<?PHP
$stage=1;			#1-alpha, 2-beta, 3
################################################################################
#Should render entry so that it will come back right from a form
#With time and varying configurations, we need htmlentities, stripslashes,
if (!function_exists('html2db'))
{
	function form2db($entry)
	{
		$out=$entry;
		return $out;
	}
}
include_once(".htfolder.inc.php");
define ('MIME_BOUNDARY',"Identity is the Foundation of Security");
define ('ADDCLIENT',"Add Client");
define ('ADDSUBJECT',"Add Subject");
define ('ADDPHONE',"Add Phone");
define ('MODIFYCLIENT',"Change Client");
define ('MODIFYSUBJECT',"Change Subject");
define ('ADDSIGNER',"Add Signing Certificate");
define ('STOPCLIENT',"stopclient");

loggywoggy("We are in $file.");

if (!function_exists('formTagItem'))
{
function formTagItem($tag)
{
	return "<TD align=right>$tag:</TD>";
}
}

if (!function_exists('missingInputs'))
{
function missingInputs($values,$label="")
{
	$comma="";
	$fields=explode(",",$values);
	$missing="";
	$n=count($fields);
	for ($i=0;$i<$n;$i++)
		if (!isset($_REQUEST[$label.$fields[$i]]) || (strlen($_REQUEST[$label.$fields[$i]]) == 0))
		{
			$missing.=$comma.$fields[$i];
			$comma=",";
		}
	return $missing;
}
}

if (!function_exists('cleanInputs'))
{
function cleanInputs($values,$label="")
{
	$fields=explode(",",$values);
	$n=count($fields);
	for ($i=0;$i<$n;$i++)
		if (isset($_REQUEST[$label.$fields[$i]]))
		{
			unset($_REQUEST[$label.$fields[$i]]);
		}
}
}

if (!function_exists('addInput'))
{
function addInput($term,$value="")
{
	global $$term;
	if (strlen($value) == 0) $_REQUEST[$term]=$$term;
	else $_REQUEST[$term]=$value;
}
}
	

if (!function_exists('DBdeleteRow'))
{
function DBdeleteRow($db,$table,$id,$key="")
{
	if (strlen($key) == 0) $key=$table."id";
	$query="delete from $table where $key=$id";
	if (pearcheck($toss=$db->query($query)))
	{
		return $toss->getMessage();
		DBerror($db,"Failed to delete",$query);
	}
	else
		return;
}
}

