Car Chasis Controller Documentation

File: /controllers/carChasisController.php

Purpose: Manages chassis number updates and modifications across multiple database tables for automotive tracking

Last Updated: December 20, 2024

Total Functions: 2

Lines of Code: ~42

---

📋 Overview

The Car Chasis Controller is a specialized utility controller that handles chassis number updates across the entire system. This controller manages:

• • Chassis number modification and standardization
• • Cross-table chassis number updates
• • Data integrity maintenance across automotive tracking tables
• • Bulk chassis number corrections

Primary Functions

• ✅ Chassis number listing and selection
• ✅ Cross-table chassis number updates
• ✅ Data integrity maintenance
• ✅ Automotive tracking system integration

Related Controllers

• • carController.php - Car management
• • buyBillController.php - Purchase operations (chassis tracking)
• • sellbillController.php - Sales operations (chassis tracking)
• • carTrackingController.php - Car tracking operations

---

🗄️ Database Tables

Primary Tables (Direct Updates)

🔑 Key Functions

1. Default Action - Chassis Selection Interface

Location: Lines 8-15

Purpose: Display interface for selecting and modifying chassis numbers

Process Flow:

1. Query all existing chassis numbers from productserial table

2. Filter for non-empty chassis numbers from non-deleted bills

3. Display chassis selection form

4. Provide interface for old/new chassis number input

SQL Query:

SELECT chassisNo 
FROM productserial 
JOIN buybill ON buybillid = billid 
WHERE chassisNo != "" 
  AND del = 0 
  AND conditions = 0

Template Variables:

• • $allChasis - Array of existing chassis numbers

---

2. savedata - Chassis Number Update Operation

Location: Lines 16-38

Purpose: Update chassis number across all related tables in the system

Function Signature:

// Triggered when: do=savedata
$oldChasis = filter_input(INPUT_POST, 'oldChasis');
$chasis = filter_input(INPUT_POST, 'chasis');

Process Flow:

1. Validate input parameters (old and new chassis numbers)

2. Execute UPDATE queries across all affected tables

3. Maintain referential integrity across the system

4. Redirect to controller on completion or error

Database Updates:

// Update all tables containing chassis references
R::exec('UPDATE productserial SET chassisNo = "'.$chasis.'" WHERE chassisNo = "'.$oldChasis.'"');
R::exec('UPDATE carfile SET chasis = "'.$chasis.'" WHERE chasis = "'.$oldChasis.'"');
R::exec('UPDATE cars SET chasisno = "'.$chasis.'" WHERE chasisno = "'.$oldChasis.'"');
R::exec('UPDATE cartracking SET chasis = "'.$chasis.'" WHERE chasis = "'.$oldChasis.'"');
R::exec('UPDATE commentclient SET chasis = "'.$chasis.'" WHERE chasis = "'.$oldChasis.'"');
R::exec('UPDATE importcontract SET chasisno = "'.$chasis.'" WHERE chasisno = "'.$oldChasis.'"');
R::exec('UPDATE expenses SET chasis = "'.$chasis.'" WHERE chasis = "'.$oldChasis.'"');
R::exec('UPDATE sellbill SET carchase = "'.$chasis.'" WHERE carchase = "'.$oldChasis.'"');
R::exec('UPDATE shippingfile SET chasis = "'.$chasis.'" WHERE chasis = "'.$oldChasis.'"');

Error Handling:

• • Try-catch block wraps all database operations
• • Redirects to main controller on both success and failure
• • Database transaction rollback on any error

---

🔄 Workflows

Workflow 1: Chassis Number Update Process

---

🌐 URL Routes & Actions

Chassis Selection (do= empty):

• • No parameters required
• • Loads all available chassis numbers

Update Chassis (do=savedata):

• • oldChasis - Current chassis number to be replaced
• • chasis - New chassis number to assign

---

🔒 Security & Permissions

Input Sanitization

$oldChasis = filter_input(INPUT_POST, 'oldChasis');
$chasis = filter_input(INPUT_POST, 'chasis');

