diff --git a/htdocs/admin/subjects.php b/htdocs/admin/subjects.php index 22e4b68..b2e4205 100644 --- a/htdocs/admin/subjects.php +++ b/htdocs/admin/subjects.php @@ -3,20 +3,47 @@ session_start(); if (!isset($_SESSION['admin'])) { header("Location: login.php"); exit; } include("../lib/db.php"); -if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['name'])) { +// FIX: Usa prepared statements per sicurezza +if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['name']) && !isset($_POST['update'])) { $name = $_POST['name']; $teacher = $_POST['teacher']; $room = $_POST['room']; - if (!empty($name)) { - $conn->query("INSERT INTO subjects (name,teacher,room) VALUES ('$name','$teacher','$room')"); + + if (!empty($name)) { + $stmt = $conn->prepare("INSERT INTO subjects (name, teacher, room) VALUES (?, ?, ?)"); + $stmt->bind_param("sss", $name, $teacher, $room); + $stmt->execute(); + $stmt->close(); } - header("Location: subjects.php"); exit; + header("Location: subjects.php"); + exit; } +// FIX: Aggiunto redirect dopo update +if(isset($_POST['update'])){ + $id = intval($_POST['id']); + $name = $_POST['name']; + $teacher = $_POST['teacher']; + $room = $_POST['room']; + + $stmt = $conn->prepare("UPDATE subjects SET name=?, teacher=?, room=? WHERE id=?"); + $stmt->bind_param("sssi", $name, $teacher, $room, $id); + $stmt->execute(); + $stmt->close(); + + header("Location: subjects.php"); + exit; +} + +// FIX: Usa prepared statement anche per delete if (isset($_GET['delete'])) { $id = intval($_GET['delete']); - $conn->query("DELETE FROM subjects WHERE id=$id"); - header("Location: subjects.php"); exit; + $stmt = $conn->prepare("DELETE FROM subjects WHERE id=?"); + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt->close(); + header("Location: subjects.php"); + exit; } ?> @@ -41,50 +68,50 @@ if (isset($_GET['delete'])) {

Gestisci Materie

⬅ Torna al Dashboard + prepare("SELECT * FROM subjects WHERE id=?"); + $stmt->bind_param("i", $id); + $stmt->execute(); + $res = $stmt->get_result(); + + if($res->num_rows > 0){ + $subject = $res->fetch_assoc(); + ?> +

Modifica materia

+
+ + + +
+ + +
+ + +
+ + + Annulla +
+
+ close(); + } + ?> + +

Aggiungi Nuova Materia

- real_escape_string($_POST['name']); - $teacher = $conn->real_escape_string($_POST['teacher']); - $room = $conn->real_escape_string($_POST['room']); - $conn->query("UPDATE subjects - SET name='$name', teacher='$teacher', room='$room' - WHERE id=$id"); -} -// 2. Mostrare il form se edit richiesto -if(isset($_GET['edit'])){ - $id = intval($_GET['edit']); - $res = $conn->query("SELECT * FROM subjects WHERE id=$id"); - if($res->num_rows > 0){ - $subject = $res->fetch_assoc(); - ?> -

Modifica materia

-
- - - -
- - -
- - -
- - -
- +

Elenco Materie

@@ -98,12 +125,12 @@ if(isset($_GET['edit'])){ while($row=$res->fetch_assoc()){ echo " - - - + + + "; } diff --git a/htdocs/docenti.php b/htdocs/docenti.php index a6d4cd3..55c62df 100644 --- a/htdocs/docenti.php +++ b/htdocs/docenti.php @@ -1,6 +1,5 @@ "Prima ora
7:50 - 8:50", @@ -10,16 +9,19 @@ $hours = [ 5 => "Quinta ora
11:55 - 12:50", 6 => "Sesta ora
12:50 - 13:50" ]; -if ($teacher == "No Lezione" || $teacher == "sconosciuto") { - header("Location: index.php"); - exit; -} -else if (!isset($_GET['teacher'])) { + +if (!isset($_GET['teacher'])) { header("Location: index.php"); exit; } $teacher = $conn->real_escape_string($_GET['teacher']); + +if ($teacher == "No Lezione" || $teacher == "sconosciuto") { + header("Location: index.php"); + exit; +} + $res = $conn->query("SELECT DISTINCT teacher FROM subjects WHERE teacher = '$teacher' LIMIT 1"); if ($res->num_rows === 0) { @@ -42,8 +44,11 @@ if ($res->num_rows === 0) { Home +

