// This script finalises a purchase
   // It expects that a cart has contents and that the
   // user is logged in

// Einbindung des gesamten Include-Sets
require("INC_global_includeset.inc");

// Einbindung des Session-Management
require_once 'INC_session.inc';
session_start();

set_error_handler("errorHandler");


   // Get the cust_id using loginUsername
   //   function getCustomerID($loginUsername, $connection)
   function getCustomerID($authenticatedUser, $connection)  
  {
      global $db;
      global $user;
      global $pass;
      global $host;

      $open = false;

      // If a connection parameter is not passed, then 
      // use our own connection to avoid any locking problems
      if (!isset($connection))
      { 
          if (!($connection = @ mysql_connect($host, 
                                             $user, 
                                             $pass)))
             showerror();

          if (!mysql_select_db($db, $connection))
             showerror();

          $open = true;
      }

      // We find the cust_id through the users table, using the
      // session variable holding their loginUsername.
      $query = "SELECT user_id 
                FROM users 
                WHERE user_name = \"$authenticatedUser\"";
  
      if (($result = @ mysql_query ($query, $connection)))
         $row = mysql_fetch_array($result);         
      else
         showerror();
 
      if ($open == true)
         @ mysql_close($connection);
  
     return($row["user_id"]);
   }


   // Check if a cart exists - this should never fail
   // unless the script is run directly
   if (!session_is_registered("order_no"))
   {
      session_register("message");
      $message = "In Ihrem Warenkorb befinden sich keine Artikel!";

      // Redirect the browser back to the calling page
      header("Location: $HTTP_REFERER");
      exit;
   }      

   // Check if the user is logged in - this should never fail
   // unless the script is run directly
   if (!session_is_registered("authenticatedUser"))
   {
      session_register("message");
      $message = "Sie müssen eingeloggt sein um eine Bestellung aufgeben zu können!";

      // Redirect the browser back to the calling page
      header("Location: $HTTP_REFERER");
      exit;
   }      
   
   // Open a connection to the DBMS
   if (!($connection = @ mysql_pconnect($host, 
                                        $user, 
                                        $pass)))
      showerror();                                     

   if (!mysql_select_db($db, $connection))
      showerror();

   // Several tables must be locked to finalise a purchase.
   // We avoid locking four other tables by
   // using another DBMS connection to produce the wine
   // information
   $query = "LOCK TABLES cart_orders WRITE, cart_items WRITE, re_sessions WRITE, users READ";

   // LOCK the tables
   if (!(@ mysql_query ($query, $connection)))
      showerror();   



   if (empty($message))
   {
      // Everything is ok - let's proceed then!         

      // First of all, find out the user's cust_id and
      // the next available order_id for this customer.
      $custID = getCustomerID($authenticatedUser, NULL);

      $query = "SELECT max(order_id) 
                FROM cart_orders 
                WHERE user_id = " . $custID;

      if (($result = @ mysql_query ($query, $connection)))
         $row = mysql_fetch_array($result);         
      else
         showerror();

      $newOrder_no = $row["max(order_id)"] + 1;
      
      // Now, change the cust_id and order_id of their cart!
      $query = "UPDATE cart_orders 
                SET user_id = $custID , " . 
                "order_id = " . $newOrder_no .
               " WHERE order_id = $order_no";

      if (!(@ mysql_query ($query, $connection)))
         showerror();

      $query = "UPDATE cart_items 
                SET user_id = $custID , " . 
               "order_id = " . $newOrder_no .
               " WHERE order_id = $order_no" .
	       " AND user_id = -1";

      if (!(@ mysql_query ($query, $connection)))
         showerror();

      // Officially empty the cart
      session_unregister("order_no");
   }


   
   // Last, UNLOCK the tables
   $query = "UNLOCK TABLES";
   if (!(@ mysql_query ($query, $connection)))
     showerror();

   // Redirect to the email confirmation page if everything is ok
   // (supply the custID and orderID to the script)
   // otherwise go back to the cart page and show a message
   if (empty($message))
   {
      header("Location: http://roth.webefacts.com/index.php?custID=$custID&orderID=$newOrder_no");
      exit;
   }
   else
      header("Location: cart_view.php");