($configuration_value);
         $configuration_query = xtc_db_query("SELECT configuration_key,\n                                                  configuration_value\n                                             FROM " . TABLE_CONFIGURATION . "\n                                            WHERE configuration_key = '" . xtc_db_input($cfg_key) . "'\n                                         ");
         if (xtc_db_num_rows($configuration_query) > 0) {
             //update
             xtc_db_query("UPDATE " . TABLE_CONFIGURATION . "\n                         SET configuration_value ='" . xtc_db_input($configuration_value) . "',\n                             last_modified = NOW()\n                       WHERE configuration_key='" . xtc_db_input($cfg_key) . "'");
         } else {
             //new entry
             $sql_data_array = array('configuration_key' => $cfg_key, 'configuration_value' => $configuration_value, 'configuration_group_id' => '1000', 'sort_order' => '-1', 'last_modified' => 'now()', 'date_added' => 'now()');
             xtc_db_perform(TABLE_CONFIGURATION, $sql_data_array);
         }
         return $configuration_value;
     }
     return defined($cfg_key) && (int) constant($cfg_key) > 0 ? constant($cfg_key) : 20;
 }

function xtc_address_summary($customers_id, $address_id)
{
    $customers_id = xtc_db_prepare_input($customers_id);
    $address_id = xtc_db_prepare_input($address_id);
    $address_query = xtc_db_query("select ab.entry_street_address, ab.entry_suburb, ab.entry_postcode, ab.entry_city, ab.entry_state, ab.entry_country_id, ab.entry_zone_id, c.countries_name, c.address_format_id from " . TABLE_ADDRESS_BOOK . " ab, " . TABLE_COUNTRIES . " c where ab.address_book_id = '" . xtc_db_input((int) $address_id) . "' and ab.customers_id = '" . xtc_db_input((int) $customers_id) . "' and ab.entry_country_id = c.countries_id");
    $address = xtc_db_fetch_array($address_query);
    $street_address = $address['entry_street_address'];
    $suburb = $address['entry_suburb'];
    $postcode = $address['entry_postcode'];
    $city = $address['entry_city'];
    $state = xtc_get_zone_code($address['entry_country_id'], $address['entry_zone_id'], $address['entry_state']);
    $country = $address['countries_name'];
    $address_format_query = xtc_db_query("select address_summary from " . TABLE_ADDRESS_FORMAT . " where address_format_id = '" . (int) $address['address_format_id'] . "'");
    $address_format = xtc_db_fetch_array($address_format_query);
    //    eval("\$address = \"{$address_format['address_summary']}\";");
    $address_summary = $address_format['address_summary'];
    eval("\$address = \"{$address_summary}\";");
    return $address;
}