if (!function_exists('form_table_row'))
{
function form_table_row($tag,$type,$column,$comments="",$value="",$row=NULL)
{
	$a="\n<TR>".formTagItem($tag)."<TD>";
	switch ($type)
	{
		case "int":
		case "float":
		case "char":
		case "varchar":
			$a.="<INPUT name='$column'";
			if (strlen($value) > 0)
				$a.=" value=\"".$value."\"";
			else if (isset($_REQUEST[$column]))
				$a.=" value=\"".PKH_output_fix($_REQUEST[$column])."\"";
			else if (!is_null($row))
				$a.=" value=\"".$row[$column]."\"";
			$a.=">";
			break;
		case "password":
			$a.="<INPUT type=password name='$column' value='";
			if (strlen($value) > 0)
				$a.=$value;
			else
				$a.=$_REQUEST[$column];
			$a.="'>";
			break;
		case "text":
			$a.="<TEXTAREA name='$column'>$value</TEXTAREA>";
			break;
		default:
			break;
	}
	$a.="</TD><TD align=left>$comments</TD></TR>";
	return $a;
}
}
################################################################################
#PRELIMINARIES
################################################################################
if (!isset($_SERVER["HTTPS"]) || ($_SERVER["HTTPS"] != "on"))
{
	buggywuggy("Redirecting to ".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);
	redirects($_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);
}
if (!isset($_SERVER["SSL_CLIENT_CERT"]))
{
	die("You have to present a registered personal certificate to come here.");
}
$cert=$_SERVER["SSL_CLIENT_CERT"];
$serial=$_SERVER["SSL_CLIENT_M_SERIAL"];
$query="select * from officer where serialNumber = ".hexdec($serial);
if (pearcheck($res=$db->query($query)))
{
	DBerror($db,"Could not get any officers.",$query);
	die("We are sorry but we are having trouble finding your record as an officer.");
}
if (!PEAR::isError($res)) while ($officer=$res->fetchRow())
{
	if ($officer["certificate"] == $cert) break;
#echo "<BR>The ".strlen($cert)." character certificate presented is:<BR>$cert<BR>and the ".strlen($officer["certificate"])." character certificate in the database is<BR>".$officer["certificate"];
	unset($officer);
}
else
{
	DBerror($db,"Error in looking at the officer table.",$query);
}
if (!isset($officer))
{
	$res=$db->query("select * from bad_officer where serialNumber = ".hexdec($serial));
	if (!PEAR::isError($res)) while ($bad=$res->fetchRow())
	{
		if ($bad["certificate"] == $cert)
		{
			$attempts=$bad["attempts"]+1;
			$db->query("update bad_officer set attempts=$attempts,last=now() where bad_officerid=".$bad["bad_officerid"]);
			die("We still have not registered your certificate and you have now tried $attempts times.");
		}
	}
	$query="insert into bad_officer (serialNumber,commonName,certificate) values ("
		.hexdec($serial).",'".$_SERVER["SSL_CLIENT_S_DN_CN"]."','".$_SERVER["SSL_CLIENT_CERT"]."')";
	$res=$db->query($query);
	if (PEAR::isERROR($res))
	{
		loggywoggy ("Bad insert query<BR>$query\n".$res->getMessage());
		die ("Sorry but we were unable to capture your certificate.");
	}
	die("Your certificate is not registered with us.  Please take care of this before you return.");
}
$officerid=$officer["officerid"];
################################################################################
#BEGINNING OF ACTUAL CONTENT--COMMANDS
################################################################################

if (!isset($_REQUEST["command"])) $_REQUEST["command"]="NIL";
if (!isset($_REQUEST["display"])) $_REQUEST["display"]="NIL";
#$msgs.=addMessage("Our input parameters are:<PRE>".print_r($_REQUEST)."</PRE>");
buggywuggy("About to process the command ".$_REQUEST["command"].".");

