MINI Sh3ll

<?php
class order {
	private $objdb;

	public function __construct(){

		$this->objdb=new database;
		return true;
	}

    public function addUserOrder($order = [])
    {
        $sql = "insert into orders(order_id, user_id, total_amount, order_items) values(
            '".mysql_escape($this->objdb->connection, $order['order_id'])."', 
            '".mysql_escape($this->objdb->connection, $order['user_id'])."', 
            '".mysql_escape($this->objdb->connection, $order['total_amount'])."', 
            '".mysql_escape($this->objdb->connection, $order['order_items'])."'
        )";
        //print $sql;
        $result = $this->objdb->saveRecords($sql);
        return $result;
    }

    public function addOrderItem($order_item = [])
    {
        $sql = "insert into order_items(order_id, user_id, product_code, cost, quantity, amount) values(
            '".mysql_escape($this->objdb->connection, $order_item['order_id'])."', 
            '".mysql_escape($this->objdb->connection, $order_item['user_id'])."', 
            '".mysql_escape($this->objdb->connection, $order_item['product_code'])."', 
            '".mysql_escape($this->objdb->connection, $order_item['cost'])."', 
            '".mysql_escape($this->objdb->connection, $order_item['quantity'])."', 
            '".mysql_escape($this->objdb->connection, $order_item['amount'])."'
        )";
        //print $sql;
        $result = $this->objdb->saveRecords($sql);
        return $result;
    }

    public function getOrders($status = '0,1,2', $user_id = '') {        

        $sql = "SELECT o.*, case o.status when 0 then 'Pending' when 1 then 'Processed' when 2 then 'Cancelled' END order_status,
            concat(u.`name`, '(', u.mobileno,')') username FROM orders o LEFT JOIN users u ON o.user_id = u.id
            WHERE o.status IN (".$status.") ";

            if($user_id != ""){
                $sql .= " and o.user_id = '".$user_id."'";
            }
            
            $sql .= " ORDER BY o.id DESC;";        
        
        $result = $this->objdb->get_records($sql);

        if($result == false)
            return false;
        else 
            return $result;        
    }

    public function getOrderItems($order_id) {        

        $sql = "SELECT o.product_code, p.`description`, p.cost, o.quantity, o.amount FROM order_items o LEFT JOIN products p ON o.product_code = p.`code`
        WHERE o.order_id = '".mysql_escape($this->objdb->connection, $order_id)."';";        
        
        $result = $this->objdb->get_records($sql);

        if($result == false)
            return false;
        else 
            return $result;        
    }     


    public function updateOrderStatus($order)
    {
        $sql = "update orders SET status = ".$order['status'].", processed_by = '".$order['processed_by']."', processed_on = now() WHERE order_id = '".$order['order_id']."'";

        $result = $this->objdb->saveRecords($sql);
        return $result;
    }

    public function exportOrders() {

        $sql = "SELECT oi.id, u.`name`, u.mobileno, u.`zone`, u.cluster, u.tty, o.order_id, o.total_amount order_amount, oi.product_code, p.`description`, p.`type`, oi.cost, oi.quantity, oi.amount, 
            o.created ordered_on, o.processed_on, case o.`status` when 0 then 'Pending' when 1 then 'Processed' when 2 then 'Cancelled' END order_status  
            FROM order_items oi 
            LEFT JOIN products p ON oi.product_code = p.`code`
            LEFT JOIN orders o ON oi.order_id = o.order_id
            LEFT JOIN users u ON o.user_id = u.id
            ORDER BY oi.id DESC;";            
        
        $result = $this->objdb->get_records($sql);

        if($result == false)
            return false;
        else 
            return $result;        
    }    
}
?>