Your IP : 216.73.217.79
<?php
session_start();
include_once($_SERVER['DOCUMENT_ROOT'] . "/php/inc_db.php");
include_once($_SERVER['DOCUMENT_ROOT'] . "/cesanet/inc_shared.php");
$conni_orange = $conni;
$GroupID = intval($_GET["id"]);
$Questionnaire_ID = intval($_GET["qid"]);
$sql = "SELECT * FROM Questionnaires WHERE Questionnaire_ID='" . $Questionnaire_ID . "'";
$rec = mysqli_query($conni_orange, $sql);
if ($row = mysqli_fetch_assoc($rec)) {
extract($row);
}
mysqli_free_result($rec);
?>
<html>
<head>
<title>Questionnaire</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">
</head>
<body class="bg-dark">
<div class="container bg-light">
<div class="row">
<div class="col-12">
<?php
$GroupID = intval($_POST["id"]);
$Questionnaire_ID = intval($_POST["qid"]);
$sql = "SELECT * FROM Questionnaires WHERE Questionnaire_ID='" . $Questionnaire_ID . "'";
$rec = mysqli_query($conni_orange, $sql);
if ($row = mysqli_fetch_assoc($rec)) {
extract($row);
}
mysqli_free_result($rec);
$sLogo = "";
$sql = "SELECT Questions.Question_ID, Answers.Answer_ID FROM Questions JOIN Answers USING (Question_ID) "
. "WHERE Questions.Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Questions.Question LIKE '%First%Name%' "
. "AND Questions.IsOptional=0";
$rec = mysqli_query($conni_orange, $sql);
$sFirstName = "";
if ($row = mysqli_fetch_assoc($rec))
$sFirstName = $_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]];
$sql = "SELECT Questions.Question_ID, Answers.Answer_ID FROM Questions JOIN Answers USING (Question_ID) "
. "WHERE Questions.Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Questions.Question LIKE '%Surname%' "
. "AND Questions.IsOptional=0";
$rec = mysqli_query($conni_orange, $sql);
$sSurname = "";
if ($row = mysqli_fetch_assoc($rec))
$sSurname = $_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]];
$RespondeeName = $sFirstName . " " . $sSurname;
$sql = "SELECT Questions.Question_ID, Answers.Answer_ID FROM Questions JOIN Answers USING (Question_ID) "
. "WHERE Questions.Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Questions.Question LIKE '%Email%Address%' "
. "AND Questions.IsOptional=0";
$rec = mysqli_query($conni_orange, $sql);
$EmailAddress = "";
if ($row = mysqli_fetch_assoc($rec))
$EmailAddress = $_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]];
$sql = "SELECT Questions.Question_ID, Answers.Answer_ID FROM Questions JOIN Answers USING (Question_ID) "
. "WHERE Questions.Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Questions.Question LIKE '%ID Number%' "
. "AND Questions.IsOptional=0";
$rec = mysqli_query($conni_orange, $sql);
$DuplicateIdentifier = "";
if ($row = mysqli_fetch_assoc($rec))
$DuplicateIdentifier = $_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]];
?>
<h1><?php
if (!empty($sLogo))
echo $sLogo;
echo htmlspecialchars($Questionnaire_Name);
?></h1>
<?php
$sql = "SELECT * FROM AnonRespondees "
. "WHERE Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND GroupID=" . $GroupID . " "
. "AND (Anon_Respondee_Email='" . addslashes($EmailAddress) . "' "
. "OR Unique_ID='" . addslashes($DuplicateIdentifier) . "') "
. "AND InterimSave=0";
$rec = mysqli_query($conni_orange, $sql);
if (($_POST["go"] == 1) && (mysqli_num_rows($rec) > 100)) {
?>
<p><b>We already have 3 saved tests with your email address or ID number, and cannot save another one.</b></p>
<?php
} else {
if (isset($_POST["rid"]) && !empty($_POST["rid"])) {
$iRespondeeID = intval($_POST["rid"]);
$sql = "UPDATE AnonRespondees SET Anon_Respondee_Name='" . addslashes($RespondeeName) . "', "
. "Anon_Respondee_Email='" . addslashes($EmailAddress) . "', "
. "Unique_ID='" . addslashes($DuplicateIdentifier) . "', "
. "Response_Date='" . date("Y-m-d H:i:s") . "', "