switch ($_REQUEST["command"])
{
	case "NIL":
		break;
	case ADDSIGNER:
		#errors.=addError("We do not yet accept third-party certificates.");
		break;
	case STOPCLIENT:
		if (!isset($_REQUEST["clientid"]))
		{
			$errors.=addError("You didn't tell us which client to shut off.");
			PKH_error(STOPCLIENT." command without a clientid.");
			break;
		}
		$clientid=$_REQUEST["clientid"];
	case MODIFYSUBJECT:
		if (!isset($_REQUEST["subjectid"]))
		{
			$errors.=addError("You didn't specify which subject to change.");
			break;
		}
		$subjectid=$_REQUEST["subjectid"];
		$query="select *,(select officerid from client where clientid=s.clientid) as officerid from subject s where subjectid=$subjectid";
		if (pearcheck($subject=$db->getRow($query)))
		{
			$errors.=addError("We could not get this subject for you most likely because the id is wrong.");
			DBerror($db,"We could not get subject $subjectid for officer $officerid.",$query);
			break;
		}
		if ($subject["officerid"] != $officerid)
		{
			PKH_error("Officer $officerid tried to access subject $subjectid.");
			$errors.=addError("You did not enter this subject.  You cannot make changes.");
			break;
		}
#function DBupdateQuery($db,$previous,$table,$key,$label,$fields="",$graphics="",$bitmasks="",$textfiles="",$largeobjects="")
		$fields="clientid,first,surname";
		if(isset($_REQUEST["passphrase"]) && ($_REQUEST["passphrase"] != $subject["passphrase"]))
			$fields.=",passphrase";
		$query=DBupdateQuery($db,$subject,"subject","subjectid","",$fields);
		if (strlen($query) > 0)
		{
			if (pearcheck($toss=$db->query($query)))
			{
				DBerror($db,"We could not make the change to subject.",$query);
				$errors.=addError("We could not make the change to subject.");
			}
			else
			{
				$msgs.=addMessage("Successfully updated the subject.");
				loggywoggy("Subject $subjectid updated by officer $officerid.");
			}
		}
		#Now look at the phonenumber(s).
		$query="select * from phone where subjectid=$subjectid";
		$res=$db->query($query);
		while ($phone=$res->fetchRow())
		{
			$phoneid=$phone["phoneid"];
			if (isset($_REQUEST["deletephone$phoneid"]) && ($_REQUEST["deletephone$phoneid"] == 1))
			{
				if (strlen($toss=DBdeleteRow($db,"phone",$phoneid,"phoneid")) > 0)
				{
					DBerror($db,"Failed to delete phone number $phoneid.",$query);
					$errors.=addError("We failed to expunge phone ".$phone["number"].".");
				}
				else
				{
					$msgs.="We got rid of that ".$phone["number"]." phone number for you.";
					loggywoggy("Officer $officerid deleted phone $phoneid, ".$phone["number"]." for subject $subjectid.");
				}
			}
			else
			{
				$query=DBupdateQuery($db,$phone,"phone","phoneid","p$phoneid","country,areacode,local,extension");
				if (strlen($query)>0)
				{
					if (pearcheck($toss=$db->query($query)))
					{
						DBerror($db,"We failed to update phone ".$phone["number"],$query);
						$errors.=addError("We were unable to update phone ".$phone["number"]);
					}
					else
					{
						$msgs.=addMessage("We successfully updated telephone number ".$phone["number"]);
						loggywoggy("Phone $phoneid updated by officer $officerid for subject $subjectid.");
					}
				}
			}
		}
		#Look for a new phone number.
		if (strlen($missing=missingInputs("country,areacode,local","new")) > 0)
		{
			if ($missing != "country,areacode,local")
			{
				$errors.=addError("We could not add the new number because you didn't give us $missing.");
			}
		}
		else
		{
			$phoneid=DBnextId($db,"phone","phoneid");
			$query=DBinsertQuery($db,"new","insert into phone(phoneid,subjectid,",")values($phoneid,$subjectid,",")","country,areacode,local,extension");
			if (pearcheck($toss=$db->query($query)))
			{
				$errors.=addError("We failed to add the new phone number.");
				DBerror($db,"We failed to add the new phone number.",$query);
			}
			else
			{
				$msgs.=addMessage("We have added the new phone number.");
			}
		}
		$_REQUEST["display"]="viewsubject";
		$_REQUEST["passphrase"]="";
		break;
	case ADDSUBJECT:
		if (strlen($missing=missingInputs("clientid,surname,passphrase")) >0)
		{
			$errors.=addError("We cannot add this subject because you are missing these fields: $missing.");
			$_REQUEST["display"] = "newsubject";
			break;
		}
		$subjectid=DBnextId($db,"subject","subjectid");
		$query=DBinsertQuery($db,"","insert into subject(subjectid,",")values($subjectid,",")","clientid,first,surname,passphrase");
