<?php
header('Content-type: application/json');
include '../db/db.php';
session_start();
$log = htmlspecialchars(trim($_SESSION['user']), ENT_QUOTES, 'UTF-8');
$log_lang = htmlspecialchars(trim($_SESSION['lang']), ENT_QUOTES, 'UTF-8');

$menu = htmlspecialchars(trim($_SESSION['menu']), ENT_QUOTES, 'UTF-8');
$emp_id = htmlspecialchars(trim($_SESSION['emp_id']), ENT_QUOTES, 'UTF-8');

if (empty($log)) {
	$redirectUrl = "index.php";
	echo "<script type=\"text/javascript\">";
	echo "window.location.href = '$redirectUrl'";
	echo "</script>";

} else {

	$sqlu = "SELECT * FROM user_priv_q WHERE emp_id='$emp_id' AND user='$log' AND menu_id='$menu'";
	$resultu = mysqli_query($conn, $sqlu);
	$countu = mysqli_num_rows($resultu);

	if($countu == 1){
		$rowc = mysqli_fetch_assoc($resultu);
		$user_id = $rowc['user_id'];
		
		date_default_timezone_set('Asia/Colombo');
		$date_today = date("Y-m-d");

		/****************************** Insert Eng *************************************/

		if(isset($_FILES['img_upload'])) {	
			if($_FILES["img_upload"]["name"] != '') {
				$name = htmlspecialchars(strip_tags(trim($_POST['name'])), ENT_QUOTES, 'UTF-8');
				$address = htmlspecialchars(strip_tags(trim($_POST['address'])), ENT_QUOTES, 'UTF-8');
				$dob = htmlspecialchars(strip_tags(trim($_POST['dob'])), ENT_QUOTES, 'UTF-8');
				$nic = htmlspecialchars(strip_tags(trim($_POST['nic'])), ENT_QUOTES, 'UTF-8');
				$designation = htmlspecialchars(strip_tags(trim($_POST['designation'])), ENT_QUOTES, 'UTF-8');
				$tel = htmlspecialchars(strip_tags(trim($_POST['tel'])), ENT_QUOTES, 'UTF-8');
				$email = htmlspecialchars(strip_tags(trim($_POST['email'])), ENT_QUOTES, 'UTF-8');
				$gender = htmlspecialchars(strip_tags(trim($_POST['gender'])), ENT_QUOTES, 'UTF-8');
				$service = htmlspecialchars(strip_tags(trim($_POST['service'])), ENT_QUOTES, 'UTF-8');
				$status = htmlspecialchars(strip_tags(trim($_POST['status'])), ENT_QUOTES, 'UTF-8');
				$division = htmlspecialchars(strip_tags(trim($_POST['division'])), ENT_QUOTES, 'UTF-8');

				$sql_u = mysqli_query($conn, "SELECT nic_no FROM staff_members WHERE nic_no='$nic' AND del=0");

				$valid_extensions = array('png','jpg','jpeg'); // valid extensions
				$path = '../upload/staff_member/'; // upload directory	

				// get uploaded file's extension
				$ext = strtolower(pathinfo($_FILES["img_upload"]["name"], PATHINFO_EXTENSION));
				$tmp = $_FILES['img_upload']['tmp_name'];

				// check valid format
				if(in_array($ext, $valid_extensions)) 
				{					
					$img_name = rand(100000, 999999).'.'.$ext;	
					$path = $path.$img_name;	
						
					if (file_exists($path))
					{			
						$response['status'] = '2'; // File Exists
					
					} else {
						
						if(mysqli_num_rows($sql_u) == 0) {
					
							if($log_lang == 1) {
								if(move_uploaded_file($tmp,$path)) 
								{	
									// Password Hash
									$pwd = hash('sha256', $nic);
							
									$sql = "INSERT INTO staff_members SET name='$name', address='$address', designation='$designation', nic_no='$nic', contact_no='$tel', dob='$dob', gender='$gender', email='$email', date='$date_today', user='$user_id', prof_pic='$img_name', service='$service', pwd='$pwd', status='$status', division='$division'";

									if(mysqli_query($conn, $sql)) {
										$response['status'] = '1'; // Success
									
									} else {
										$response['status'] = '3'; // Sql Error
									}
								
								} else{				
								  //exit("Error While uploading image on the server");
								  $response['status'] = '4'; // Uploading Error
								}
							}
						
						} else {
							$response['status'] = '6'; //Duplicate NIC No
						}
					}
				} 
				else 
				{
					$response['status'] = '5'; // Invaild File
				}
			 