. "IPAddress='" . $_SERVER['REMOTE_ADDR'] . "' "
. "WHERE Anon_RespondeeID=" . $iRespondeeID;
mysqli_query($conni_orange, $sql);
$sql = "DELETE FROM Anon_User_Answers WHERE Respondee_ID=" . $iRespondeeID;
mysqli_query($conni_orange, $sql);
} else {
$iInterim = 0;
if ($_POST["go"] == 2)
$iInterim = 1;
$sql = "INSERT INTO AnonRespondees "
. "(Anon_Respondee_Name, Anon_Respondee_Email, Unique_ID, Questionnaire_ID, GroupID, Response_Date, IPAddress, InterimSave) "
. "VALUES "
. "('" . addslashes($RespondeeName) . "', '" . addslashes($EmailAddress) . "', '" . addslashes($DuplicateIdentifier) . "', "
. $Questionnaire_ID . ", " . $GroupID . ", '" . date("Y-m-d H:i:s") . "', '" . $_SERVER['REMOTE_ADDR'] . "', "
. $iInterim . ")";
mysqli_query($conni_orange, $sql);
$iRespondeeID = mysqli_insert_id($conni_orange);
}
$sql = "INSERT INTO Anon_User_Answers (GroupID, Questionnaire_ID, Question_ID, Respondee_ID, AnonCompanyID, Answer_ID) "
. "SELECT " . $GroupID . ", "
. $Questionnaire_ID . ", Question_ID, " . $iRespondeeID . ", 0 AS AnonCompanyID, 0 AS Answer_ID "
. "FROM Questions "
. "WHERE Questionnaire_ID=" . $Questionnaire_ID . " AND Question_ID IN (" . addslashes($_POST["QuestionIDs"]) . ")";
ErrorLog::logInfo('Inserting answers: ' . $sql);
mysqli_query($conni_orange, $sql);
$sql = "SELECT Questions.IsMulti, Questions.Answer_Type, Answers.* "
. "FROM Answers "
. "JOIN Questions USING (Question_ID) "
. "WHERE Questions.Questionnaire_ID='" . $Questionnaire_ID . "' "
. "AND Questions.Question_ID IN (" . addslashes($_POST["QuestionIDs"]) . ")";
// echo $sql;
$rec = mysqli_query($conni_orange, $sql);
$User_Score = 0;
if ($rec) {
while ($row = mysqli_fetch_assoc($rec)) {
if (empty($row["Answer"])) {
// This is a free text answer
$sTextAnswer = "";
if (isset($_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]])) {
$sTextAnswer = $_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]];
} else {
if (isset($_POST["Question_" . $row["Question_ID"]])) {
$sTextAnswer = $_POST["Question_" . $row["Question_ID"]];
}
}
$sql = "UPDATE Anon_User_Answers SET Answer_ID=" . $row["Answer_ID"] . ", Answer_Text='" . addslashes($sTextAnswer) . "' "
. "WHERE GroupID=" . $GroupID . " AND Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Question_ID=" . $row["Question_ID"] . " "
. "AND Respondee_ID=" . $iRespondeeID;
mysqli_query($conni_orange, $sql);
} elseif ($row["IsMulti"] == 1) {
if (isset($_POST["Question_" . $row["Question_ID"]])) {
$sAnswer = implode(",", $_POST["Question_" . $row["Question_ID"]]);
// $sql = "INSERT INTO Anon_User_Answers (GroupID, Questionnaire_ID, Question_ID, Answer_ID, Answer_Text,
// Respondee_ID) VALUES (".$GroupID.", ".$Questionnaire_ID.", ".$row["Question_ID"].", ".$row["Answer_ID"].",
// '".$sAnswer."', ".$iRespondeeID.")";
$sql = "UPDATE Anon_User_Answers SET Answer_ID=" . $row["Answer_ID"] . ", Answer_Text='" . $sAnswer . "' "
. "WHERE GroupID=" . $GroupID . " AND Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Question_ID=" . $row["Question_ID"] . " "
. "AND Respondee_ID=" . $iRespondeeID;
mysqli_query($conni_orange, $sql);
}
} else {
if ($_POST["Question_" . $row["Question_ID"]] == $row["Answer_ID"]) {
if (isset($_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]]) && !empty($_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]])) {
$sTextAnswer = $_POST["Question_" . $row["Question_ID"] . "_" . $row["Answer_ID"]];
} else {
$sTextAnswer = '';
}
$sql = "INSERT INTO Anon_User_Answers (GroupID, Questionnaire_ID, Question_ID, Answer_ID, Respondee_ID, Answer_Text) "
. "VALUES (" . $GroupID . ", " . $Questionnaire_ID . ", " . $row["Question_ID"] . ", "
. $_POST["Question_" . $row["Question_ID"]] . ", " . $iRespondeeID . ", "
. "'" . addslashes($sTextAnswer) . "')";
