<%
' (SS,26/7/11) added CleanSQLStr function
' (SS,22/8/14) added getting picture by ID (PictureID) instead of Type, Code, Code2 if id is specified
' (SS,27/8/14) added " AND Enabled ORDER BY SortOrder, Code2, PictureID LIMIT 1" to SQL to pick correct (i.e. main) picture for product when PictureID not specified
' (SS,12/5/17) added Function CheckCacheDate which uses LastUpdated field to check when modified and only return picture if since modified
Response.ContentType = "image/jpeg"
' (SS,12/5/17) commented out following to give better PageSpeed results, but may be better to keep?
'Response.Expires = 60
Dim LPictureID, LType, LSize, LCode, LCode2, LPictureField, LWhereCode2
LPictureID = Request.QueryString("id") ' (SS,22/8/14) 
LType = UCase(Request.QueryString("type"))
LSize = UCase(Request.QueryString("size"))
LCode = Request.QueryString("code")
LCode2 = Request.QueryString("code2")
If LCode2 <> "" Then
  LWhereCode2 = " AND Code2 = """ & CleanSQLStr(LCode2) & """" ' (SS,26/7/11) added CleanSQLStr
Else
  LWhereCode2 = ""
End If
If LType = "" then LType = "P"
If LSize = "O" Then
  LPictureField = "OriginalPicture"
ElseIf LSize = "L" Then
  LPictureField = "LargeThumbnail"
Else
  LPictureField = "SmallThumbnail"
End If
Dim oConn, oRs, nRecs, LImage, LFound, LWhere, LLastUpdated
Set oConn = Server.CreateObject("ADODB.Connection")
oConn.ConnectionString = Application("ConnectionString")
oConn.Open
' (SS,26/7/11) added CleanSQLStr
' (SS,12/6/12) added CleanSQLStr before LType to prevent SQL injection
' (SS,22/8/14) different WHERE clause when PictureID specified
If LPictureID <> "" Then
  LWhere = "PictureID = '" & CleanSQLStr(LPictureID) & "'"
Else
  LWhere = "Type = '" & CleanSQLStr(LType) & "' AND Code = """ & CleanSQLStr(LCode) & """" + LWhereCode2
End If
' (SS,27/6/14) added " AND Enabled ORDER BY SortOrder, Code2, PictureID LIMIT 1" to pick correct picture when only Code is specified for Type P 
' (SS,12/5/17) added LastUpdated for cache file modified check
Set oRS = oConn.Execute("SELECT " & LPictureField & ", LastUpdated FROM pictures WHERE " & LWhere & " AND Enabled ORDER BY SortOrder, Code2, PictureID LIMIT 1", nRecs, &H0001)
LFound = Not oRS.Eof
If LFound Then
  LImage = oRS(LPictureField)
  LLastUpdated = oRS("LastUpdated") ' (SS,12/5/17)
End If
oRS.Close
Set oRS = Nothing
' if not found then get the no image picture '
If Not LFound Then
  ' (SS,12/5/17) added LastUpdated for cache file modified check
  Set oRS = oConn.Execute("SELECT " & LPictureField & ", LastUpdated  FROM pictures WHERE Type = 'O' AND Code = 'NoPicture'", nRecs, &H0001)
  LFound = Not oRS.Eof
  If LFound Then
    LImage = oRS(LPictureField)
    LLastUpdated = oRS("LastUpdated") ' (SS,12/5/17)
  End If
End If
oConn.Close
Set oConn = Nothing

' (SS,12/5/17)
CheckCacheDate(LLastUpdated)

If LFound Then Response.BinaryWrite LImage
Response.End

' (SS,26/7/11) added following from dbfunctions.asp because query would fail if code contained a quote
Function CleanSQLStr(AValue)
  Dim LNewValue
  If IsNull(AValue) Then AValue = ""
  LNewValue = AValue
  LNewValue = Replace(LNewValue, "\", "\\")
  LNewValue = Replace(LNewValue, "'", "\'")
  LNewValue = Replace(LNewValue, """", "\""")
  LNewValue = Replace(LNewValue, Chr(0), "\0") ' An ASCII NUL (0x00) character.
  LNewValue = Replace(LNewValue, Chr(8), "\b") ' A backspace character.
  LNewValue = Replace(LNewValue, Chr(9), "\t") ' A tab character. 
  LNewValue = Replace(LNewValue, Chr(10), "\n") ' A newline (linefeed) character.
  LNewValue = Replace(LNewValue, Chr(13), "\r") ' A carriage return character.
  LNewValue = Replace(LNewValue, Chr(26), "\Z") ' ASCII 26 (Control-Z).
  CleanSQLStr = LNewValue
End Function

' (SS,12/5/17)
' help from https://www.webmasterworld.com/forum3/6005-2-30.htm
Function CheckCacheDate(AFileDate)
  Dim dModified, sModifiedSince, sModifiedLast, ckDate
  'This is the date in which the last update was made. 
  ' dModified = "10/29/1994 7:43:31 PM"

  ' Add 7 hours to our time for PST to GMT difference 
  ' dModified = DateAdd ("h",7,dModified)
  
  ' (SS,12/5/17) replaced above with following
  dModified = AFileDate

  'If the HTTP_IF_MODIFIED_SINCE exists then compare it 
  If Len(Request.ServerVariables("HTTP_IF_MODIFIED_SINCE")) > 0 Then

    'Modify our date to make it readable in VBScript 
    sModifiedSince = Request.ServerVariables("HTTP_IF_MODIFIED_SINCE") 
    sModifiedSince = Left(sModifiedSince, Len(sModifiedSince) - 4) 
    sModifiedSince = Right(sModifiedSince, Len(sModifiedSince) - 5) 
    ckDate = CDate(sModifiedSince)

    'Compare our dates and throw a 304 if our date is less then or = to the If Modified Since Date 
    If dModified <= ckDate Then 
      Response.Clear 
      Response.Status = "304 Not Modified" 
      Response.End 
    End If 
  End If

  'This may not be necessary but I am passing back the Last-Modified date 
  'Converting it back to the Standard Date Format 
  sModifiedLast = WeekDayName(WeekDay(dModified), TRUE) & ", " & Day(dModified) & " " & MonthName(Month(dModified),TRUE) &_ 
    " " & Year(dModified) &" "& Hour(dModified) & ":" & Minute(dModified) & ":" & Second(dModified) & " GMT" 
  ' Passing back the Last-Modified 
  Response.AddHeader "Last-modified", sModifiedLast 
End Function

%>