			}
			echo json_encode($response);	
		}
		
		/****************************** Insert *************************************/
		if (array_key_exists('staff_reg', $_POST)) {
			$name = htmlspecialchars(strip_tags(trim($_POST['name'])), ENT_QUOTES, 'UTF-8');
			$address = htmlspecialchars(strip_tags(trim($_POST['address'])), ENT_QUOTES, 'UTF-8');
			$dob = htmlspecialchars(strip_tags(trim($_POST['dob'])), ENT_QUOTES, 'UTF-8');
			$nic = htmlspecialchars(strip_tags(trim($_POST['nic'])), ENT_QUOTES, 'UTF-8');
			$designation = htmlspecialchars(strip_tags(trim($_POST['designation'])), ENT_QUOTES, 'UTF-8');
			$tel = htmlspecialchars(strip_tags(trim($_POST['tel'])), ENT_QUOTES, 'UTF-8');
			$email = htmlspecialchars(strip_tags(trim($_POST['email'])), ENT_QUOTES, 'UTF-8');
			$gender = htmlspecialchars(strip_tags(trim($_POST['gender'])), ENT_QUOTES, 'UTF-8');
			$service = htmlspecialchars(strip_tags(trim($_POST['service'])), ENT_QUOTES, 'UTF-8');
			$status = htmlspecialchars(strip_tags(trim($_POST['status'])), ENT_QUOTES, 'UTF-8');
			$division = htmlspecialchars(strip_tags(trim($_POST['division'])), ENT_QUOTES, 'UTF-8');
			
			$sql_u = mysqli_query($conn, "SELECT nic_no FROM staff_members WHERE nic_no='$nic' AND del=0");
			
			if($log_lang == 1) {
				if(mysqli_num_rows($sql_u) == 0) {
					// Password Hash
					$pwd = hash('sha256', $nic);

					$sql = "INSERT INTO staff_members SET name='$name', address='$address', designation='$designation', nic_no='$nic', contact_no='$tel', dob='$dob', gender='$gender', email='$email', date='$date_today', user='$user_id', service='$service', pwd='$pwd', status='$status', division='$division'";

					if(mysqli_query($conn, $sql)) {
						echo json_encode(array("msgType" => 1, "msg" => "Successfully Added"));
					
					} else {
						echo json_encode(array("msgType" => 2, "msg" => "Sorry ! Could not be Save Data"));
					}
				
				} else {
					echo json_encode(array("msgType" => 3, "msg" => "Duplicate NIC No"));
				}
			}
		}
		
		/****************************** Remove *************************************/
		
		if (array_key_exists('remove_reg', $_POST)) {	
			
			if($log_lang == 1) {			
				$reg_id = htmlspecialchars(strip_tags(trim($_POST['reg_id'])), ENT_QUOTES, 'UTF-8');		
				$sqld = mysqli_query($conn, "SELECT * FROM user_acc_tbl WHERE emp_id='$reg_id'");
				
				if(mysqli_num_rows($sqld) == 0) {
					$sql = "UPDATE staff_members SET del=1 WHERE id='$reg_id'";
					
					if(!empty($reg_id)) {
					
						if(mysqli_query($conn, $sql)) {
							echo json_encode(array("msgType" => 1, "msg" => "Successfully Removed"));
						
						} else {
							echo json_encode(array("msgType" => 2, "msg" => "Sorry ! not deleted"));
						}
					
					} else {
						echo json_encode(array("msgType" => 2, "msg" => "Sorry ! empty id"));
					}
				
				} else {
					echo json_encode(array("msgType" => 3, "msg" => "Data Already Exist"));
				}	
			}
		}		
		
		/****************************** Load Form Data *************************************/
		
		if (array_key_exists('get_dataset', $_POST)) {

			$reg_id = htmlspecialchars(strip_tags(trim($_POST['reg_id'])), ENT_QUOTES, 'UTF-8');

			$data = array();
			$sql = mysqli_query($conn, "SELECT * FROM staff_members WHERE id=$reg_id AND del=0");

			while ($row = mysqli_fetch_assoc($sql)) {
				$data[] = $row;
			}
			echo json_encode($data);
		}
		
		/****************************** Update Eng/Sinhala/Tamil *************************************/
		
		if (array_key_exists('update_dr_lang', $_POST)) {
			$reg_id = htmlspecialchars(strip_tags(trim($_POST['reg_id'])), ENT_QUOTES, 'UTF-8');

			$name = htmlspecialchars(strip_tags(trim($_POST['name'])), ENT_QUOTES, 'UTF-8');
			$address = htmlspecialchars(strip_tags(trim($_POST['address'])), ENT_QUOTES, 'UTF-8');
			$dob = htmlspecialchars(strip_tags(trim($_POST['dob'])), ENT_QUOTES, 'UTF-8');
			$nic = htmlspecialchars(strip_tags(trim($_POST['nic'])), ENT_QUOTES, 'UTF-8');
			$designation = htmlspecialchars(strip_tags(trim($_POST['designation'])), ENT_QUOTES, 'UTF-8');
			$tel = htmlspecialchars(strip_tags(trim($_POST['tel'])), ENT_QUOTES, 'UTF-8');
			$email = htmlspecialchars(strip_tags(trim($_POST['email'])), ENT_QUOTES, 'UTF-8');
			$gender = htmlspecialchars(strip_tags(trim($_POST['gender'])), ENT_QUOTES, 'UTF-8');
			$service = htmlspecialchars(strip_tags(trim($_POST['service'])), ENT_QUOTES, 'UTF-8');
			$status = htmlspecialchars(strip_tags(trim($_POST['status'])), ENT_QUOTES, 'UTF-8');
			$division = htmlspecialchars(strip_tags(trim($_POST['division'])), ENT_QUOTES, 'UTF-8');
				