 function query($order_id)
 {
     $order_id = xtc_db_prepare_input($order_id);
     $order_query = xtc_db_query("SELECT\r\n                                   *\r\n                                   FROM " . TABLE_ORDERS . " WHERE\r\n                                   orders_id = '" . xtc_db_input($order_id) . "'");
     $order = xtc_db_fetch_array($order_query);
     $totals_query = xtc_db_query("SELECT * FROM " . TABLE_ORDERS_TOTAL . " where orders_id = '" . xtc_db_input($order_id) . "' order by sort_order");
     while ($totals = xtc_db_fetch_array($totals_query)) {
         $this->totals[] = array('title' => $totals['title'], 'text' => $totals['text'], 'value' => $totals['value']);
     }
     $order_total_query = xtc_db_query("select text from " . TABLE_ORDERS_TOTAL . " where orders_id = '" . $order_id . "' and class = 'ot_total'");
     $order_total = xtc_db_fetch_array($order_total_query);
     $shipping_method_query = xtc_db_query("select title from " . TABLE_ORDERS_TOTAL . " where orders_id = '" . $order_id . "' and class = 'ot_shipping'");
     $shipping_method = xtc_db_fetch_array($shipping_method_query);
     $order_status_query = xtc_db_query("select orders_status_name from " . TABLE_ORDERS_STATUS . " where orders_status_id = '" . $order['orders_status'] . "' and language_id = '" . $_SESSION['languages_id'] . "'");
     $order_status = xtc_db_fetch_array($order_status_query);
     //echo "ord query:<pre>"; print_r($order); echo "</pre>";
     $this->info = array('currency' => $order['currency'], 'currency_value' => $order['currency_value'], 'payment_method' => $order['payment_method'], 'date_purchased' => $order['date_purchased'], 'orders_invoice_date' => $order['orders_invoice_date'], 'orders_status' => $order_status['orders_status_name'], 'last_modified' => $order['last_modified'], 'total' => strip_tags($order_total['text']), 'shipping_method' => substr($shipping_method['title'], -1) == ':' ? substr(strip_tags($shipping_method['title']), 0, -1) : strip_tags($shipping_method['title']), 'comments' => $order['comments'], 'ibn_billdate' => $order['ibn_billdate'], 'ibn_billnr' => $order['ibn_billnr'], 'ibn_pdfnotifydate' => $order['ibn_pdfnotifydate']);
     $this->customer = array('id' => $order['customers_id'], 'vat_id' => $order['customers_vat_id'], 'name' => $order['customers_name'], 'firstname' => $order['customers_firstname'], 'lastname' => $order['customers_lastname'], 'csID' => $order['customers_cid'], 'company' => $order['customers_company'], 'street_address' => $order['customers_street_address'], 'suburb' => $order['customers_suburb'], 'city' => $order['customers_city'], 'postcode' => $order['customers_postcode'], 'state' => $order['customers_state'], 'country' => $order['customers_country'], 'format_id' => $order['customers_address_format_id'], 'telephone' => $order['customers_telephone'], 'email_address' => $order['customers_email_address']);
     $this->delivery = array('name' => $order['delivery_name'], 'firstname' => $order['delivery_firstname'], 'lastname' => $order['delivery_lastname'], 'company' => $order['delivery_company'], 'street_address' => $order['delivery_street_address'], 'suburb' => $order['delivery_suburb'], 'city' => $order['delivery_city'], 'postcode' => $order['delivery_postcode'], 'state' => $order['delivery_state'], 'country' => $order['delivery_country'], 'format_id' => $order['delivery_address_format_id']);
     if (empty($this->delivery['name']) && empty($this->delivery['street_address'])) {
         $this->delivery = false;
     }
     $this->billing = array('name' => $order['billing_name'], 'firstname' => $order['billing_firstname'], 'lastname' => $order['billing_lastname'], 'company' => $order['billing_company'], 'street_address' => $order['billing_street_address'], 'suburb' => $order['billing_suburb'], 'city' => $order['billing_city'], 'postcode' => $order['billing_postcode'], 'state' => $order['billing_state'], 'country' => $order['billing_country'], 'format_id' => $order['billing_address_format_id']);
     $index = 0;
     $orders_products_query = xtc_db_query("SELECT * FROM " . TABLE_ORDERS_PRODUCTS . " where orders_id = '" . xtc_db_input($order_id) . "'");
     while ($orders_products = xtc_db_fetch_array($orders_products_query)) {
         $this->products[$index] = array('qty' => $orders_products['products_quantity'], 'id' => $orders_products['products_id'], 'name' => $orders_products['products_name'], 'model' => $orders_products['products_model'], 'tax' => $orders_products['products_tax'], 'price' => $orders_products['products_price'], 'shipping_time' => $orders_products['products_shipping_time'], 'final_price' => $orders_products['final_price']);
         $subindex = 0;
         $attributes_query = xtc_db_query("SELECT * FROM " . TABLE_ORDERS_PRODUCTS_ATTRIBUTES . " where orders_id = '" . xtc_db_input($order_id) . "' and orders_products_id = '" . $orders_products['orders_products_id'] . "'");
         if (xtc_db_num_rows($attributes_query)) {
             while ($attributes = xtc_db_fetch_array($attributes_query)) {
                 $this->products[$index]['attributes'][$subindex] = array('option' => $attributes['products_options'], 'value' => $attributes['products_options_values'], 'prefix' => $attributes['price_prefix'], 'price' => $attributes['options_values_price']);
                 $subindex++;
             }
         }
         $this->info['tax_groups']["{$this->products[$index]['tax']}"] = '1';
         $index++;
     }
 }