Security Considerations

• • SQL Injection: Uses direct SQL with user input - potential vulnerability
• • No Authentication: Controller lacks authentication checks
• • No Permission Validation: No user role verification
• • No Input Validation: Limited validation of chassis number formats

Recommended Security Improvements

// Add authentication
include_once("../public/authentication.php");

// Use parameterized queries
R::exec('UPDATE productserial SET chassisNo = ? WHERE chassisNo = ?', [$chasis, $oldChasis]);

// Add input validation
if (!preg_match('/^[A-Z0-9]{10,20}$/', $chasis)) {
    throw new Exception('Invalid chassis number format');
}

---

📊 Impact Analysis

Tables Affected by Chassis Updates

• • Referential Integrity: No foreign key constraints enforced
• • Cascade Updates: Manual cascade across 9 tables
• • Orphan Records: Risk of orphaned records if operation fails partially
• • Audit Trail: No logging of chassis number changes

---

🐛 Common Issues & Troubleshooting

1. Partial Update Failures

Issue: Some tables updated but others fail, causing data inconsistency

Cause: Network interruption or database connection issues

Debug:

-- Check for inconsistent chassis numbers across tables
SELECT 'productserial' as table_name, chassisNo, COUNT(*) 
FROM productserial WHERE chassisNo = 'OLD_CHASSIS'
UNION ALL
SELECT 'cars' as table_name, chasisno, COUNT(*) 
FROM cars WHERE chasisno = 'OLD_CHASSIS'
UNION ALL
SELECT 'carfile' as table_name, chasis, COUNT(*) 
FROM carfile WHERE chasis = 'OLD_CHASSIS';

Fix: Implement database transactions:

R::begin();
try {
    // All UPDATE statements here
    R::commit();
} catch (Exception $e) {
    R::rollback();
    throw $e;
}

2. SQL Injection Vulnerability

Issue: Direct string concatenation in SQL queries

Risk: Potential for SQL injection attacks

Current Vulnerable Code:

R::exec('UPDATE productserial SET chassisNo = "'.$chasis.'" WHERE chassisNo = "'.$oldChasis.'"');

Secure Alternative:

R::exec('UPDATE productserial SET chassisNo = ? WHERE chassisNo = ?', [$chasis, $oldChasis]);

3. Missing Authentication

Issue: Controller accessible without login verification

Risk: Unauthorized chassis number modifications

Fix:

// Add at beginning of controller
include_once("../public/authentication.php");

---

🧪 Testing Scenarios

Test Case 1: Valid Chassis Update

1. Select existing chassis number from dropdown
2. Enter new valid chassis number
3. Submit form
4. Verify all 9 tables updated correctly
5. Confirm redirect to main controller

Test Case 2: Non-existent Chassis

1. Enter chassis number that doesn't exist in system
2. Submit form  
3. Verify graceful handling (no records affected)
4. Confirm appropriate user feedback

Test Case 3: Duplicate Chassis Number

1. Try to update chassis to number that already exists
2. Verify system handles potential conflicts
3. Check for data integrity preservation

---

⚠️ Security Warnings

Critical Issues

1. SQL Injection: Direct string concatenation in queries

2. No Authentication: Anyone can access chassis modification

3. No Audit Trail: Changes not logged for accountability

4. No Validation: Chassis number format not verified

Immediate Actions Needed

// 1. Add authentication
include_once("../public/authentication.php");

// 2. Use parameterized queries
$queries = [
    'UPDATE productserial SET chassisNo = ? WHERE chassisNo = ?',
    'UPDATE carfile SET chasis = ? WHERE chasis = ?',
    // ... etc for all tables
];

// 3. Add transaction handling
R::begin();
try {
    foreach ($queries as $query) {
        R::exec($query, [$chasis, $oldChasis]);
    }
    R::commit();
} catch (Exception $e) {
    R::rollback();
    error_log("Chassis update failed: " . $e->getMessage());
    throw $e;
}

---

📚 Related Documentation

• • CLAUDE.md - PHP 8.2 migration guide
• • carController.md - Car management operations
• • Security Best Practices - Recommended security implementations

---

Documented By: AI Assistant

Review Status: ⚠️ Security Review Required

Next Review: Immediate - address security vulnerabilities