orders_list.php

<?php
require_once 'includes/auth.php';
require_login();
require_once 'includes/db.php';

$orderBy = in_array($_GET['orderBy'] ?? '', [
  'beleg','pos','artikel','bezeichnung_artikel','menge','liefermenge','versendet','verpackt','in_produktion','offen','liefertermin','verwendung'
]) ? $_GET['orderBy'] : 'id';
$orderDir = ($_GET['orderDir'] ?? 'ASC') === 'DESC' ? 'DESC' : 'ASC';

$where = [];
$params = [];
if (!empty($_GET['search'])) {
  $where[] = "(artikel LIKE ? OR bezeichnung_artikel LIKE ?)";
  $params[] = '%'.$_GET['search'].'%';
  $params[] = '%'.$_GET['search'].'%';
}
if (!empty($_GET['from'])) {
  $where[] = "liefertermin >= ?";
  $params[] = $_GET['from'];
}
if (!empty($_GET['to'])) {
  $where[] = "liefertermin <= ?";
  $params[] = $_GET['to'];
}
$where_sql = $where ? 'WHERE '.implode(' AND ', $where) : '';

$sql = "SELECT * FROM orders $where_sql ORDER BY $orderBy $orderDir";
$stmt = $pdo->prepare($sql);
$stmt->execute($params);

$orders = $stmt->fetchAll(PDO::FETCH_ASSOC);
header('Content-Type: application/json');
echo json_encode($orders);