            $tax_class_title = xtc_db_prepare_input($_POST['tax_class_title']);
            $tax_class_description = xtc_db_prepare_input($_POST['tax_class_description']);
            $date_added = xtc_db_prepare_input($_POST['date_added']);
            xtc_db_query("insert into " . TABLE_TAX_CLASS . " (tax_class_title, tax_class_description, date_added) values ('" . xtc_db_input($tax_class_title) . "', '" . xtc_db_input($tax_class_description) . "', now())");
            xtc_redirect(xtc_href_link(FILENAME_TAX_CLASSES));
            break;
        case 'save':
            $tax_class_id = xtc_db_prepare_input($_GET['tID']);
            $tax_class_title = xtc_db_prepare_input($_POST['tax_class_title']);
            $tax_class_description = xtc_db_prepare_input($_POST['tax_class_description']);
            $last_modified = xtc_db_prepare_input($_POST['last_modified']);
            xtc_db_query("update " . TABLE_TAX_CLASS . " set tax_class_id = '" . xtc_db_input($tax_class_id) . "', tax_class_title = '" . xtc_db_input($tax_class_title) . "', tax_class_description = '" . xtc_db_input($tax_class_description) . "', last_modified = now() where tax_class_id = '" . xtc_db_input($tax_class_id) . "'");
            xtc_redirect(xtc_href_link(FILENAME_TAX_CLASSES, 'page=' . $_GET['page'] . '&tID=' . $tax_class_id));
            break;
        case 'deleteconfirm':
            $tax_class_id = xtc_db_prepare_input($_GET['tID']);
            xtc_db_query("delete from " . TABLE_TAX_CLASS . " where tax_class_id = '" . xtc_db_input($tax_class_id) . "'");
            xtc_redirect(xtc_href_link(FILENAME_TAX_CLASSES, 'page=' . $_GET['page']));
            break;
    }
}
require DIR_WS_INCLUDES . 'head.php';
?>

</head>
<body marginwidth="0" marginheight="0" topmargin="0" bottommargin="0" leftmargin="0" rightmargin="0" bgcolor="#FFFFFF" onload="SetFocus();">
<!-- header //-->
<?php 
require DIR_WS_INCLUDES . 'header.php';
?>
<!-- header_eof //-->

function calculate_tax($amount)
{
    global $xtPrice, $status;
    $price = 'b_price';
    if ($status['customers_status_show_price_tax'] == 0 && $status['customers_status_add_tax_ot'] == 1) {
        $price = 'n_price';
    }
    $sum_query = xtc_db_query("select SUM(" . $price . ") as price from " . TABLE_ORDERS_RECALCULATE . " where orders_id = '" . (int) $_POST['oID'] . "' and class = 'products'");
    $sum_total = xtc_db_fetch_array($sum_query);
    //Gutscheinwert/Rabatt in % berechnen, vereinheitlicht die Berechnungen
    if ($sum_total['price'] == 0) {
        return 0;
    }
    $amount_pro = $amount / $sum_total['price'] * 100;
    //Steuersätze alle Produkte der Bestellung feststellen
    $tax_rate_query = xtc_db_query("select tax_rate from " . TABLE_ORDERS_RECALCULATE . " where orders_id = '" . (int) $_POST['oID'] . "' and class = 'ot_tax' GROUP BY tax_rate");
    $tod_amount = 0;
    //Berechnungen pro Steuersatz durchführen
    while ($tax_rate = xtc_db_fetch_array($tax_rate_query)) {
        $tax_query = xtc_db_query("select SUM(tax) as value from " . TABLE_ORDERS_RECALCULATE . " where orders_id = '" . (int) $_POST['oID'] . "' and tax_rate = '" . $tax_rate['tax_rate'] . "'and class = 'products'");
        $tax_total = xtc_db_fetch_array($tax_query);
        $god_amount = $tax_total['value'] * $amount_pro / 100;
        $new_tax_query = xtc_db_query("select tax as value from " . TABLE_ORDERS_RECALCULATE . " where orders_id = '" . (int) $_POST['oID'] . "' and tax_rate = '" . $tax_rate['tax_rate'] . "'and class = 'ot_tax'");
        $new_tax_total = xtc_db_fetch_array($new_tax_query);
        $new_tax = $new_tax_total['value'] + $god_amount;
        //web29 - 2011-08-25 - Fix negative sign
        //Einzelne Steuersätze neu in Kalkulationstabelle speichern
        xtc_db_query("UPDATE " . TABLE_ORDERS_RECALCULATE . "\n                     SET tax = '" . xtc_db_prepare_input($new_tax) . "'\n                   WHERE orders_id = '" . (int) $_POST['oID'] . "'\n                     AND tax_rate = '" . xtc_db_prepare_input($tax_rate['tax_rate']) . "'\n                     AND class = 'ot_tax'\n                 ");
        //echo $god_amount . '<br>';
        $tod_amount += $god_amount;
        //hier wird die Steuer aufaddiert
    }
    return $tod_amount;
}

