function query($order_id)
 {
     $order_query = vam_db_query("select customers_name,\n                                   customers_cid,\n                                   customers_id,\n                                   customers_vat_id,\n                                   customers_company,\n                                   customers_street_address,\n                                   customers_suburb,\n                                   customers_city,\n                                   customers_postcode,\n                                   customers_state,\n                                   customers_country,\n                                   customers_telephone,\n                                   customers_email_address,\n                                   customers_address_format_id,\n                                   delivery_name,\n                                   delivery_company,\n                                   delivery_street_address,\n                                   delivery_suburb,\n                                   delivery_city,\n                                   delivery_postcode,\n                                   delivery_state,\n                                   delivery_country,\n                                   delivery_address_format_id,\n                                   billing_name,\n                                   billing_company,\n                                   billing_street_address,\n                                   billing_suburb,\n                                   billing_city,\n                                   billing_postcode,\n                                   billing_state,\n                                   billing_country,\n                                   billing_address_format_id,\n                                   payment_method,\n                                   payment_class,\n\t\t\t\t                  shipping_class,\n\t\t\t\t                  cc_type,\n                                   cc_owner,\n                                   cc_number,\n                                   cc_expires,\n                                   cc_cvv,\n                                   comments,\n                                   currency,\n                                   currency_value,\n                                   date_purchased,\n                                   orders_status,\n                                   last_modified,\n                                   orig_reference, \n                                   login_reference,\n                                   customers_status,\n                                   customers_status_name,\n                                   customers_status_image,\n                                   customers_ip,\n                                   language,\n                                   customers_status_discount\n                                   from " . TABLE_ORDERS . " where\n                                   orders_id = '" . vam_db_input($order_id) . "'");
     $order = vam_db_fetch_array($order_query);
     $totals_query = vam_db_query("select title, text from " . TABLE_ORDERS_TOTAL . " where orders_id = '" . vam_db_input($order_id) . "' order by sort_order");
     while ($totals = vam_db_fetch_array($totals_query)) {
         $this->totals[] = array('title' => $totals['title'], 'text' => $totals['text']);
     }
     $this->info = array('currency' => $order['currency'], 'currency_value' => $order['currency_value'], 'payment_method' => $order['payment_method'], 'payment_class' => $order['payment_class'], 'shipping_class' => $order['shipping_class'], 'status' => $order['customers_status'], 'status_name' => $order['customers_status_name'], 'status_image' => $order['customers_status_image'], 'status_discount' => $order['customers_status_discount'], 'cc_type' => $order['cc_type'], 'cc_owner' => $order['cc_owner'], 'cc_number' => $order['cc_number'], 'cc_expires' => $order['cc_expires'], 'cc_cvv' => $order['cc_cvv'], 'comments' => $order['comments'], 'language' => $order['language'], 'date_purchased' => $order['date_purchased'], 'orders_status' => $order['orders_status'], 'last_modified' => $order['last_modified']);
     $this->customer = array('name' => $order['customers_name'], 'company' => $order['customers_company'], 'csID' => $order['customers_cid'], 'vat_id' => $order['customers_vat_id'], 'shop_id' => $order['shop_id'], 'ID' => $order['customers_id'], 'cIP' => $order['customers_ip'], 'street_address' => $order['customers_street_address'], 'suburb' => $order['customers_suburb'], 'city' => $order['customers_city'], 'postcode' => $order['customers_postcode'], 'state' => $order['customers_state'], 'country' => $order['customers_country'], 'format_id' => $order['customers_address_format_id'], 'telephone' => $order['customers_telephone'], 'email_address' => $order['customers_email_address'], 'orig_reference' => $order['orig_reference'], 'login_reference' => $order['login_reference']);