		if (strlen($query)>0)
		{
			if (pearcheck($res=$db->query($query)))
			{
				$msgs.=addMessage("We were unable to add that subject to our database.");
				$msgs.=addMessage("Would you like to try again?");
				buggywuggy("Officer $officerid failed insert with query\n\t$query\n\treason given is\n\t".$res->getMessage());
				$_REQUEST["display"]="newsubject";
			}
			else
			{
				$msgs.=addMessage("Congratulations, we have added ".$_REQUEST["first"]." ".$_REQUEST["surname"]." as subject $subjectid.");
				if (strlen($missing=missingInputs("country,areacode,local")) > 0)
				{
					$msgs.=addMessage("We cannot add the phone number because we are missing $missing.");
				}
				$query=DBinsertQuery($db,"", "insert into phone (subjectid,", ")values($subjectid,", ")", "country,areacode,local,extension");
				if (strlen($query)>0)
				{
					if (pearcheck($phone=$db->query($query)))
					{
						$msgs.=addMessage("We were unable to add the phone number.  You can try again.");
						DBerror($db,"Officer $officerid could not add a phone for subject $subjectid.",$query);
						$_REQUEST["display"]="newphone";
					}
					else
					{
						$msgs.=addMessage("We also added the phone number.");
						loggywoggy("Officer $officerid add a phone number for subject $subjectid.");
					}
				}
				else
				{
					$msgs.=addMessage("There was no information for a telephone number.");
				}
				if ((isset($_REQUEST["morephones"])) && ($_REQUEST["morephones"] == 1))
				{
					$msgs.=addMessage("Now in response to your checking the \"more phones\" box, we give you a chance to enter another phone number.");
					$msgs.=addMessage("You can also use this page to correct any indelicacies committed in your initial data entry.");
					$_REQUEST["display"]="viewsubject";
					$_REQUEST["subjectid"]=$subjectid;
				}
				else
				{
					$msgs.=addMessage("Would you like to do another?");
					$_REQUEST["display"]="newsubject";
					cleanInputs("first,surname,passphrase,areacode,local,extension");
				}
			}
		}
		else
		{
			$msgs.=addMessage("You did not supply any information about the new subject.");
			$_REQUEST["clientid"]=$clientid;
		#	$_REQUEST["signerid"]=$signerid;	#To be used sometime
			$_REQUEST["display"] = "newsubject";
		}
		break;
	case MODIFYCLIENT:
		$clientid=$_REQUEST["clientid"];
		$client=DBrowById($db,"client",$clientid,"clientid");
#function DBupdateQuery($db,$previous,$table,$key,$label,$fields="",$graphics="",$bitmasks="",$textfiles="",$largeobjects="")
		$query=DBupdateQuery($db,$client,"client","clientid","","name,contact,phone,address1,address2,city,state,zip,country,days,signerid");
		if (strlen($query) > 0)
		{
			if (pearcheck($res=$db->query($query)))
			{
				$msgs.=addMessage("We were unable to change the data.");
				buggywuggy("Failed attempt to change a client with\n\t$query\n\t".$res->getMessage());
			}
			else
			{
				$_REQUEST["display"]="viewclient";
			}
		}
		else
		{
			$msgs.=addMessage("You gave us nothing to change, so we didn't.");
			$_REQUEST["display"]="viewclient";
		}
		break;
	case ADDCLIENT:
		$clientid=DBnextId($db,"client","clientid");
		$query=DBinsertQuery($db,"","insert into client(clientid,officerid,",")values($clientid,$officerid,",")","name,contact,phone,address1,address2,city,state,zip,country","signerid,days");
		if (strlen($query) > 0)
		{
			if (pearcheck($res=$db->query($query)))
			{
				$msgs.=addMessage("We were unable to add that client to our database.");
				$msgs.=addMessage("Would you like to try again?");
				buggywuggy("Failed insert with query\n\t$query\n\treason given is\n\t".$res->getMessage());
				$_REQUEST["display"]="newclient";
			}
			else
			{
				$msgs.=addMessage("Congratulations, we have added ".$_REQUEST["name"]." as client $clientid.");
				$msgs.=addMessage("Now you can begin to add some subjects to get the certificates.");
				$_REQUEST["display"]="newsubject";
				addInput("clientid");
			}
		}
		else
		{
			$msgs.=addMessage("You did not supply any information about the new client.");
			$_REQUEST["clientid"]=$clientid;
		#	$_REQUEST["signerid"]=$signerid;	#To be used sometime
			$_REQUEST["display"] = "newclient";
		}
		break;
	case "newsubject":
	case "editsubject":
	case "viewsubject":
	default:
	$msgs.=addMessage("We do not yet handle the ".$_REQUEST["command"]." command.");
}

