<%
' (SS,26/7/11) added CleanSQLStr function
' (SS,22/8/14) added getting picture by ID (PictureID) instead of Type, Code, Code2 if id is specified
' (SS,27/8/14) added " AND Enabled ORDER BY SortOrder, Code2, PictureID LIMIT 1" to SQL to pick correct (i.e. main) picture for product when PictureID not specified
Response.ContentType = "image/jpeg"
Response.Expires = 60
Dim LPictureID, LType, LSize, LCode, LCode2, LPictureField, LWhereCode2
LPictureID = Request.QueryString("id") ' (SS,22/8/14) 
LType = UCase(Request.QueryString("type"))
LSize = UCase(Request.QueryString("size"))
LCode = Request.QueryString("code")
LCode2 = Request.QueryString("code2")
If LCode2 <> "" Then
  LWhereCode2 = " AND Code2 = """ & CleanSQLStr(LCode2) & """" ' (SS,26/7/11) added CleanSQLStr
Else
  LWhereCode2 = ""
End If
If LType = "" then LType = "P"
If LSize = "O" Then
  LPictureField = "OriginalPicture"
ElseIf LSize = "L" Then
  LPictureField = "LargeThumbnail"
Else
  LPictureField = "SmallThumbnail"
End If
Dim oConn, oRs, nRecs, LImage, LFound, LWhere
Set oConn = Server.CreateObject("ADODB.Connection")
oConn.ConnectionString = Application("ConnectionString")
oConn.Open
' (SS,26/7/11) added CleanSQLStr
' (SS,12/6/12) added CleanSQLStr before LType to prevent SQL injection
' (SS,22/8/14) different WHERE clause when PictureID specified
If LPictureID <> "" Then
  LWhere = "PictureID = '" & CleanSQLStr(LPictureID) & "'"
Else
  LWhere = "Type = '" & CleanSQLStr(LType) & "' AND Code = """ & CleanSQLStr(LCode) & """" + LWhereCode2
End If
' (SS,27/6/14) added " AND Enabled ORDER BY SortOrder, Code2, PictureID LIMIT 1" to pick correct picture when only Code is specified for Type P 
Set oRS = oConn.Execute("SELECT " & LPictureField & " FROM pictures WHERE " & LWhere & " AND Enabled ORDER BY SortOrder, Code2, PictureID LIMIT 1", nRecs, &H0001)
LFound = Not oRS.Eof
If LFound Then LImage = oRS(LPictureField)
oRS.Close
Set oRS = Nothing
' if not found then get the no image picture '
If Not LFound Then
  Set oRS = oConn.Execute("SELECT " & LPictureField & " FROM pictures WHERE Type = 'O' AND Code = 'NoPicture'", nRecs, &H0001)
  LFound = Not oRS.Eof
  If LFound Then LImage = oRS(LPictureField)
End If
oConn.Close
Set oConn = Nothing
If LFound Then Response.BinaryWrite LImage
Response.End

' (SS,26/7/11) added following from dbfunctions.asp because query would fail if code contained a quote
Function CleanSQLStr(AValue)
  Dim LNewValue
  If IsNull(AValue) Then AValue = ""
  LNewValue = AValue
  LNewValue = Replace(LNewValue, "\", "\\")
  LNewValue = Replace(LNewValue, "'", "\'")
  LNewValue = Replace(LNewValue, """", "\""")
  LNewValue = Replace(LNewValue, Chr(0), "\0") ' An ASCII NUL (0x00) character.
  LNewValue = Replace(LNewValue, Chr(8), "\b") ' A backspace character.
  LNewValue = Replace(LNewValue, Chr(9), "\t") ' A tab character. 
  LNewValue = Replace(LNewValue, Chr(10), "\n") ' A newline (linefeed) character.
  LNewValue = Replace(LNewValue, Chr(13), "\r") ' A carriage return character.
  LNewValue = Replace(LNewValue, Chr(26), "\Z") ' ASCII 26 (Control-Z).
  CleanSQLStr = LNewValue
End Function
%>