     $this->delivery = array('name' => $order['delivery_name'], 'company' => $order['delivery_company'], 'street_address' => $order['delivery_street_address'], 'suburb' => $order['delivery_suburb'], 'city' => $order['delivery_city'], 'postcode' => $order['delivery_postcode'], 'state' => $order['delivery_state'], 'country' => $order['delivery_country'], 'format_id' => $order['delivery_address_format_id']);
     $this->billing = array('name' => $order['billing_name'], 'company' => $order['billing_company'], 'street_address' => $order['billing_street_address'], 'suburb' => $order['billing_suburb'], 'city' => $order['billing_city'], 'postcode' => $order['billing_postcode'], 'state' => $order['billing_state'], 'country' => $order['billing_country'], 'format_id' => $order['billing_address_format_id']);
     $index = 0;
     $orders_products_query = vam_db_query("select\n                                                 orders_products_id,products_id, products_name, products_model, products_price, products_tax, products_quantity, final_price,allow_tax, products_discount_made\n                                             from\n                                                 " . TABLE_ORDERS_PRODUCTS . "\n                                             where\n                                                 orders_id ='" . vam_db_input($order_id) . "'");
     while ($orders_products = vam_db_fetch_array($orders_products_query)) {
         $this->products[$index] = array('qty' => $orders_products['products_quantity'], 'name' => $orders_products['products_name'], 'id' => $orders_products['products_id'], 'opid' => $orders_products['orders_products_id'], 'model' => $orders_products['products_model'], 'tax' => $orders_products['products_tax'], 'price' => $orders_products['products_price'], 'discount' => $orders_products['products_discount_made'], 'final_price' => $orders_products['final_price'], 'allow_tax' => $orders_products['allow_tax']);
         $subindex = 0;
         $attributes_query = vam_db_query("select products_options, products_options_values, options_values_price, price_prefix from " . TABLE_ORDERS_PRODUCTS_ATTRIBUTES . " where orders_id = '" . vam_db_input($order_id) . "' and orders_products_id = '" . $orders_products['orders_products_id'] . "'");
         if (vam_db_num_rows($attributes_query)) {
             while ($attributes = vam_db_fetch_array($attributes_query)) {
                 $this->products[$index]['attributes'][$subindex] = array('option' => $attributes['products_options'], 'value' => $attributes['products_options_values'], 'prefix' => $attributes['price_prefix'], 'price' => $attributes['options_values_price']);
                 $subindex++;
             }
         }
         $index++;
     }
 }

function vam_get_categories($categories_array = '', $parent_id = '0', $indent = '')
{
    $parent_id = vam_db_prepare_input($parent_id);
    if (!is_array($categories_array)) {
        $categories_array = array();
    }
    $categories_query = "select\n                                      c.categories_id,\n                                      cd.categories_name\n                                      from " . TABLE_CATEGORIES . " c,\n                                       " . TABLE_CATEGORIES_DESCRIPTION . " cd\n                                       where parent_id = '" . vam_db_input($parent_id) . "'\n                                       and c.categories_id = cd.categories_id\n                                       and c.categories_status != 0\n                                       and cd.language_id = '" . $_SESSION['languages_id'] . "'\n                                       order by sort_order, cd.categories_name";
    $categories_query = vamDBquery($categories_query);
    while ($categories = vam_db_fetch_array($categories_query, true)) {
        $categories_array[] = array('id' => $categories['categories_id'], 'text' => $indent . $categories['categories_name']);
        if ($categories['categories_id'] != $parent_id) {
            $categories_array = vam_get_categories($categories_array, $categories['categories_id'], $indent . '  ');
        }
    }
    return $categories_array;
}

function vam_db_perform($table, $data, $action = 'insert', $parameters = '', $link = 'db_link')
{
    reset($data);
    if ($action == 'insert') {
        $query = 'insert into ' . $table . ' (';
        while (list($columns, ) = each($data)) {
            $query .= $columns . ', ';
        }
        $query = substr($query, 0, -2) . ') values (';
        reset($data);
        while (list(, $value) = each($data)) {
            $value = is_Float($value) & PHP4_3_10 ? sprintf("%.F", $value) : (string) $value;
            switch ($value) {
                case 'now()':
                    $query .= 'now(), ';
                    break;
                case 'null':
                    $query .= 'null, ';
                    break;
                default:
                    $query .= '\'' . vam_db_input($value) . '\', ';