$sql = "UPDATE Anon_User_Answers SET Answer_ID=" . $row["Answer_ID"] . ", Answer_Text='" . $sTextAnswer . "' "
. "WHERE GroupID=" . $GroupID . " AND Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Question_ID=" . $row["Question_ID"] . " "
. "AND Respondee_ID=" . $iRespondeeID;
mysqli_query($conni_orange, $sql);
}
}
} //while questions
}
if ($_POST["go"] == 1) {
?>
<p>
<h1>Results</h1>
</p>
<?php
if ($HasScore == 1) {
$iSumScore = 0;
$sql = "SELECT SUM(Answers.Answer_Score) AS SumScore FROM Questions, Answers, Anon_User_Answers "
. "WHERE Questions.Question_ID=Answers.Question_ID "
. "AND Answers.`Answer_ID`=Anon_User_Answers.`Answer_ID` "
. "AND Questions.IsMulti=0 "
. "AND Questions.Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Anon_User_Answers.Respondee_ID=" . $iRespondeeID;
//echo $sql;
$rec = mysqli_query($conni_orange, $sql);
if ($row = mysqli_fetch_assoc($rec)) {
$iSumScore = $row["SumScore"];
}
$sql = "SELECT Anon_User_Answers.Answer_Text FROM Questions, Anon_User_Answers "
. "WHERE Questions.Question_ID=Anon_User_Answers.Question_ID "
. "AND Questions.IsMulti=1 "
. "AND Questions.Questionnaire_ID=" . $Questionnaire_ID . " "
. "AND Anon_User_Answers.Respondee_ID=" . $iRespondeeID;
//echo $sql;
$rec = mysqli_query($conni_orange, $sql);
while ($row = mysqli_fetch_assoc($rec)) {
if (!empty($row["Answer_Text"])) {
$sql = "SELECT SUM(Answers.Answer_Score) AS SumScore FROM Answers WHERE Answer_ID IN (" . $row["Answer_Text"] . ")";
$rec2 = mysqli_query($conni_orange, $sql);
if ($row2 = mysqli_fetch_assoc($rec2)) {
$iSumScore += $row2["SumScore"];
}
mysqli_free_result($rec2);
}
}
if ($Questionnaire_ID == 318) {
?>
<p>
<h4>Please see the correct answers below.</h4>
</p>
<?php
$questionsSQL = "SELECT * FROM Questions WHERE Questionnaire_ID=" . $Questionnaire_ID . " ORDER BY Display_Order";
$recQuestions = mysqli_query($conni_orange, $questionsSQL);
while ($rowQuestions = mysqli_fetch_assoc($recQuestions)) {
?>
<p>
<b><?php echo $rowQuestions["Question"]; ?></b>
</p>
<?php
$sql = "SELECT * FROM Answers WHERE Question_ID=" . $rowQuestions["Question_ID"] . " ORDER BY Display_Order";
$recAnswers = mysqli_query($conni_orange, $sql);
while ($rowAnswers = mysqli_fetch_assoc($recAnswers)) {
?>
<p>
<?php echo $rowAnswers["Answer"];
if ($rowAnswers["Answer_Score"] > 0) {
echo " <b>(Correct)</b>";
}
echo $_POST["Question_" . $rowQuestions["Question_ID"] . "_" . $rowAnswers["Answer_ID"]] . ' ';
if (
isset($_POST["Question_" . $rowQuestions["Question_ID"]])
&& !empty($_POST["Question_" . $rowQuestions["Question_ID"]])
&& $_POST["Question_" . $rowQuestions["Question_ID"]] == $rowAnswers["Answer_ID"]
) {
echo " <b>(Your answer)</b>";
}
?>
</p>
<?php
}
}
}
$sql = "UPDATE AnonRespondees SET InterimSave=0, Score=" . $iSumScore . " WHERE Anon_RespondeeID=" . $iRespondeeID;
mysqli_query($conni_orange, $sql);
$PercScore = intval($iSumScore) / $Score * 100;
$iAttendeeID = 0;
if (!empty($DuplicateIdentifier)) {
$sql = "SELECT * FROM `SchoolEvents` JOIN SchoolAttendees USING (EventID)
WHERE SchoolEvents.`TestRequired`=1
AND SchoolEvents.`QuestionnaireID`=" . $Questionnaire_ID . " AND SchoolEvents.EventID=" . $GroupID . "
AND REPLACE(SchoolAttendees.`IDNumber`, ' ','')='" . str_replace(' ', '', $DuplicateIdentifier) . "'";
$recA = mysqli_query($conni_orange, $sql);
if (mysqli_num_rows($recA) == 1) {
$rowA = mysqli_fetch_assoc($recA);
$iAttendeeID = $rowA["AttendeeID"];
}
}
if (empty($iAttendeeID)) {
$sql = "SELECT * FROM `SchoolEvents` JOIN SchoolAttendees USING (EventID)
WHERE SchoolEvents.`TestRequired`=1
AND SchoolEvents.`QuestionnaireID`=" . $Questionnaire_ID . " AND SchoolEvents.EventID=" . $GroupID . "
AND LOWER(SchoolAttendees.`EmailAddress`)='" . addslashes(strtolower($EmailAddress)) . "'";