function saveSpecialsData($products_id)
{
    // decide whether to insert a new special,
    // or to update an existing one
    if ($_POST['specials_action'] == "insert" && isset($_POST['specials_price']) && !empty($_POST['specials_price'])) {
        // insert a new special, code taken from /admin/specials.php, and modified
        if (!isset($_POST['specials_quantity']) or empty($_POST['specials_quantity'])) {
            $_POST['specials_quantity'] = 0;
        }
        if (PRICE_IS_BRUTTO == 'true' && substr($_POST['specials_price'], -1) != '%') {
            $_POST['specials_price'] = $_POST['specials_price'] / ($_POST['tax_rate'] + 100) * 100;
            //web28 - 2010-07-27 - tax_rate from  hidden field
        }
        if (substr($_POST['specials_price'], -1) == '%') {
            $_POST['specials_price'] = $_POST['products_price_hidden'] - $_POST['specials_price'] / 100 * $_POST['products_price_hidden'];
            //web28 - 2010-07-27 - products_price_hidden from  hidden field
        }
        $expires_date = '';
        if ($_POST['specials_expires']) {
            $expires_date = str_replace("-", "", $_POST['specials_expires']);
        }
        $sql_data_array = array('products_id' => $products_id, 'specials_quantity' => (int) $_POST['specials_quantity'], 'specials_new_products_price' => xtc_db_prepare_input($_POST['specials_price']), 'specials_date_added' => 'now()', 'expires_date' => $expires_date, 'status' => '1');
        xtc_db_perform(TABLE_SPECIALS, $sql_data_array);
    } elseif ($_POST['specials_action'] == "update" && isset($_POST['specials_price']) && isset($_POST['specials_quantity'])) {
        // update the existing special for this product, code taken from /admin/specials.php, and modified
        if (PRICE_IS_BRUTTO == 'true' && substr($_POST['specials_price'], -1) != '%') {
            $sql = "SELECT tr.tax_rate\n              FROM " . TABLE_TAX_RATES . " tr,\n                   " . TABLE_PRODUCTS . " p\n             WHERE tr.tax_class_id = p. products_tax_class_id\n               AND p.products_id = '" . $products_id . "' ";
            $tax_query = xtc_db_query($sql);
            $tax = xtc_db_fetch_array($tax_query);
            $_POST['specials_price'] = $_POST['specials_price'] / ($_POST['tax_rate'] + 100) * 100;
            //web28 - 2010-07-27 - tax_rate from  hidden field
        }
        if (substr($_POST['specials_price'], -1) == '%') {
            $_POST['specials_price'] = $_POST['products_price_hidden'] - $_POST['specials_price'] / 100 * $_POST['products_price_hidden'];
            //web28 - 2010-07-27 - products_price_hidden from  hidden field
        }
        $expires_date = 'NULL';
        if ($_POST['specials_expires'] && $_POST['specials_status'] == 1) {
            //DokuMan - 2011-11-8 - from SP1b
            $expires_date = str_replace("-", "", $_POST['specials_expires']);
        }
        $sql_data_array = array('specials_quantity' => (int) $_POST['specials_quantity'], 'specials_new_products_price' => xtc_db_prepare_input($_POST['specials_price']), 'specials_date_added' => 'now()', 'expires_date' => $expires_date, 'status' => (int) $_POST['specials_status']);
        //$sql_data_array['specials_attribute'] = (int)$_POST['specials_attribute'];
        xtc_db_perform(TABLE_SPECIALS, $sql_data_array, 'update', "specials_id = '" . xtc_db_input($_POST['specials_id']) . "'");
    }
    if (isset($_POST['specials_delete'])) {
        // delete existing special for this product, code taken from /admin/specials.php, and modified
        xtc_db_query("DELETE FROM " . TABLE_SPECIALS . " WHERE specials_id = '" . xtc_db_input($_POST['specials_id']) . "'");
    }
}