                    break;
            }
        }
        $query = substr($query, 0, -2) . ')';
    } elseif ($action == 'update') {
        $query = 'update ' . $table . ' set ';
        while (list($columns, $value) = each($data)) {
            $value = is_Float($value) & PHP4_3_10 ? sprintf("%.F", $value) : (string) $value;
            switch ($value) {
                case 'now()':
                    $query .= $columns . ' = now(), ';
                    break;
                case 'null':
                    $query .= $columns .= ' = null, ';
                    break;
                default:
                    $query .= $columns . ' = \'' . vam_db_input($value) . '\', ';
                    break;
            }
        }
        $query = substr($query, 0, -2) . ' where ' . $parameters;
    }
    return vam_db_query($query, $link);
}

function vam_address_summary($customers_id, $address_id)
{
    $customers_id = vam_db_prepare_input($customers_id);
    $address_id = vam_db_prepare_input($address_id);
    $address_query = vam_db_query("select ab.entry_street_address, ab.entry_suburb, ab.entry_postcode, ab.entry_city, ab.entry_state, ab.entry_country_id, ab.entry_zone_id, c.countries_name, c.address_format_id from " . TABLE_ADDRESS_BOOK . " ab, " . TABLE_COUNTRIES . " c where ab.address_book_id = '" . vam_db_input($address_id) . "' and ab.customers_id = '" . vam_db_input($customers_id) . "' and ab.entry_country_id = c.countries_id");
    $address = vam_db_fetch_array($address_query);
    $street_address = $address['entry_street_address'];
    $suburb = $address['entry_suburb'];
    $postcode = $address['entry_postcode'];
    $city = $address['entry_city'];
    $state = vam_get_zone_name($address['entry_country_id'], $address['entry_zone_id'], $address['entry_state']);
    $country = $address['countries_name'];
    $address_format_query = vam_db_query("select address_summary from " . TABLE_ADDRESS_FORMAT . " where address_format_id = '" . $address['address_format_id'] . "'");
    $address_format = vam_db_fetch_array($address_format_query);
    //    eval("\$address = \"{$address_format['address_summary']}\";");
    $address_summary = $address_format['address_summary'];
    eval("\$address = \"{$address_summary}\";");
    return $address;
}

 function splitPageResults($query, $page, $max_rows, $count_key = '*')
 {
     $this->sql_query = $query;
     if (empty($page) || is_numeric($page) == false) {
         $page = 1;
     }
     $this->current_page_number = $page;
     $this->number_of_rows_per_page = $max_rows;
     $pos_to = strlen($this->sql_query);
     $pos_from = strpos($this->sql_query, ' FROM', 0);
     $pos_group_by = strpos($this->sql_query, ' GROUP BY', $pos_from);
     if ($pos_group_by < $pos_to && $pos_group_by != false) {
         $pos_to = $pos_group_by;
     }
     $pos_having = strpos($this->sql_query, ' HAVING', $pos_from);
     if ($pos_having < $pos_to && $pos_having != false) {
         $pos_to = $pos_having;
     }
     $pos_order_by = strpos($this->sql_query, ' ORDER BY', $pos_from);
     if ($pos_order_by < $pos_to && $pos_order_by != false) {
         $pos_to = $pos_order_by;
     }
     if (strpos($this->sql_query, 'DISTINCT') || strpos($this->sql_query, 'GROUP BY')) {
         $count_string = 'DISTINCT ' . vam_db_input($count_key);
         //$count_string = vam_db_input($count_key);
     } else {
         $count_string = vam_db_input($count_key);
     }
     $count_query = vamDBquery($query);
     $count = vam_db_num_rows($count_query, true);
     $this->number_of_rows = $count;
     $this->number_of_pages = ceil($this->number_of_rows / $this->number_of_rows_per_page);
     if ($this->current_page_number > $this->number_of_pages) {
         $this->current_page_number = $this->number_of_pages;
     }
     $offset = $this->number_of_rows_per_page * ($this->current_page_number - 1);
     $this->sql_query .= " LIMIT " . max($offset, 0) . ", " . $this->number_of_rows_per_page;
 }

 function query($order_id)
 {
     $order_id = vam_db_prepare_input($order_id);
     $order_query = vam_db_query("SELECT\n                                   *\n                                   FROM " . TABLE_ORDERS . " WHERE\n                                   orders_id = '" . vam_db_input($order_id) . "'");
     $order = vam_db_fetch_array($order_query);
     $totals_query = vam_db_query("SELECT * FROM " . TABLE_ORDERS_TOTAL . " where orders_id = '" . vam_db_input($order_id) . "' order by sort_order");
     while ($totals = vam_db_fetch_array($totals_query)) {
         $this->totals[] = array('title' => $totals['title'], 'text' => $totals['text'], 'value' => $totals['value']);
     }
     $order_total_query = vam_db_query("select text,value from " . TABLE_ORDERS_TOTAL . " where orders_id = '" . $order_id . "' and class = 'ot_total'");
     $order_total = vam_db_fetch_array($order_total_query);
     $shipping_method_query = vam_db_query("select title from " . TABLE_ORDERS_TOTAL . " where orders_id = '" . $order_id . "' and class = 'ot_shipping'");
