text: var ContributionsDAO = require("../data/contributions-dao").ContributionsDAO;
  
  /* The ContributionsHandler must be constructed with a connected db */
  function ContributionsHandler(db) {
      "use strict";
  
      var contributionsDAO = new ContributionsDAO(db);
  
      this.displayContributions = function(req, res, next) {
          var userId = req.session.userId;
  
          contributionsDAO.getByUserId(userId, function(error, contrib) {
              if (error) return next(error);
  
              contrib.userId = userId; //set for nav menu items
              return res.render("contributions", contrib);
          });
      };
  
      this.handleContributionsUpdate = function(req, res, next) {
  
          /*jslint evil: true */
          // Insecure use of eval() to parse inputs
          var preTax = eval(req.body.preTax);
          var afterTax = eval(req.body.afterTax);
          var roth = eval(req.body.roth);
  
          /*
          //Fix for A1 -1 SSJS Injection attacks - uses alternate method to eval
          var preTax = parseInt(req.body.preTax);
          var afterTax = parseInt(req.body.afterTax);
          var roth = parseInt(req.body.roth);
          */
          var userId = req.session.userId;
  
          //validate contributions
          if (isNaN(preTax) || isNaN(afterTax) || isNaN(roth) || preTax < 0 || afterTax < 0 || roth < 0) {
              return res.render("contributions", {
                  updateError: "Invalid contribution percentages",
                  userId: userId
              });
          }
          // Prevent more than 30% contributions
          if (preTax + afterTax + roth > 30) {
              return res.render("contributions", {
                  updateError: "Contribution percentages cannot exceed 30 %",
                  userId: userId
              });
          }
  
          contributionsDAO.update(userId, preTax, afterTax, roth, function(err, contributions) {
  
              if (err) return next(err);
  
              contributions.updateSuccess = true;
              return res.render("contributions", contributions);
          });
  
      };
  
  }
  
  module.exports = ContributionsHandler;
  