###################################################################################################
#	Processing is done, now we build the returned page.
###################################################################################################

$nclients=$db->getOne("select count(*) from client where officerid=$officerid");
$nsubjects=$db->getOne("select count(*) from subject where clientid in (select clientid from client where officerid=$officerid)");

buggywuggy("Building the menu.");
addMenu("$self?display=newclient","Register a New Client");
if ($nclients > 0) addMenu("$self?display=listclients","List Clients");
addMenu("$self?display=newsubject","Register a New Subject");
if ($nsubjects > 0) addMenu("$self?display=listsubjects","List Subjects");

buggywuggy("Built the menu.");
echo page_top("ValID Officer control page","",$menubar);
buggywuggy("Displayed the menu.");
echo "\n<H2>Officer Input Page for ".$officer["commonname"]."</H2>";
if (strlen($errors) > 0) echo "<FONT color=red size=+3>$errors</FONT>";
if (strlen($msgs) > 0) echo $msgs;

buggywuggy("About to display ".$_REQUEST["display"].".");
switch ($_REQUEST["display"])
{
	case "newsubject":
		echo "<FORM action=$self method=post>";
		echo "<H2>Enter a new subject</H2>";
		echo "<TABLE>";
		$query="select * from client where officerid=$officerid";
		echo "\n<TR>".formTagItem("Client")."<TD>".DBformSelect($db,"clientid",$query,"clientid","name",$_REQUEST["clientid"])
			."</TD><TD>For which organization are you doing this?</TD></TR>";
		echo "\n<TR><TD>Subject data</TD></TR>";
		echo form_table_row("given name","varchar","first","");
		echo form_table_row("surname","varchar","surname","");
		echo form_table_row("passphrase","password","passphrase","password or phrase");
		echo "\n<TR><TD>Subject's phone</TD><TD></TD><TD>Where will the subject receive the qualifying phone call?</TD></TR>";
		$query="select * from country order by country";
		echo "\n<TR><TD align=right>Country:</TD><TD>".DBformSelect($db,"country",$query,"inet_code","country",$_REQUEST["country"])."</TD></TR>";
		echo form_table_row("area code","varchar","areacode","");
		echo form_table_row("local number","varchar","local","local number including exchange");
		echo form_table_row("extension","varchar","extension","");
		echo "\n<TR><TD></TD><TD><INPUT type=submit name=command value='".ADDSUBJECT."'></TD></TR>";
		echo "\n</TABLE></FORM>";
		break;
	case "newclient":
		echo "<FORM action=$self method=post>";
		echo "<H2>Enroll a new client</H2>";
		echo "<TABLE>";
		echo form_table_row("organization","varchar","name","The name of the organization");
		echo form_table_row("contact name","varchar","contact","Person heading the effort in the organization");
		echo form_table_row("contact phone","varchar","phone","Contact's telephone number");
		echo form_table_row("address1","varchar","address1");
		echo form_table_row("address2","varchar","address2");
		echo form_table_row("city","varchar","city");
		echo form_table_row("state","varchar","state");
		echo form_table_row("Postal Code","varchar","zip");
		$query="select * from country order by country";
		echo "<TR><TD align=right>Country:</TD><TD>".DBformSelect($db,"country",$query,"inet_code","country")."</TD></TR>";
		echo "<TR><TD align=right>Certificate life</TD><TD><INPUT name=days></TD><TD>How many days until the subject certificates expire</TD></TR>";
		$query="select signerid,commonname from signer where officerid=0 or officerid=$officerid";
		echo "\n<TR><TD align=right>Signing Certificate</TD><TD>".DBformSelect($db,"signerid",$query,"signerid","commonname")."</TD><TD>Which certificate will sign the subjects' certificates</TD></TR>";