     $shipping_method = vam_db_fetch_array($shipping_method_query);
     $order_status_query = vam_db_query("select orders_status_name from " . TABLE_ORDERS_STATUS . " where orders_status_id = '" . $order['orders_status'] . "' and language_id = '" . $_SESSION['languages_id'] . "'");
     $order_status = vam_db_fetch_array($order_status_query);
     $this->info = array('currency' => $order['currency'], 'currency_value' => $order['currency_value'], 'payment_method' => $order['payment_method'], 'cc_type' => $order['cc_type'], 'cc_owner' => $order['cc_owner'], 'cc_number' => $order['cc_number'], 'cc_expires' => $order['cc_expires'], 'cc_start' => $order['cc_start'], 'cc_issue' => $order['cc_issue'], 'cc_cvv' => $order['cc_cvv'], 'date_purchased' => $order['date_purchased'], 'orders_status' => $order_status['orders_status_name'], 'last_modified' => $order['last_modified'], 'total' => strip_tags($order_total['text']), 'total_value' => $order_total['value'], 'shipping_method' => substr($shipping_method['title'], -1) == ':' ? substr(strip_tags($shipping_method['title']), 0, -1) : strip_tags($shipping_method['title']), 'comments' => $order['comments']);
     $this->customer = array('id' => $order['customers_id'], 'name' => $order['customers_name'], 'firstname' => $order['customers_firstname'], 'secondname' => $order['customers_secondname'], 'lastname' => $order['customers_lastname'], 'csID' => $order['customers_cid'], 'company' => $order['customers_company'], 'street_address' => $order['customers_street_address'], 'suburb' => $order['customers_suburb'], 'city' => $order['customers_city'], 'postcode' => $order['customers_postcode'], 'state' => $order['customers_state'], 'country' => $order['customers_country'], 'format_id' => $order['customers_address_format_id'], 'telephone' => $order['customers_telephone'], 'email_address' => $order['customers_email_address']);
     $this->delivery = array('name' => $order['delivery_name'], 'firstname' => $order['delivery_firstname'], 'secondname' => $order['delivery_secondname'], 'lastname' => $order['delivery_lastname'], 'company' => $order['delivery_company'], 'street_address' => $order['delivery_street_address'], 'suburb' => $order['delivery_suburb'], 'city' => $order['delivery_city'], 'postcode' => $order['delivery_postcode'], 'state' => $order['delivery_state'], 'country' => $order['delivery_country'], 'format_id' => $order['delivery_address_format_id']);
     if (empty($this->delivery['name']) && empty($this->delivery['street_address'])) {
         $this->delivery = false;
     }
     $this->billing = array('name' => $order['billing_name'], 'firstname' => $order['billing_firstname'], 'secondname' => $order['billing_secondname'], 'lastname' => $order['billing_lastname'], 'company' => $order['billing_company'], 'street_address' => $order['billing_street_address'], 'suburb' => $order['billing_suburb'], 'city' => $order['billing_city'], 'postcode' => $order['billing_postcode'], 'state' => $order['billing_state'], 'country' => $order['billing_country'], 'format_id' => $order['billing_address_format_id']);
     $index = 0;
     $orders_products_query = vam_db_query("SELECT * FROM " . TABLE_ORDERS_PRODUCTS . "   WHERE orders_id = '" . vam_db_input($order_id) . "'");
     while ($orders_products = vam_db_fetch_array($orders_products_query)) {
         $this->products[$index] = array('qty' => $orders_products['products_quantity'], 'id' => $orders_products['products_id'], 'name' => $orders_products['products_name'], 'model' => $orders_products['products_model'], 'tax' => $orders_products['products_tax'], 'price' => $orders_products['products_price'], 'shipping_time' => $orders_products['products_shipping_time'], 'final_price' => $orders_products['final_price']);
         $subindex = 0;
         $attributes_query = vam_db_query("SELECT * FROM " . TABLE_ORDERS_PRODUCTS_ATTRIBUTES . " where orders_id = '" . vam_db_input($order_id) . "' and orders_products_id = '" . $orders_products['orders_products_id'] . "'");
         if (vam_db_num_rows($attributes_query)) {
             while ($attributes = vam_db_fetch_array($attributes_query)) {
                 $this->products[$index]['attributes'][$subindex] = array('option' => $attributes['products_options'], 'value' => $attributes['products_options_values'], 'prefix' => $attributes['price_prefix'], 'price' => $attributes['options_values_price']);
                 $subindex++;
             }
         }
         $this->info['tax_groups']["{$this->products[$index]['tax']}"] = '1';
         $index++;
     }
 }

        $zone_id = 0;
        $check_query = vam_db_query("select count(*) as total from " . TABLE_ZONES . " where zone_country_id = '" . (int) $entry['entry_country_id'] . "'");
        $check = vam_db_fetch_array($check_query);
        $entry_state_has_zones = $check['total'] > 0;
        if ($entry_state_has_zones == true) {
            $zones_array = array();