 function callback_process($data, $charset)
 {
     // Keine Session da !
     // Stand: 29.06.2011
     global $_GET;
     $this->data = $data;
     //$this->_logTrans($data);
     require_once DIR_WS_CLASSES . 'class.phpmailer.php';
     if (EMAIL_TRANSPORT == 'smtp') {
         require_once DIR_WS_CLASSES . 'class.smtp.php';
     }
     require_once DIR_FS_INC . 'xtc_Security.inc.php';
     $xtc_order_id = (int) substr($this->data['invoice'], strlen(PAYPAL_INVOICE));
     if (isset($xtc_order_id) && is_numeric($xtc_order_id) && $xtc_order_id > 0) {
         // order suchen
         $order_query = xtc_db_query("SELECT currency, currency_value\n                                    FROM " . TABLE_ORDERS . "\n                                    WHERE orders_id = '" . xtc_db_prepare_input($xtc_order_id) . "'");
         if (xtc_db_num_rows($order_query) > 0) {
             // order gefunden
             $ipn_charset = xtc_db_prepare_input($this->data['charset']);
             $ipn_data = array();
             $ipn_data['reason_code'] = xtc_db_prepare_input($this->data['reason_code']);
             $ipn_data['xtc_order_id'] = xtc_db_prepare_input($xtc_order_id);
             $ipn_data['payment_type'] = xtc_db_prepare_input($this->data['payment_type']);
             $ipn_data['payment_status'] = xtc_db_prepare_input($this->data['payment_status']);
             $ipn_data['pending_reason'] = xtc_db_prepare_input($this->data['pending_reason']);
             $ipn_data['invoice'] = xtc_db_prepare_input($this->data['invoice']);
             $ipn_data['mc_currency'] = xtc_db_prepare_input($this->data['mc_currency']);
             $ipn_data['first_name'] = xtc_db_prepare_input($this->IPNdecode($this->data['first_name'], $ipn_charset, $charset));
             $ipn_data['last_name'] = xtc_db_prepare_input($this->IPNdecode($this->data['last_name'], $ipn_charset, $charset));
             $ipn_data['address_name'] = xtc_db_prepare_input($this->IPNdecode($this->data['address_name'], $ipn_charset, $charset));
             $ipn_data['address_street'] = xtc_db_prepare_input($this->IPNdecode($this->data['address_street'], $ipn_charset, $charset));
             $ipn_data['address_city'] = xtc_db_prepare_input($this->IPNdecode($this->data['address_city'], $ipn_charset, $charset));
             $ipn_data['address_state'] = xtc_db_prepare_input($this->IPNdecode($this->data['address_state'], $ipn_charset, $charset));
             $ipn_data['address_zip'] = xtc_db_prepare_input($this->data['address_zip']);
             $ipn_data['address_country'] = xtc_db_prepare_input($this->IPNdecode($this->data['address_country'], $ipn_charset, $charset));
             $ipn_data['address_status'] = xtc_db_prepare_input($this->data['address_status']);
             $ipn_data['payer_email'] = xtc_db_prepare_input($this->data['payer_email']);
             $ipn_data['payer_id'] = xtc_db_prepare_input($this->data['payer_id']);
             $ipn_data['payer_status'] = xtc_db_prepare_input($this->data['payer_status']);
             $ipn_data['payment_date'] = xtc_db_prepare_input($this->datetime_to_sql_format($this->data['payment_date']));
             $ipn_data['business'] = xtc_db_prepare_input($this->IPNdecode($this->data['business'], $ipn_charset, $charset));
             $ipn_data['receiver_email'] = xtc_db_prepare_input($this->data['receiver_email']);
             $ipn_data['receiver_id'] = xtc_db_prepare_input($this->data['receiver_id']);
             $ipn_data['txn_id'] = xtc_db_prepare_input($this->data['txn_id']);
             $ipn_data['txn_type'] = $this->ipn_determine_txn_type($this->data['txn_type']);
             $ipn_data['parent_txn_id'] = xtc_db_prepare_input($this->data['parent_txn_id']);
             $ipn_data['mc_gross'] = xtc_db_prepare_input($this->data['mc_gross']);
             $ipn_data['mc_fee'] = xtc_db_prepare_input($this->data['mc_fee']);
             $ipn_data['mc_shipping'] = xtc_db_prepare_input($this->data['mc_shipping']);
             $ipn_data['payment_gross'] = xtc_db_prepare_input($this->data['payment_gross']);
             $ipn_data['payment_fee'] = xtc_db_prepare_input($this->data['payment_fee']);
             $ipn_data['notify_version'] = xtc_db_prepare_input($this->data['notify_version']);
             $ipn_data['verify_sign'] = xtc_db_prepare_input($this->data['verify_sign']);