		echo "\n<TR><TD></TD><TD><INPUT type=submit name=command value='".ADDCLIENT."'></TD></TR>";
		echo "\n</TABLE>\n</FORM>";
		break;
	case "NIL":
		echo "You have $nclients clients who have brought you $nsubjects subjects.";
		break;
	case "extendclient":
		echo "We don't do that yet.";
		break;
	case "listclients":
		$query="select *,(select count(*) from subject where clientid=c.clientid) as number,(now() > ends) as expire from client c where officerid=$officerid order by expire,name";
		if (pearcheck($res=$db->query($query)))
		{
			DBerror($db,"Couldn't get clients for officer $officerid.",$query);
			echo "\nWe could not fetch your clients from the database.";
		}
		else
		{
			echo "\n<H2>Here are your clients</H2>";
			while ($row=$res->fetchRow())
			{
				$clientid=$row["clientid"];
				echo "\n<BR>".$row["name"]."  <A href=$self?display=viewclient&clientid=$clientid>View and edit ".$row["name"]."</A>";
				if (($nsubj=$row["number"]) > 0)
					echo "\n<A href=$self?display=listsubjects&clientid=".$row["clientid"].">View subject list for ".$row["name"]."</A> ($nsubj total)";
				else
					echo "\nThis client has no subjects registered.";
				if ($row["expire"] == "t")
					echo "\n<A href=$self?display=extendclient&clientid=$clientid>Extend the deadline of ".$row["ends"]."</A>";
				else
					echo "\n<A href=$self?command=stopclient&clientid=$clientid>Shut down this client</A>";
			}
		}
		break;
	case "listsubjects":
		if (isset($_REQUEST["clientid"]))
		{
			$query="select * from subject where clientid=".$_REQUEST["clientid"];	####Privacy breach without checking if officer owns client.
			echo "<H2>Subject list for ".$db->getOne("select name from client where clientid=".$_REQUEST["clientid"])."</H2>";
		}
		else
		{
			echo "<H2>Subject list for ".$officer["commonname"]."</H2>";
			$query="select * from subject where clientid in (select clientid from client where officerid=$officerid)";
		}
		$query.=" order by surname,first";
		if (pearcheck($res=$db->query($query)))
		{
			echo "Your query,<BR>$query<BR>failed because<BR>".$res->getMessage();
		}
		else
		{
			while ($row=$res->fetchRow())
			{
				echo "\n<BR>"."<A href=$self?display=viewsubject&subjectid=".$row["subjectid"].">".$row["first"]." ".$row["surname"]."</A>";
			}
		}
		break;
	case "editclient":
	case "viewclient":
		$query="select * from client where clientid=".$_REQUEST["clientid"]." and officerid=$officerid";
		if (pearcheck($client=$db->getRow($query)))
		{
			echo "\n<P>We could not get this client for you.  Either it's not yours or it doesn't exist.";
			loggywoggy("Officer $officerid failed to get a client with\n\t$query");
			break;
		}
		echo "\n<H2>Data for ".$client["name"]."</H2>";
		echo "\n<FORM action=$self method=post>";
		echo "\n<INPUT type=hidden name=clientid value=".$client["clientid"].">";
		echo "\n<TABLE>";
#function form_table_row($tag,$type,$column,$comments="",$value="",$row=NULL)
		echo form_table_row("organization","varchar","name","The name of the organization",$client["name"]);
		echo form_table_row("contact name","varchar","contact","Person heading the effort in the organization",$client["contact"]);
		echo form_table_row("contact phone","varchar","phone","Contact's telephone number",$client["phone"]);
		echo form_table_row("address1","varchar","address1","",$client["address1"]);
		echo form_table_row("address2","varchar","address2","",$client["address2"]);
		echo form_table_row("city","varchar","city","",$client["city"]);
		echo form_table_row("state","varchar","state","",$client["state"]);
		echo form_table_row("Postal Code","varchar","zip","",$client["zip"]);
#function DBformSelect($db,$name,$query,$values,$display,$default="")
		$query="select * from country order by country";