            $zones_query = vam_db_query("select zone_name from " . TABLE_ZONES . " where zone_country_id = '" . (int) $entry['entry_country_id'] . "' order by zone_name");
            while ($zones_values = vam_db_fetch_array($zones_query)) {
                $zones_array[] = array('id' => $zones_values['zone_name'], 'text' => $zones_values['zone_name']);
            }
            $zone = vam_db_query("select distinct zone_id, zone_name from " . TABLE_ZONES . " where zone_country_id = '" . (int) $entry['entry_country_id'] . "' and zone_code = '" . vam_db_input($state) . "'");
            if (vam_db_num_rows($zone) > 0) {
                $zone_id = $zone['zone_id'];
                $zone_name = $zone['zone_name'];
            } else {
                $zone = vam_db_query("select distinct zone_id, zone_name from " . TABLE_ZONES . " where zone_country_id = '" . (int) $entry['entry_country_id'] . "' and zone_code = '" . vam_db_input($state) . "'");
                if (vam_db_num_rows($zone) > 0) {
                    $zone_id = $zone['zone_id'];
                    $zone_name = $zone['zone_name'];
                }
            }
        }
    }
    if ($entry_state_has_zones == true) {
        $state_input = vam_draw_pull_down_menuNote(array('name' => 'state', 'text' => '&nbsp;' . (vam_not_null(ENTRY_STATE_TEXT) ? '<span class="Requirement">' . ENTRY_STATE_TEXT . '</span>' : '')), $zones_array, vam_get_zone_name($entry['entry_country_id'], $entry['entry_zone_id'], $entry['entry_state']), ' id="state"');
    } else {
        $state_input = vam_draw_input_fieldNote(array('name' => 'state', 'text' => '&nbsp;' . (vam_not_null(ENTRY_STATE_TEXT) ? '<span class="Requirement">' . ENTRY_STATE_TEXT . '</span>' : '')), vam_get_zone_name(STORE_COUNTRY, STORE_ZONE), ' id="state"');
    }
    $module->assign('INPUT_STATE', $state_input);
} else {
    $module->assign('state', '0');

        $geo_zone_description = vam_db_prepare_input($_POST['geo_zone_description']);
        vam_db_query("insert into " . TABLE_GEO_ZONES . " (geo_zone_name, geo_zone_description, date_added) values ('" . vam_db_input($geo_zone_name) . "', '" . vam_db_input($geo_zone_description) . "', now())");
        $new_zone_id = vam_db_insert_id();
        vam_redirect(vam_href_link(FILENAME_GEO_ZONES, 'zpage=' . $_GET['zpage'] . '&zID=' . $new_zone_id));
        break;
    case 'save_zone':
        $zID = vam_db_prepare_input($_GET['zID']);
        $geo_zone_name = vam_db_prepare_input($_POST['geo_zone_name']);
        $geo_zone_description = vam_db_prepare_input($_POST['geo_zone_description']);
        vam_db_query("update " . TABLE_GEO_ZONES . " set geo_zone_name = '" . vam_db_input($geo_zone_name) . "', geo_zone_description = '" . vam_db_input($geo_zone_description) . "', last_modified = now() where geo_zone_id = '" . vam_db_input($zID) . "'");
        vam_redirect(vam_href_link(FILENAME_GEO_ZONES, 'zpage=' . $_GET['zpage'] . '&zID=' . $_GET['zID']));
        break;
    case 'deleteconfirm_zone':
        $zID = vam_db_prepare_input($_GET['zID']);
        vam_db_query("delete from " . TABLE_GEO_ZONES . " where geo_zone_id = '" . vam_db_input($zID) . "'");
        vam_db_query("delete from " . TABLE_ZONES_TO_GEO_ZONES . " where geo_zone_id = '" . vam_db_input($zID) . "'");
        vam_redirect(vam_href_link(FILENAME_GEO_ZONES, 'zpage=' . $_GET['zpage']));
        break;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html <?php 
echo HTML_PARAMS;
?>
>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=<?php 
echo $_SESSION['language_charset'];
?>
"> 
<title><?php 

 function add_cart($products_id, $qty = '1', $attributes = '', $notify = true)
 {
     global $new_products_id_in_cart;
     $products_id = vam_get_uprid($products_id, $attributes);
     if ($notify == true) {
         $_SESSION['new_products_id_in_cart'] = $products_id;
     }
     if ($this->in_cart($products_id)) {
         $this->update_quantity($products_id, $qty, $attributes);
     } else {
         $this->contents[] = array($products_id);
         $this->contents[$products_id] = array('qty' => $qty);
         // insert into database
         if (isset($_SESSION['customer_id'])) {
             vam_db_query("insert into " . TABLE_CUSTOMERS_BASKET . " (customers_id, products_id, customers_basket_quantity, customers_basket_date_added) values ('" . $_SESSION['customer_id'] . "', '" . $products_id . "', '" . $qty . "', '" . date('Ymd') . "')");
         }
         if (is_array($attributes)) {
             reset($attributes);
             while (list($option, $value) = each($attributes)) {
                 $attr_value = NULL;
                 $blank_value = FALSE;
                 if (strstr($option, 'txt_')) {
                     if (trim($value) == NULL) {
                         $blank_value = TRUE;
                     } else {
                         $option_1 = substr($option, strlen('txt_'));
                         $option_2 = preg_split('/_/', $option_1);