             $ipn_data['num_cart_items'] = xtc_db_prepare_input($this->data['num_cart_items']);
             if ($ipn_data['num_cart_items'] > 1) {
                 $verspos = $ipn_data['num_cart_items'];
                 for ($p = 1; $p <= $verspos; $p++) {
                     if ($this->data['item_name' . $p] == substr(SUB_TITLE_OT_DISCOUNT, 0, 127) || $this->data['item_name' . $p] == substr(PAYPAL_GS, 0, 127) || $this->data['item_name' . $p] == "Handling" || $this->data['item_name' . $p] == substr(PAYPAL_TAX, 0, 127) || $this->data['item_name' . $p] == "Differenz") {
                         // Artikel Nummer aus den Details für Sonderzeilen
                         $ipn_data['num_cart_items']--;
                     }
                     if ($this->data['item_name' . $p] == substr(SHIPPING_COSTS, 0, 127)) {
                         // Versandkosten
                         $ipn_data['mc_shipping'] = $this->data['mc_gross_' . $p];
                         $ipn_data['num_cart_items']--;
                     }
                 }
             }
             $_transQuery = "SELECT paypal_ipn_id FROM " . TABLE_PAYPAL . " WHERE txn_id = '" . $ipn_data['txn_id'] . "'";
             $_transQuery = xtc_db_query($_transQuery);
             $_transQuery = xtc_db_fetch_array($_transQuery);
             if ($_transQuery['paypal_ipn_id'] != '') {
                 $insert_id = $_transQuery['paypal_ipn_id'];
                 $sql_data_array = array('payment_status' => $ipn_data['payment_status'], 'pending_reason' => $ipn_data['pending_reason'], 'payer_email' => $ipn_data['payer_email'], 'num_cart_items' => $ipn_data['num_cart_items'], 'mc_fee' => $ipn_data['mc_fee'], 'mc_shipping' => $ipn_data['mc_shipping'], 'address_name' => $ipn_data['address_name'], 'address_street' => $ipn_data['address_street'], 'address_city' => $ipn_data['address_city'], 'address_state' => $ipn_data['address_state'], 'address_zip' => $ipn_data['address_zip'], 'address_country' => $ipn_data['address_country'], 'address_status' => $ipn_data['address_status'], 'payer_status' => $ipn_data['payer_status'], 'receiver_email' => $ipn_data['receiver_email'], 'last_modified ' => 'now()');
                 xtc_db_perform(TABLE_PAYPAL, $sql_data_array, 'update', "paypal_ipn_id = '" . (int) $insert_id . "'");
             } else {
                 $ipn_data['date_added'] = 'now()';
                 $ipn_data['last_modified'] = 'now()';
                 xtc_db_perform(TABLE_PAYPAL, $ipn_data);
                 $insert_id = xtc_db_insert_id();
             }
             $paypal_order_history = array('paypal_ipn_id' => $insert_id, 'txn_id' => $ipn_data['txn_id'], 'parent_txn_id' => $ipn_data['parent_txn_id'], 'payment_status' => $ipn_data['payment_status'], 'pending_reason' => $ipn_data['pending_reason'], 'mc_amount' => $ipn_data['mc_gross'], 'date_added' => 'now()');
             xtc_db_perform(TABLE_PAYPAL_STATUS_HISTORY, $paypal_order_history);
             $crlf = "\n";
             $comment_status = xtc_db_prepare_input($this->data['payment_status']) . ' ' . xtc_db_prepare_input($this->data['mc_gross']) . xtc_db_prepare_input($this->data['mc_currency']) . $crlf;
             $comment_status .= ' ' . xtc_db_prepare_input($this->data['first_name']) . ' ' . xtc_db_prepare_input($this->data['last_name']) . ' ' . xtc_db_prepare_input($this->data['payer_email']);
             if (isset($this->data['payer_status'])) {
                 $comment_status .= ' is ' . xtc_db_prepare_input($this->data['payer_status']);
             }
             $comment_status .= '.' . $crlf;
             if (isset($this->data['test_ipn']) && is_numeric($this->data['test_ipn']) && $_POST['test_ipn'] > 0) {
                 $comment_status .= '(Sandbox-Test Mode)' . $crlf;
             }
             $comment_status .= 'Total=' . xtc_db_prepare_input($this->data['mc_gross']) . xtc_db_prepare_input($this->data['mc_currency']);
             if (isset($this->data['pending_reason'])) {
                 $comment_status .= $crlf . ' Pending Reason=' . xtc_db_prepare_input($this->data['pending_reason']);
             }
             if (isset($this->data['reason_code'])) {
                 $comment_status .= $crlf . ' Reason Code=' . xtc_db_prepare_input($this->data['reason_code']);
             }
//.........这里部分代码省略.........

