userCC.cfm / Eric Bourland

<!-----
Name:        editCC.cfm
Author:      Eric Bourland
Description: view, update CC information
Created:     February 2013
Revised: February 2013
ColdFusion Version 9
MS SQL Server 2005
----->

<!--- set a default value "" for UserID in scope URL --->
<cfparam name="url.UserID" default="">

<!--- define the UserID in scope FORM, then set form.UserID equal to the UserID passed in the URL --->
<cfparam name="form.UserID" default="#url.UserID#">

<!--- set default values for other user-editable fields --->

<cfparam name="form.FirstName" default="">
<cfparam name="form.MiddleInitial" default="">
<cfparam name="form.LastName" default="">
<cfparam name="form.UserRoleID" default="">
<cfparam name="form.DateModified" default="">
<cfparam name="form.CheckEnclosed" default="">
<cfparam name="form.AuthorizeCharge" default="">
<cfparam name="form.CreditCard" default="">
<cfparam name="form.CreditCardNumber" default="">
<cfparam name="form.ExpirationDate" default="">
<cfparam name="form.PrintedCardHolderName" default="">
<cfparam name="form.CreditCardZIPCode" default="">
<cfparam name="form.CVV" default="">


<!--- in user-editable fields, set up protection against XSS  --->
    <cfloop collection="#FORM#" item="field">
      <cfset FORM[ field ] = ReReplaceNoCase (FORM[ field ], "<script.*?>.*?</script>", "", "all")>
    </cfloop>


<!--- query editUser tells ColdFusion which record to edit--->
<cfquery datasource="#application.datasource#" name="editUser">
SELECT UserID
,FirstName
,MiddleInitial
,LastName
,UserRoleID
,CheckEnclosed
,AuthorizeCharge
,CreditCard
,CreditCardNumber
,ExpirationDate
,PrintedCardHolderName
,CreditCardZIPCode
,CVV
,DateCreated
,DateModified

FROM #request.membersTable#
WHERE UserID = <cfqueryparam cfsqltype="cf_sql_integer" value="#val(form.UserID)#">
</cfquery>


<!---- begin CFTRY; catch errors ---->
<cftry>

<!---- populate cftry with error message ---->
<cfset variables.error = "">

<!--- BEGIN: Save action --->

<!--- begin form.doSave --->

<cfif IsDefined("FORM.doSave")>


<!--- encryption --->

 <!--- if a value is entered in form.CreditCardNumber, then proceed with encryption --->
<cfif len(form.CreditCardNumber)>

 <!--- set default value for variable "result" in case no value is entered for CreditCardNumber --->
 <cfparam name="result" default="">

 <!--- generate a key suitable for "AES" --->
 <cfset theKey = GenerateSecretKey("AES", 256)>
 <!--- now do the actual encryption using the "AES" algorithm --->
 <cfset result = encrypt(form.CreditCardNumber, theKey, "AES", "UU")>
 </cfif>


<!--- decryption --->

<!--- set default value for variable "form.decrypted" in case no value is present in column CreditCardNumber --->
<cfparam name="form.decrypted" default="">

<!--- does editUser.CreditCardNumber have a value?  --->
<cfif len(editUser.CreditCardNumber)>

<!--- if so, apply decrypt function  --->
<cfset decrypted = decrypt(form.CreditCardNumber, theKey, "AES", "UU")>
</cfif>



<!--- Assume that a UserID Exists; the action is UPDATE --->
<cfif val(form.UserID)>
<cfquery name="UpdateUser" datasource="#application.datasource#">
UPDATE #REQUEST.membersTable#
SET FirstName = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.FirstName,255))#">,
MiddleInitial = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.MiddleInitial,5))#">,
LastName = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.LastName,255))#">,
CheckEnclosed = <cfqueryparam cfsqltype="cf_sql_bit" value="#val(CheckEnclosed)#">,
AuthorizeCharge = <cfqueryparam cfsqltype="cf_sql_bit" value="#val(AuthorizeCharge)#">,
CreditCard = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.CreditCard,20))#">,
<cfif len(form.CreditCardNumber)>CreditCardNumber = <cfqueryparam cfsqltype="cf_sql_varchar" value="#result#">,</cfif>
ExpirationDate = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.ExpirationDate,10))#">,
PrintedCardHolderName = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.PrintedCardHolderName,128))#">,
CreditCardZIPCode = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.CreditCardZIPCode,128))#">,
CVV = <cfqueryparam cfsqltype="cf_sql_varchar" value="#Trim(Left(form.CVV,12))#">,
DateModified = <cfqueryparam cfsqltype="cf_sql_timestamp" value="#now()#">
WHERE UserID = <cfqueryparam cfsqltype="cf_sql_integer" value="#val(form.UserID)#">
</cfquery>


<!--- END queries to update or insert database records --->

<!--- END cfif val(form.UserID) -- if a record needed to be updated, then it was done --->
					    </cfif>


       <!--- done? relocate --->


<cflocation url="/admin/manageUsers.cfm" addtoken="no">



<!--- END: Save action --->

<!--- END form.doSave --->
                    </cfif>

<!--- END queries to update or insert database records --->


<!--- this CFCATCH will trap errors -- the ones you threw or just regular database issues --->
            <cfcatch type="Any">
                 <cfset variables.error = cfcatch.message>
                 <cfrethrow>
            </cfcatch>