                         $option = $option_2[0];
                         $attr_value = htmlspecialchars(stripslashes($value), ENT_QUOTES);
                         $value = $option_2[1];
                         $this->contents[$products_id]['attributes_values'][$option] = $attr_value;
                     }
                 }
                 if (!$blank_value) {
                     $this->contents[$products_id]['attributes'][$option] = $value;
                     // insert into database
                     if (isset($_SESSION['customer_id'])) {
                         vam_db_query("insert into " . TABLE_CUSTOMERS_BASKET_ATTRIBUTES . " (customers_id, products_id, products_options_id, products_options_value_id, products_options_value_text) values ('" . $_SESSION['customer_id'] . "', '" . $products_id . "', '" . $option . "', '" . $value . "', '" . vam_db_input($attr_value) . "')");
                     }
                 }
             }
         }
     }
     $this->cleanup();
     // assign a temporary unique ID to the order contents to prevent hack attempts during the checkout procedure
     $this->cartID = $this->generate_cart_id();
 }

    switch ($_POST['affiliate_email_address']) {
        case '***':
            $mail_query = vam_db_query("select affiliate_firstname, affiliate_lastname, affiliate_email_address from " . TABLE_AFFILIATE . " ");
            $mail_sent_to = TEXT_ALL_AFFILIATES;
            break;
            //      case '**D':
            //        $mail_query = vam_db_query("select affiliate_firstname, affiliate_lastname, affiliate_email_address from " . TABLE_AFFILIATE . " where affiliate_newsletter = '1'");
            //        $mail_sent_to = TEXT_NEWSLETTER_AFFILIATE;
            //        break;
        //      case '**D':
        //        $mail_query = vam_db_query("select affiliate_firstname, affiliate_lastname, affiliate_email_address from " . TABLE_AFFILIATE . " where affiliate_newsletter = '1'");
        //        $mail_sent_to = TEXT_NEWSLETTER_AFFILIATE;
        //        break;
        default:
            $affiliate_email_address = vam_db_prepare_input($_POST['affiliate_email_address']);
            $mail_query = vam_db_query("select affiliate_firstname, affiliate_lastname, affiliate_email_address from " . TABLE_AFFILIATE . " where affiliate_email_address = '" . vam_db_input($affiliate_email_address) . "'");
            $mail_sent_to = $_POST['affiliate_email_address'];
            break;
    }
    $from = vam_db_prepare_input($_POST['from']);
    $subject = vam_db_prepare_input($_POST['subject']);
    $message = vam_db_prepare_input($_POST['message']);
    while ($mail = vam_db_fetch_array($mail_query)) {
        vam_php_mail(EMAIL_SUPPORT_ADDRESS, EMAIL_SUPPORT_NAME, $mail['affiliate_email_address'], $mail['affiliate_firstname'] . ' ' . $mail['affiliate_lastname'], '', EMAIL_SUPPORT_REPLY_ADDRESS, EMAIL_SUPPORT_REPLY_ADDRESS_NAME, '', '', $subject, $message, $message);
    }
    vam_redirect(vam_href_link(FILENAME_AFFILIATE_CONTACT, 'mail_sent_to=' . urlencode($mail_sent_to)));
}
if ($_GET['action'] == 'preview' && !$_POST['affiliate_email_address']) {
    $messageStack->add(ERROR_NO_AFFILIATE_SELECTED, 'error');
}
if (vam_not_null($_GET['mail_sent_to'])) {

        if ($shipping_status_image =& vam_try_upload('shipping_status_image', DIR_WS_ICONS)) {
            vam_db_query("update " . TABLE_SHIPPING_STATUS . " set shipping_status_image = '" . $shipping_status_image->filename . "' where shipping_status_id = '" . vam_db_input($shipping_status_id) . "'");
        }
        if ($_POST['default'] == 'on') {
            vam_db_query("update " . TABLE_CONFIGURATION . " set configuration_value = '" . vam_db_input($shipping_status_id) . "' where configuration_key = 'DEFAULT_SHIPPING_STATUS_ID'");
        }
        vam_redirect(vam_href_link(FILENAME_SHIPPING_STATUS, 'page=' . $_GET['page'] . '&oID=' . $shipping_status_id));
        break;
    case 'deleteconfirm':
        $oID = vam_db_prepare_input($_GET['oID']);
        $shipping_status_query = vam_db_query("select configuration_value from " . TABLE_CONFIGURATION . " where configuration_key = 'DEFAULT_SHIPPING_STATUS_ID'");
        $shipping_status = vam_db_fetch_array($shipping_status_query);
        if ($shipping_status['configuration_value'] == $oID) {
            vam_db_query("update " . TABLE_CONFIGURATION . " set configuration_value = '' where configuration_key = 'DEFAULT_SHIPPING_STATUS_ID'");
        }
        vam_db_query("delete from " . TABLE_SHIPPING_STATUS . " where shipping_status_id = '" . vam_db_input($oID) . "'");
        vam_redirect(vam_href_link(FILENAME_SHIPPING_STATUS, 'page=' . $_GET['page']));
        break;
    case 'delete':
        $oID = vam_db_prepare_input($_GET['oID']);
        $remove_status = true;
        if ($oID == DEFAULT_SHIPPING_STATUS_ID) {
            $remove_status = false;
            $messageStack->add(ERROR_REMOVE_DEFAULT_SHIPPING_STATUS, 'error');
        } else {
        }