		echo "<TR>".formTagItem("country")."<TD>".DBformSelect($db,"country",$query,"inet_code","country",$client["country"])."</TD></TR>";
		echo form_table_row("certificate life","int","days","How many days until the subject certificates expire",$client["days"]);
		$query="select signerid,commonname from signer where officerid=0 or officerid=$officerid";
		echo "<TR><TD align=right>Signing Certificate</TD><TD>".DBformSelect($db,"signerid",$query,"signerid","commonname",$client["signerid"])."</TD><TD>Which certificate will sign the subjects' certificates</TD></TR>";
		echo "<TR><TD></TD><TD><INPUT type=submit name=command value='".MODIFYCLIENT."'></TD></TR>";
		echo "\n</TABLE></FORM>";
		break;
	case "editsubject":
	case "viewsubject":
		if (!isset($_REQUEST["subjectid"]))
		{
			PKH_error("\nWe are unable to show you this subject because you did not give us the identifier.");
			break;
		}
		$subjectid=$_REQUEST["subjectid"];
		$query="select *,(select officerid from client where clientid=s.clientid) as officerid from subject s where subjectid=$subjectid";
		if (pearcheck($subject=$db->getRow($query)))
		{
			echo "\n<P>We could not get this subject for you most likely because the id is wrong.";
			DBerror($db,"We could not get subject $subjectid for officer $officerid.",$query);
			break;
		}
		if ($subject["officerid"] != $officerid)
		{
			PKH_error("Officer $officerid tried to access subject $subjectid.");
			break;
		}
		#Now we can actually start the display.
		echo "\n<H2>Data for ".$subject["first"]." ".$subject["surname"]."</H2>";
		echo "\n<FORM action=$self method=post>";
		echo "\n<INPUT type=hidden name=subjectid value=$subjectid>";
		echo "\n<TABLE>";
		$query="select * from client where officerid=$officerid";
		echo "\n<TR>".formTagItem("client")."<TD>".DBformSelect($db,"clientid",$query,"clientid","name",$subject["clientid"])."</TD></TR>";
		echo form_table_row("given name","varchar","first","","",$subject);
		echo form_table_row("surname","varchar","surname","","",$subject);
		echo form_table_row("pass phrase","password","passphrase","Fill this in only if you want to change it.");
		$query="select * from phone where subjectid=$subjectid";
		if (pearcheck($res=$db->query($query)))
		{
			echo "\n<TR><TD></TD><TD colspan=5>We were unable to find any phone numbers.</TD></TR>";
		}
		else
		{
			$nphones=nrows($res);
			echo "\n<TR>".formTagItem("phone number".if_s($nphones>0))."<TD colspan=5><TABLE>";
			echo "\n<TR><TH>country</TH><TH>area/city code</TH><TH>local number</TH><TH>extension</TH></TR>";
			while ($row=$res->fetchRow())
			{
				$phoneid=$row["phoneid"];
				$query="select * from country order by country";
				echo "\n<TR><TD>".DBformSelect($db,"p$phoneid"."country",$query,"inet_code","country",$row["country"])."</TD>";
				echo "\n\t<TD><INPUT name=p$phoneid"."areacode value=\"".$row["areacode"]."\"></TD>";
				echo "\n\t<TD><INPUT name=p$phoneid"."local value=\"".$row["local"]."\"></TD>";
				echo "\n\t<TD><INPUT name=p$phoneid"."extension value=\"".$row["extension"]."\"></TD>";
				echo "\n\t<TD><INPUT type=checkbox name=deletephone$phoneid value=1>delete ".$row["number"]."</TD>";
				echo "</TR>";
			}
			$query="select * from country order by country";
			echo "\n<TR><TD>".DBformSelect($db,"newcountry",$query,"inet_code","country",$row["country"])."</TD>";
			echo "<TD><INPUT name=newareacode></TD>";
			echo "<TD><INPUT name=newlocal></TD>";
			echo "<TD><INPUT name=newextension></TD>";
			echo "</TR>";
			echo "</TABLE></TD></TR>";
		}
		echo "\n<TR><TD></TD><TD><INPUT type=submit name=command value=\"".MODIFYSUBJECT."\"></TD></TR>";
		echo "\n</TABLE></FORM>";
		break;
	default:
		echo "We do not yet render the ".$_REQUEST["display"]." page.";
		
}


?>