<?php

require 'includes/application_top.php';
#MN: Check if $_POST form is submited on this page
if ($_POST) {
    switch ($_POST['action']) {
        case 'widget_active':
            xtc_db_query("update " . TABLE_WIDGETS . " set widgets_active = !widgets_active where widgets_id = '" . xtc_db_input($_POST['widgets']) . "'");
            break;
        case 'widget_save_position':
            foreach ($_POST['widgets_id'] as $key => $widget) {
                $w_x = xtc_db_prepare_input($_POST['widgets_x'][$key]);
                $w_y = xtc_db_prepare_input($_POST['widgets_y'][$key]);
                xtc_db_query("update " . TABLE_WIDGETS . " set widgets_x = '" . $w_x . "', widgets_y = '" . $w_y . "' where widgets_id = '" . $widget . "'");
            }
            break;
    }
    xtc_redirect(xtc_href_link(FILENAME_START));
}
require DIR_WS_INCLUDES . 'head.php';
?>


    <style type="text/css">

      .gridster li header {
        background: #999;
        display: block;
        font-size: 20px;
        line-height: normal;
        padding: 4px 0 6px ;

            $carrier_sort_order = xtc_db_prepare_input($_POST['carrier_sort_order']);
            $date_added = xtc_db_prepare_input($_POST['carrier_date_added']);
            xtc_db_query("insert into " . TABLE_CARRIERS . " (carrier_name, carrier_tracking_link, carrier_sort_order, carrier_date_added) values ('" . xtc_db_input($carrier_name) . "', '" . xtc_db_input($carrier_tracking_link) . "', '" . xtc_db_input($carrier_sort_order) . "', now())");
            xtc_redirect(xtc_href_link(FILENAME_PARCEL_CARRIERS));
            break;
        case 'save':
            $carrier_id = xtc_db_prepare_input($_GET['carrierID']);
            $carrier_name = xtc_db_prepare_input($_POST['carrier_name']);
            $carrier_tracking_link = xtc_db_prepare_input($_POST['carrier_tracking_link']);
            $carrier_sort_order = xtc_db_prepare_input($_POST['carrier_sort_order']);
            $last_modified = xtc_db_prepare_input($_POST['carrier_last_modified']);
            xtc_db_query("update " . TABLE_CARRIERS . " set carrier_id = '" . (int) $carrier_id . "', carrier_name = '" . xtc_db_input($carrier_name) . "', carrier_tracking_link = '" . xtc_db_input($carrier_tracking_link) . "', carrier_sort_order = '" . xtc_db_input($carrier_sort_order) . "', carrier_last_modified = now() where carrier_id = '" . (int) $carrier_id . "'");
            xtc_redirect(xtc_href_link(FILENAME_PARCEL_CARRIERS, 'page=' . $page_parcel . '&carrierID=' . $carrier_id));
            break;
        case 'deleteconfirm':
            $carrier_id = xtc_db_prepare_input($_GET['carrierID']);
            xtc_db_query("delete from " . TABLE_CARRIERS . " where carrier_id = '" . (int) $carrier_id . "'");
            xtc_redirect(xtc_href_link(FILENAME_PARCEL_CARRIERS, 'page=' . $page_parcel));
            break;
    }
}
require DIR_WS_INCLUDES . 'head.php';
?>
  <script type="text/javascript" src="includes/general.js"></script>
</head>
<body>
    <!-- header //-->
    <?php 
require DIR_WS_INCLUDES . 'header.php';
?>
    <!-- header_eof //-->

 protected function after_process()
 {
     if (isset($this->document->document->documentNumber) && xtc_not_null($this->document->document->documentNumber)) {
         $process_array = array('orders_id' => xtc_db_prepare_input($this->info['order_id']), 'customers_id' => xtc_db_prepare_input($this->customer['id']), 'easybill_customers_id' => xtc_db_prepare_input($this->customers->customerID), 'billing_id' => xtc_db_prepare_input($this->document->document->documentNumber), 'billing_date' => 'now()');
         xtc_db_perform(TABLE_EASYBILL, $process_array);
         if (MODULE_EASYBILL_DO_STATUS_CHANGE == 'True') {
             $status_array = array('orders_id' => $this->info['order_id'], 'orders_status_id' => MODULE_EASYBILL_STATUS_CHANGE, 'date_added' => 'now()', 'customer_notified' => '0', 'comments' => EASYBILL_STATUS_CHANGE_COMMENT);
             xtc_db_perform(TABLE_ORDERS_STATUS_HISTORY, $status_array);
             xtc_db_query("UPDATE " . TABLE_ORDERS . "\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tSET orders_status = " . MODULE_EASYBILL_STATUS_CHANGE . ",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tlast_modified = now()\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tWHERE orders_id = " . $this->info['order_id']);
         }
     }
 }

function shopDbPrepareInput($string)
{
    return xtc_db_prepare_input($string);
}