        break;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html <?php 

require_once DIR_FS_INC . 'vam_php_mail.inc.php';
// initiate template engine for mail
$vamTemplate = new vamTemplate();
if ($_GET['action'] == 'send_email_to_user' && ($_POST['customers_email_address'] || $_POST['email_to']) && !$_POST['back_x']) {
    switch ($_POST['customers_email_address']) {
        case '***':
            $mail_query = vam_db_query("select customers_firstname, customers_lastname, customers_email_address from " . TABLE_CUSTOMERS);
            $mail_sent_to = TEXT_ALL_CUSTOMERS;
            break;
        case '**D':
            $mail_query = vam_db_query("select customers_firstname, customers_lastname, customers_email_address from " . TABLE_CUSTOMERS . " where customers_newsletter = '1'");
            $mail_sent_to = TEXT_NEWSLETTER_CUSTOMERS;
            break;
        default:
            $customers_email_address = vam_db_prepare_input($_POST['customers_email_address']);
            $mail_query = vam_db_query("select customers_firstname, customers_lastname, customers_email_address from " . TABLE_CUSTOMERS . " where customers_email_address = '" . vam_db_input($customers_email_address) . "'");
            $mail_sent_to = $_POST['customers_email_address'];
            if ($_POST['email_to']) {
                $mail_sent_to = $_POST['email_to'];
            }
            break;
    }
    $from = vam_db_prepare_input($_POST['from']);
    $subject = vam_db_prepare_input($_POST['subject']);
    while ($mail = vam_db_fetch_array($mail_query)) {
        $id1 = create_coupon_code($mail['customers_email_address']);
        // assign language to template for caching
        $vamTemplate->assign('language', $_SESSION['language']);
        $vamTemplate->caching = false;
        $vamTemplate->assign('tpl_path', 'templates/' . CURRENT_TEMPLATE . '/');
        $vamTemplate->assign('logo_path', HTTP_SERVER . DIR_WS_CATALOG . 'templates/' . CURRENT_TEMPLATE . '/img/');

    }
    ?>
                <td class="dataTableHeadingContent" align="right"><?php 
    echo TABLE_HEADING_ACTION;
    ?>
&nbsp;</td>
              </tr>
<?php 
    if ($_GET['cID']) {
        $cID = vam_db_prepare_input($_GET['cID']);
        $orders_query_raw = "select o.orders_id, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.customers_id, o.payment_method, o.shipping_method, o.shipping_class, o.date_purchased, o.last_modified, o.currency, o.currency_value, o.orders_status, s.orders_status_name, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id), " . TABLE_ORDERS_STATUS . " s where o.customers_id = '" . vam_db_input($cID) . "' and (o.orders_status = s.orders_status_id and s.language_id = '" . $_SESSION['languages_id'] . "' and ot.class = 'ot_total') or (o.orders_status = '0' and ot.class = 'ot_total' and  s.orders_status_id = '1' and s.language_id = '" . $_SESSION['languages_id'] . "') order by orders_id DESC";
    } elseif ($_GET['status'] == '0') {
        $orders_query_raw = "select o.orders_id, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.payment_method, o.shipping_method, o.shipping_class, o.date_purchased, o.last_modified, o.currency, o.currency_value, o.orders_status, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id) where o.orders_status = '0' and ot.class = 'ot_total' order by o.orders_id DESC";
    } elseif ($_GET['status']) {
        $status = vam_db_prepare_input($_GET['status']);
        $orders_query_raw = "select o.orders_id, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.payment_method, o.shipping_method, o.shipping_class, o.date_purchased, o.last_modified, o.currency, o.currency_value, s.orders_status_name, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id), " . TABLE_ORDERS_STATUS . " s where o.orders_status = s.orders_status_id and s.language_id = '" . $_SESSION['languages_id'] . "' and s.orders_status_id = '" . vam_db_input($status) . "' and ot.class = 'ot_total' order by o.orders_id DESC";
    } else {
        $orders_query_raw = "select o.orders_id, o.orders_status, o.afterbuy_success, o.afterbuy_id, o.customers_name, o.payment_method, o.shipping_method, o.shipping_class, o.date_purchased, o.last_modified, o.currency, o.currency_value, s.orders_status_name, ot.text as order_total from " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id), " . TABLE_ORDERS_STATUS . " s where (o.orders_status = s.orders_status_id and s.language_id = '" . $_SESSION['languages_id'] . "' and ot.class = 'ot_total') or (o.orders_status = '0' and ot.class = 'ot_total' and  s.orders_status_id = '1' and s.language_id = '" . $_SESSION['languages_id'] . "') order by o.orders_id DESC";
    }
    $orders_split = new splitPageResults($_GET['page'], MAX_DISPLAY_ADMIN_PAGE, $orders_query_raw, $orders_query_numrows);
    $orders_query = vam_db_query($orders_query_raw);
    while ($orders = vam_db_fetch_array($orders_query)) {
        if ((!$_GET['oID'] || $_GET['oID'] == $orders['orders_id']) && !$oInfo) {
            $oInfo = new objectInfo($orders);