Orario docente

-
ID
{$row['id']}{$row['name']}{$row['teacher']}{$row['room']}" . htmlspecialchars($row['name']) . "" . htmlspecialchars($row['teacher']) . "" . htmlspecialchars($row['room']) . " Modifica | - Elimina + Elimina
+ + +
$d"; ?> @@ -59,10 +64,12 @@ if ($res->num_rows === 0) { WHERE subjects.teacher='$teacher' AND timetable.day='$d' AND timetable.hour=$hnum"); if($row = $q->fetch_assoc()){ echo ""; +
" . htmlspecialchars($row['name']) . "
+
" . htmlspecialchars($row['class_name']) . "
"; + if(!empty($row['room'])) { + echo "
" . htmlspecialchars($row['room']) . "
"; + } + echo ""; } else { echo ""; } @@ -71,6 +78,41 @@ if ($res->num_rows === 0) { } ?>
-
{$row['name']}
-
{$row['class_name']}
-
{$row['room']}
-
+ + +
+ +
+

+ $hlabel): + $q = $conn->query("SELECT subjects.name, classes.name AS class_name, subjects.room + FROM timetable + LEFT JOIN subjects ON timetable.subject_id = subjects.id + LEFT JOIN classes ON timetable.class_id = classes.id + WHERE subjects.teacher='$teacher' AND timetable.day='$d' AND timetable.hour=$hnum"); + + if($row = $q->fetch_assoc()): + ?> +
+
+
+
+ +
+ +
+ +
+
+
—
+
+ + +
+ +
+

Copyright (C) 2025 EmmeV. - Released under GNU AGPL 3.0 License.

diff --git a/htdocs/laboratori.php b/htdocs/laboratori.php index f7f3232..9596617 100644 --- a/htdocs/laboratori.php +++ b/htdocs/laboratori.php @@ -1,6 +1,5 @@ "Prima ora
7:50 - 8:50", @@ -10,6 +9,7 @@ $hours = [ 5 => "Quinta ora
11:55 - 12:50", 6 => "Sesta ora
12:50 - 13:50" ]; + if (!isset($_GET['room'])) { header("Location: index.php"); exit; @@ -19,7 +19,6 @@ $room = $conn->real_escape_string($_GET['room']); $res = $conn->query("SELECT DISTINCT room FROM subjects WHERE room = '$room' LIMIT 1"); if ($res->num_rows === 0) { - // Aula non trovata header("Location: index.php"); exit; } @@ -42,7 +41,8 @@ if ($res->num_rows === 0) {

Orario

- + +
$d"; ?> @@ -66,15 +66,13 @@ if ($res->num_rows === 0) { $entries = []; while($row = $q->fetch_assoc()){ - // salvo materia (prendo la prima, di solito è la stessa per tutti) if($subject === null) { $subject = $row['subject_name']; } - // accumulo classi + docente $entries[] = $row['class_name'] . " (" . $row['teacher'] . ")"; } - // unisci le classi con " e " se sono 2, altrimenti virgole + "e" finale + // FIX: Gestione corretta di multiple classi if(count($entries) > 1){ $last = array_pop($entries); $entries_list = implode(", ", $entries) . " e " . $last; @@ -83,8 +81,8 @@ if ($res->num_rows === 0) { } echo ""; } else { echo ""; @@ -94,6 +92,57 @@ if ($res->num_rows === 0) { } ?>
-
$subject
-
$entries_list
+
" . htmlspecialchars($subject) . "
+
" . htmlspecialchars($entries_list) . "
-

Copyright (C) 2025 EmmeV. All rights reserved.

+ + +
+ +
+

+ $hlabel): + $q = $conn->query(" + SELECT subjects.name AS subject_name, subjects.teacher, classes.name AS class_name + FROM timetable + LEFT JOIN subjects ON timetable.subject_id = subjects.id + LEFT JOIN classes ON timetable.class_id = classes.id + WHERE subjects.room='". $conn->real_escape_string($room) ."' + AND timetable.day='$d' AND timetable.hour=$hnum + "); + + if($q->num_rows > 0): + $subject = null; + $entries = []; + + while($row = $q->fetch_assoc()){ + if($subject === null) { + $subject = $row['subject_name']; + } + $entries[] = $row['class_name'] . " (" . $row['teacher'] . ")"; + } + + if(count($entries) > 1){ + $last = array_pop($entries); + $entries_list = implode(", ", $entries) . " e " . $last; + } else { + $entries_list = $entries[0]; + } + ?> +
+
+
+
+
+ +
+
+
—
+
+ + +
+ +
+ +