<!--- END CFTRY --->
			</cftry>



<!--- fetch the data from the database only when there are no errors; let the form variables pass back from the data table into the form to display ---->

<cfif len(variables.error) eq 0>

  			<cfloop index="aCol" list="#editUser.columnList#">
			       <cfset "form.#aCol#" = editUser[aCol][editUser.currentRow]>
			  </cfloop>

</cfif>

<!----- if record already exists (it will have a UserID) then update record; otherwise, add new record ----->

<!--- include HTML page head --->
<cfinclude template="/admin/admin_header.cfm">

<!--- include navigation --->
<cfinclude template="/admin/adminNav.cfm">


<hr />

<!--- if there an error, display error in human-readable form --->

<cfif len(variables.error)>
	  <cfoutput>
	    <div class="errorbox">#variables.error#</div>
	    </cfoutput>

   <br />

             <div class="align-center">
               <input type=button value="Go Back" onClick="history.go(-1)">
             </div>

             <cfabort>
</cfif>



<cfparam name="url.cftoken" default="">

<cfif len(url.cftoken)>

<div class="notice success width150px align-center">Update Succeeded.</div>

</cfif>


<script language="JavaScript" type="application/javascript">
<!-- Begin
function popUp(URL) {
day = new Date();
id = day.getTime();
eval("page" + id + " = window.open(URL, '" + id + "', 'toolbar=0,scrollbars=1,location=0,statusbar=0,menubar=0,resizable=0,width=440,height=500,left = 383,top = 84');");
}
// End -->
</script>


	<!--- Add or Update User Form begins here --->
<cfform method="post" enctype="multipart/form-data" scriptsrc="#request.CFFORM_JS_Lib#">


 <!--- Embed UserID (PK) to assign a value to it --->
 <cfoutput>
<input type="hidden" name="UserID" value="#form.UserID#" />
   </cfoutput>



<p><span class="icon red small" data-icon="V"></span> <em>indicates a required field.</em></p>


<table>
      <tr>
      <td colspan="2"><h2>Membership Payment Information for  <cfoutput>#FirstName# #MiddleInitial# #LastName#</cfoutput></h2></td></tr>

    <tr>
            <td colspan="2">


<p><span class="icon medium red" data-icon="`"></span> <strong>Payment information is submitted through a secured connection and stored in encrypted format in a secure database. Your payment information is never displayed on this screen. The security of your data is very important to us.</strong></p>


<p><cfinput type="Checkbox" name="CheckEnclosed" value="1" checked="#val(editUser.CheckEnclosed)#" tabindex="15" /> Enclosed is a check, payable to <cfoutput>#REQUEST.CompanyName#</cfoutput>.</p>


<p><cfinput type="Checkbox" name="AuthorizeCharge" value="1" checked="#val(editUser.AuthorizeCharge)#" tabindex="16" /> I authorize <cfoutput>#REQUEST.CompanyName#</cfoutput> to charge my:</p>


<!--- this query selects Credit Cards from table LookupCC --->
<cfquery datasource="#APPLICATION.dataSource#" name="GetCC">
        SELECT  CreditCardName
        FROM    LookupCC
</cfquery>


<p class="float-left" style="margin-left:20px">
<cfselect tabindex="17" size="1" name="CreditCard" display="CreditCardName" multiple="no" query="GetCC" queryPosition="below" selected="#editUser.CreditCard#" id="CreditCard">
<option value="SelectCard">Select a Credit Card</option>
</cfselect></p>


<table>
<tr>
	<td>Credit Card Number (decrypted):</td>
	<td><cfinput TYPE="text" SIZE="30" NAME="CreditCardNumber" value="#decrypted#" tabindex="19" /></td>
	<td>Expiration Date:</td>
	<td><cfinput TYPE="text" SIZE="15" NAME="ExpirationDate" value="#editUser.ExpirationDate#" tabindex="20" /></td>
</tr>
<tr>
	<td>Printed Cardholder Name:</td>
	<td><cfinput TYPE="text" SIZE="30" NAME="PrintedCardHolderName" value="#editUser.PrintedCardHolderName#" tabindex="21" /></td>
	<td>Credit Card ZIP Code:</td>
	<td><cfinput TYPE="text" SIZE="15" NAME="CreditCardZIPCode" value="#editUser.CreditCardZIPCode#" tabindex="22" /></td>
</tr>
<tr>
	<td>Signature (if printing and mailing):</td>
	<td>__________________________</td>
	<td>CVV#/3-digit #:</td>
	<td><cfinput TYPE="text" SIZE="15" NAME="CVV" value="#editUser.CVV#" tabindex="23" /></td>
</tr>
</table>

</td>

                              </tr>



   </table>





   <!--- submit form to ColdFusion for processing; this is the DoSave function, which will add or edit a record --->

   <div class="align-center"> <cfoutput>

   <button name="doSave" type="submit" class="medium orange" tabindex="27">Update</button>

   </cfoutput>
   </div>

</cfform>



<!--- Page footer --->
<cfinclude template="/admin/admin_footer.cfm">