        }
        if (is_object($oInfo) && $orders['orders_id'] == $oInfo->orders_id) {
            echo '<tr class="dataTableRowSelected" onmouseover="this.style.cursor=\'hand\'">' . "\n";
        } else {
            echo '<tr class="dataTableRow" onmouseover="this.className=\'dataTableRowOver\';this.style.cursor=\'hand\'" onmouseout="this.className=\'dataTableRow\'">' . "\n";
        }
        ?>

 }
 if (ACCOUNT_CITY == 'true') {
     if (strlen($city) < ENTRY_CITY_MIN_LENGTH) {
         $error = true;
         $messageStack->add('checkout_address', ENTRY_CITY_ERROR);
     }
 }
 if (ACCOUNT_STATE == 'true') {
     $zone_id = 0;
     $check_query = vam_db_query("select count(*) as total from " . TABLE_ZONES . " where zone_country_id = '" . (int) $country . "'");
     $check = vam_db_fetch_array($check_query);
     $entry_state_has_zones = $check['total'] > 0;
     if ($entry_state_has_zones == true) {
         $zone_query = vam_db_query("select distinct zone_id from " . TABLE_ZONES . " where zone_country_id = '" . (int) $country . "' and (zone_name like '" . vam_db_input($state) . "%' or zone_code like '%" . vam_db_input($state) . "%')");
         if (vam_db_num_rows($zone_query) > 1) {
             $zone_query = vam_db_query("select distinct zone_id from " . TABLE_ZONES . " where zone_country_id = '" . (int) $country . "' and zone_name = '" . vam_db_input($state) . "'");
         }
         if (vam_db_num_rows($zone_query) >= 1) {
             $zone = vam_db_fetch_array($zone_query);
             $zone_id = $zone['zone_id'];
         } else {
             $error = true;
             $messageStack->add('create_account', ENTRY_STATE_ERROR_SELECT);
         }
     } else {
         if (strlen($state) < ENTRY_STATE_MIN_LENGTH) {
             $error = true;
             $messageStack->add('checkout_address', ENTRY_STATE_ERROR);
         }
     }
 }

         $vamTemplate->assign('tpl_path', 'templates/' . CURRENT_TEMPLATE . '/');
         $vamTemplate->assign('logo_path', HTTP_SERVER . DIR_WS_CATALOG . 'templates/' . CURRENT_TEMPLATE . '/img/');
         $vamTemplate->assign('NAME', $check_status['customers_name']);
         $vamTemplate->assign('ORDER_NR', $_GET['oID']);
         $vamTemplate->assign('ORDER_LINK', vam_catalog_href_link(FILENAME_CATALOG_ACCOUNT_HISTORY_INFO, 'order_id=' . $oID, 'SSL'));
         $vamTemplate->assign('ORDER_DATE', vam_date_long($check_status['date_purchased']));
         $vamTemplate->assign('NOTIFY_COMMENTS', ' ' . $notify_comments);
         $vamTemplate->assign('ORDER_STATUS', $orders_status_array[$_GET['status']]);
         $html_mail = $vamTemplate->fetch(CURRENT_TEMPLATE . '/admin/mail/' . $_SESSION['language'] . '/change_order_mail.html');
         $txt_mail = $vamTemplate->fetch(CURRENT_TEMPLATE . '/admin/mail/' . $_SESSION['language'] . '/change_order_mail.txt');
         // create subject
         $billing_subject = str_replace('{$nr}', $oID, EMAIL_BILLING_SUBJECT);
         vam_php_mail(EMAIL_BILLING_ADDRESS, EMAIL_BILLING_NAME, $check_status['customers_email_address'], $check_status['customers_name'], '', EMAIL_BILLING_REPLY_ADDRESS, EMAIL_BILLING_REPLY_ADDRESS_NAME, '', '', $billing_subject, $html_mail, $txt_mail);
         $customer_notified = '1';
     }
     vam_db_query("INSERT into " . TABLE_ORDERS_STATUS_HISTORY . " \n\t\t\t(orders_id, orders_status_id, date_added, customer_notified, comments) \n\t\t\tvalues ('" . vam_db_input($_GET['oID']) . "', \n\t\t\t\t'" . vam_db_input($_POST['status']) . "', \n\t\t\t\tnow(), \n\t\t\t\t" . vam_db_input($customer_notified) . ", \n\t\t\t\t'" . vam_db_input(vam_db_prepare_input($_POST['comments'])) . "')");
 }
 // Update Products
 if (is_array($_POST['update_products'])) {
     foreach ($_POST['update_products'] as $orders_products_id => $products_details) {
         //  Update Inventory Quantity
         $order_query = vam_db_query("\n\t\t\tSELECT products_id, products_quantity \n\t\t\tFROM " . TABLE_ORDERS_PRODUCTS . " \n\t\t\tWHERE orders_id = '" . (int) $oID . "'\n\t\t\tAND orders_products_id = '" . (int) $orders_products_id . "'");
         $order_products = vam_db_fetch_array($order_query);
         // First we do a stock check
         if ($products_details['qty'] != $order_products['products_quantity']) {
             $quantity_difference = $products_details['qty'] - $order['products_quantity'];
             if (STOCK_LIMITED == 'true') {
                 vam_db_query("UPDATE " . TABLE_PRODUCTS . " SET \n\t\t\t\t\tproducts_quantity = products_quantity - " . $quantity_difference . ",\n\t\t\t\t\tproducts_ordered = products_ordered + " . $quantity_difference . " \n\t\t\t\t\tWHERE products_id = '" . (int) $order_products['products_id'] . "'");
             } else {
                 vam_db_query("UPDATE " . TABLE_PRODUCTS . " SET\n\t\t\t\t\tproducts_ordered = products_ordered + " . $quantity_difference . "\n\t\t\t\t\tWHERE products_id = '" . (int) $order_products['products_id'] . "'");
             }