404

D7net
:/ var / www / html / crsys_ant / adm / vendor_Ant / api /
Filename : atualizaDatalistObra.php
back
<?php
include_once "ConectaApi.php";

header('Content-Type: application/json; charset=utf-8');

// Pegando parâmetros com segurança
$empr_id = $_GET['empr_id'] ?? null;
$vend_id = $_GET['vend_id'] ?? null;
$q       = $_GET['q'] ?? '';

// Validação básica
if (!$empr_id || !$vend_id) {
    echo json_encode([]);
    exit;
}

// Prepared Statement (evita SQL Injection 🚨)
$sql = "SELECT 
            o.id AS id_obra,
            o.nome AS nome_obra
        FROM gre_obras o 
        WHERE o.empr_id = ?
          AND o.vend_id = ?
          AND o.sit_id = 1
          AND o.nome <> ''
          AND o.nome LIKE CONCAT('%', ?, '%')
        ORDER BY o.nome
        LIMIT 10";

$stmt = $link->prepare($sql);
$stmt->bind_param("iis", $empr_id, $vend_id, $q);
$stmt->execute();

$result = $stmt->get_result();

$dados = [];

while ($row = $result->fetch_assoc()) {
    $dados[] = [
        'id'   => $row['id_obra'],
        'nome' => $row['nome_obra']
    ];
}

echo json_encode($dados);