$recA = mysqli_query($conni_orange, $sql);
if (mysqli_num_rows($recA) == 1) {
$rowA = mysqli_fetch_assoc($recA);
$iAttendeeID = $rowA["AttendeeID"];
}
}
if (empty($iAttendeeID)) {
$sql = "SELECT * FROM `SchoolEvents` JOIN SchoolAttendees USING (EventID)
WHERE SchoolEvents.`TestRequired`=1
AND SchoolEvents.`QuestionnaireID`=" . $Questionnaire_ID . " AND SchoolEvents.EventID=" . $GroupID . "
AND LOWER(SchoolAttendees.ContactLastName)='" . addslashes(strtolower($sSurname)) . "'
AND LOWER(SchoolAttendees.`ContactFirstName`)='" . addslashes(strtolower($sFirstName)) . "'";
$recA = mysqli_query($conni_orange, $sql);
if (mysqli_num_rows($recA) == 1) {
$rowA = mysqli_fetch_assoc($recA);
$iAttendeeID = $rowA["AttendeeID"];
}
}
if (!empty($iAttendeeID)) {
$sql = "UPDATE SchoolAttendees SET SchoolAttendees.`TestCompleted` = 1, CertificateSent = NULL "
. "WHERE SchoolAttendees.AttendeeID=" . $iAttendeeID;
mysqli_query($conni_orange, $sql);
$sql = "UPDATE AnonRespondees SET SchoolAttendeeID=" . $iAttendeeID
. " WHERE Anon_RespondeeID=" . $iRespondeeID;
mysqli_query($conni_orange, $sql);
if ($PercScore >= $PassPerc) {
$sql = "UPDATE SchoolAttendees SET SchoolAttendees.`TestPassed` = 1, CertificateSent = NULL WHERE SchoolAttendees.AttendeeID=" . $iAttendeeID;
mysqli_query($conni_orange, $sql);
$sql = "SELECT SchoolEvents.`EventName`, SchoolEvents.`StartDate`, SchoolAttendees.`ContactFirstName`, "
. "SchoolAttendees.`ContactLastName` "
. "FROM SchoolEvents JOIN SchoolAttendees USING (EventID) WHERE SchoolAttendees.`AttendeeID`=" . $iAttendeeID;
$recAttendeeName = mysqli_query($conni_orange, $sql);
if ($rowAttendeeName = mysqli_fetch_assoc($recAttendeeName)) {
$sCourse = $rowAttendeeName["EventName"];
$sAttendeeName = $rowAttendeeName["ContactFirstName"] . " " . $rowAttendeeName["ContactLastName"];
$messageText = "Test passed on " . date("Y-m-d") . " with score " . number_format($PercScore, 0) . "%\r\n"
. "Course: " . $sCourse . "\r\n"
. "Start date: " . $rowAttendeeName["StartDate"] . "\r\n"
. "Attendee: " . $sAttendeeName;
maill(
"athromethm@cesa.co.za,blessings@cesa.co.za",
$sCourse . " test passed by " . $sAttendeeName,
$messageText,
null,
array('from-name' => 'CESA SCE', 'from-address' => 'sce@cesa.co.za')
);
}
}
}
?>
<p><b>Your score: <?php echo number_format($PercScore, 0); ?>%</b></p>
<?php
if ($PercScore >= $PassPerc) {
echo $GoodResultText;
} else {
echo $BadResultText;
}
}
if ($Questionnaire_ID != 318) {
?>
<p>
<a href="/questionnaire.php?rid=<?php echo $iRespondeeID; ?>&chk=<?php echo md5($iRespondeeID); ?>">Click here to complete the survey, if you are not redirected automatically.</a>
</p>
<script language="javascript">
setTimeout(function() {
window.location.href = "/questionnaire.php?qid=225&id=<?php echo $GroupID; ?>&attendeeId=<?php echo $iAttendeeID; ?>&chk=<?php echo md5($iAttendeeID); ?>";
}, 5000);
</script>
<?php
}
} else {
$editlink = "https://www.cesa.co.za/test.php?rid=" . $iRespondeeID . "&chk=" . md5($iRespondeeID);
?>
<p>
<h1>Answers Saved</h1>
</p>
<p>Your answers have been saved, please save the link below to return to your test and complete it:</p>
<p><a href="<?php echo $editlink; ?>" target="_blank"><?php echo $editlink; ?></a></p>
<?php
}
}
?>
<p> </p>
<p> </p>
</div>
</div>
</div>
<script src="https://code.jquery.com/jquery-3.3.1.slim.min.js" integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js" integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1" crossorigin="anonymous"></script>
<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js" integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM" crossorigin="anonymous"></script>
</body>
</html>
<?php
//TODO Close all mysql connections
mysqli_close($conni_orange);
mysqli_close($conni);