                <td class="dataTableHeadingContent" align="right"><?php 
    echo TABLE_HEADING_ACTION;
    ?>
&nbsp;</td>
              </tr>
<?php 
    if ($_GET['cID']) {
        $cID = xtc_db_prepare_input($_GET['cID']);
        // BOF - Tomcraft - 2009-10-11 - BUGFIX: #0000247 view orders query bug in admin
        //$orders_query_raw = "select o.orders_id, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.customers_id, o.payment_method, o.date_purchased, o.last_modified, o.currency, o.currency_value, o.orders_status, s.orders_status_name, ot.text as order_total from ".TABLE_ORDERS." o left join ".TABLE_ORDERS_TOTAL." ot on (o.orders_id = ot.orders_id), ".TABLE_ORDERS_STATUS." s where o.customers_id = '".xtc_db_input($cID)."' and (o.orders_status = s.orders_status_id and s.language_id = '".$_SESSION['languages_id']."' and ot.class = 'ot_total') or (o.orders_status = '0' and ot.class = 'ot_total' and  s.orders_status_id = '1' and s.language_id = '".$_SESSION['languages_id']."') order by orders_id DESC";
        $orders_query_raw = "select o.orders_id, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.customers_id, o.payment_method, o.date_purchased, o.last_modified, o.currency, o.currency_value, o.orders_status, s.orders_status_name, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id), " . TABLE_ORDERS_STATUS . " s where o.customers_id = '" . xtc_db_input($cID) . "' and ((o.orders_status = s.orders_status_id) or (o.orders_status = '0' and  s.orders_status_id = '1')) and ot.class = 'ot_total' and s.language_id = '" . $_SESSION['languages_id'] . "' order by orders_id DESC";
        // EOF - Tomcraft - 2009-10-11 - BUGFIX: #0000247 view orders query bug in admin
    } elseif ($_GET['status'] == '0') {
        $orders_query_raw = "select o.orders_id, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.payment_method, o.date_purchased, o.last_modified, o.currency, o.currency_value, o.orders_status, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id) where o.orders_status = '0' and ot.class = 'ot_total' order by o.orders_id DESC";
    } elseif ($_GET['status']) {
        $status = xtc_db_prepare_input($_GET['status']);
        $orders_query_raw = "select o.orders_id, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.payment_method, o.date_purchased, o.last_modified, o.currency, o.currency_value, s.orders_status_name, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id), " . TABLE_ORDERS_STATUS . " s where o.orders_status = s.orders_status_id and s.language_id = '" . $_SESSION['languages_id'] . "' and s.orders_status_id = '" . xtc_db_input($status) . "' and ot.class = 'ot_total' order by o.orders_id DESC";
    } elseif ($_GET['action'] == 'search' && $_GET['oID']) {
        //$orders_query_raw siehe oben
        //EOF - web28 - 2010-04-10 added for ADMIN SEARCH BAR
    } else {
        $orders_query_raw = "select o.orders_id, o.orders_status, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.payment_method, o.date_purchased, o.last_modified, o.currency, o.currency_value, s.orders_status_name, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id), " . TABLE_ORDERS_STATUS . " s where (o.orders_status = s.orders_status_id and s.language_id = '" . $_SESSION['languages_id'] . "' and ot.class = 'ot_total') or (o.orders_status = '0' and ot.class = 'ot_total' and  s.orders_status_id = '1' and s.language_id = '" . $_SESSION['languages_id'] . "') order by o.orders_id DESC";
    }
    $orders_split = new splitPageResults($_GET['page'], '20', $orders_query_raw, $orders_query_numrows);
    $orders_query = xtc_db_query($orders_query_raw);
    while ($orders = xtc_db_fetch_array($orders_query)) {
        if ((!$_GET['oID'] || $_GET['oID'] == $orders['orders_id']) && !$oInfo) {
            $oInfo = new objectInfo($orders);
        }
        if (is_object($oInfo) && $orders['orders_id'] == $oInfo->orders_id) {
            echo '              <tr class="dataTableRowSelected" onmouseover="this.style.cursor=\'pointer\'" onclick="document.location.href=\'' . xtc_href_link(FILENAME_ORDERS, xtc_get_all_get_params(array('oID', 'action')) . 'oID=' . $oInfo->orders_id . '&action=edit') . '\'">' . "\n";