Copyright (C) 2025 EmmeV. - Released under GNU AGPL 3.0 License.

diff --git a/htdocs/studenti.php b/htdocs/studenti.php index 4f46db7..6ed50cf 100644 --- a/htdocs/studenti.php +++ b/htdocs/studenti.php @@ -1,5 +1,5 @@ query("SELECT * FROM classes WHERE id=$class_id")->fetch_assoc(); $days = ["Lunedì","Martedì","Mercoledì","Giovedì","Venerdì","Sabato"]; @@ -11,16 +11,17 @@ $hours = [ 5 => "Quinta ora
11:55 - 12:50", 6 => "Sesta ora
12:50 - 13:50" ]; + +// FIX: Validazione classe prima di tutto if (!isset($_GET['class_id'])) { header("Location: index.php"); exit; } -$class_id = intval($_GET['class_id']); // sicurezza +$class_id = intval($_GET['class_id']); $res = $conn->query("SELECT id FROM classes WHERE id = $class_id LIMIT 1"); if ($res->num_rows === 0) { - // Classe non trovata header("Location: index.php"); exit; } @@ -28,7 +29,7 @@ if ($res->num_rows === 0) { - Orario <?php echo $class['name']; ?> + Orario <?php echo htmlspecialchars($class['name']); ?> @@ -40,8 +41,10 @@ if ($res->num_rows === 0) { Home -

Orario della classe

- +

Orario della classe

+ + +
$d"; ?> @@ -56,31 +59,34 @@ if ($res->num_rows === 0) { WHERE class_id=$class_id AND day='$d' AND hour=$hnum"); if($q->num_rows > 0){ - $row = $q->fetch_assoc(); - $subject = $row['name']; - $room = $row['room']; + // FIX: Gestione corretta di multipli docenti/materie + $entries = []; + $subject = null; + $room = null; - // metto il primo docente - $teachers = [$row['teacher']]; - - // aggiungo eventuali altri docenti while($row = $q->fetch_assoc()){ - $teachers[] = $row['teacher']; + if($subject === null) { + $subject = $row['name']; + $room = $row['room']; + } + $entries[] = $row['teacher']; } - // se più docenti -> unisci con virgola e "e" finale - if(count($teachers) > 1){ - $last = array_pop($teachers); - $teachers_list = implode(", ", $teachers) . " e " . $last; + // Unisci i docenti correttamente + if(count($entries) > 1){ + $last = array_pop($entries); + $teachers_list = implode(", ", $entries) . " e " . $last; } else { - $teachers_list = $teachers[0]; + $teachers_list = $entries[0]; } echo ""; +
" . htmlspecialchars($subject) . "
+
" . htmlspecialchars($teachers_list) . "
"; + if(!empty($room)) { + echo "
" . htmlspecialchars($room) . "
"; + } + echo ""; } else { echo ""; } @@ -89,10 +95,12 @@ if ($res->num_rows === 0) { } ?>
-
$subject
-
$teachers_list
-
$room
-
+ +
-

+

$hlabel): $q = $conn->query("SELECT subjects.name, subjects.teacher, subjects.room @@ -101,31 +109,35 @@ if ($res->num_rows === 0) { WHERE class_id=$class_id AND day='$d' AND hour=$hnum"); if($q->num_rows > 0): - $row = $q->fetch_assoc(); - $subject = $row['name']; - $room = $row['room']; - - $teachers = [$row['teacher']]; + // FIX: Stessa logica corretta anche per mobile + $entries = []; + $subject = null; + $room = null; + while($row = $q->fetch_assoc()){ - $teachers[] = $row['teacher']; + if($subject === null) { + $subject = $row['name']; + $room = $row['room']; + } + $entries[] = $row['teacher']; } - if(count($teachers) > 1){ - $last = array_pop($teachers); - $teachers_list = implode(", ", $teachers) . " e " . $last; + if(count($entries) > 1){ + $last = array_pop($entries); + $teachers_list = implode(", ", $entries) . " e " . $last; } else { - $teachers_list = $teachers[0]; + $teachers_list = $entries[0]; } ?>
-
-
-
-
+
+
+
+
-
+
—
@@ -133,6 +145,7 @@ if ($res->num_rows === 0) {
+

Copyright (C) 2025 EmmeV. - Released under GNU AGPL 3.0 License.