			$sql_u = mysqli_query($conn, "SELECT nic_no FROM staff_members WHERE nic_no='$nic' AND id!='$reg_id' AND del=0");
			
			$sql_up = "UPDATE staff_members SET name='$name', address='$address', designation='$designation', nic_no='$nic', contact_no='$tel', dob='$dob', gender='$gender', email='$email', user='$user_id', service='$service', status='$status', division='$division' WHERE id='$reg_id'";
			
			if($log_lang == 1) {
				if(mysqli_num_rows($sql_u) == 0) {
					if(!empty($reg_id)) {
						
						if(mysqli_query($conn, $sql_up)) {
							echo json_encode(array("msgType" => 1, "msg" => "Successfully updated"));
						
						} else {
							echo json_encode(array("msgType" => 2, "msg" => "Sorry ! Could not be Save Data"));
						}
					
					} else {
						echo json_encode(array("msgType" => 4, "msg" => "Sorry ! empty id"));
					}
				
				} else {
					echo json_encode(array("msgType" => 3, "msg" => "Duplicate NIC No"));
				}
			
			}			
			
		}

		/****************************** Update Image *************************************/

		if(isset($_FILES['img_upload_update'])) {	
			if($_FILES["img_upload_update"]["name"] != '') {
				$reg_id = htmlspecialchars(strip_tags(trim($_POST['reg_id'])), ENT_QUOTES, 'UTF-8');

				$name = htmlspecialchars(strip_tags(trim($_POST['name'])), ENT_QUOTES, 'UTF-8');
				$address = htmlspecialchars(strip_tags(trim($_POST['address'])), ENT_QUOTES, 'UTF-8');
				$dob = htmlspecialchars(strip_tags(trim($_POST['dob'])), ENT_QUOTES, 'UTF-8');
				$nic = htmlspecialchars(strip_tags(trim($_POST['nic'])), ENT_QUOTES, 'UTF-8');
				$designation = htmlspecialchars(strip_tags(trim($_POST['designation'])), ENT_QUOTES, 'UTF-8');
				$tel = htmlspecialchars(strip_tags(trim($_POST['tel'])), ENT_QUOTES, 'UTF-8');
				$email = htmlspecialchars(strip_tags(trim($_POST['email'])), ENT_QUOTES, 'UTF-8');
				$gender = htmlspecialchars(strip_tags(trim($_POST['gender'])), ENT_QUOTES, 'UTF-8');
				$service = htmlspecialchars(strip_tags(trim($_POST['service'])), ENT_QUOTES, 'UTF-8');
				$status = htmlspecialchars(strip_tags(trim($_POST['status'])), ENT_QUOTES, 'UTF-8');
				$division = htmlspecialchars(strip_tags(trim($_POST['division'])), ENT_QUOTES, 'UTF-8');
			
				$sql_u = mysqli_query($conn, "SELECT nic_no FROM staff_members WHERE nic_no='$nic' AND id!='$reg_id' AND del=0");
				
				$valid_extensions = array('png','jpg','jpeg'); // valid extensions
				$path = '../upload/staff_member/'; // upload directory	

				// get uploaded file's extension
				$ext = strtolower(pathinfo($_FILES["img_upload_update"]["name"], PATHINFO_EXTENSION));
				$tmp = $_FILES['img_upload_update']['tmp_name'];

				// check valid format
				if(in_array($ext, $valid_extensions)) 
				{					
					$img_name = rand(100000, 999999).'.'.$ext;	
					$path = $path.$img_name;	
						
					if (file_exists($path))
					{			
						$response['status'] = '2'; // File Exists
					
					} else if(!empty($reg_id)) {
						if(mysqli_num_rows($sql_u) == 0) {
						
							$sql_eng = mysqli_fetch_assoc(mysqli_query($conn, "SELECT prof_pic FROM staff_members WHERE id='$reg_id'"));	

							if(!empty($sql_eng['prof_pic'])) {
								$path_old = "../upload/staff_member/".$sql_eng['prof_pic'];
								$files = glob($path_old);
								
								foreach($files as $file) {
									unlink($file);
								}
							}
							
							if(move_uploaded_file($tmp,$path)) 
							{  
								if($log_lang == 1) {					
									$sql = "UPDATE staff_members SET name='$name', address='$address', designation='$designation', nic_no='$nic', contact_no='$tel', dob='$dob', gender='$gender', email='$email', user='$user_id', prof_pic='$img_name', service='$service', status='$status', division='$division' WHERE id='$reg_id'";
									
									if(mysqli_query($conn, $sql)) {
										$response['status'] = '1'; // Success
									
									} else {
										$response['status'] = '3'; // Sql Error
									}
								}
							
							} else{				
							  //exit("Error While uploading image on the server");
							  $response['status'] = '4'; // Uploading Error
							}
						} else {
							$response['status'] = '7'; 
						}
					
					} else {
						$response['status'] = '6'; // Empty ID
					}
				} 
				else 
				{
					$response['status'] = '5'; // Invaild File
				}
			 
			}
			echo json_encode($response);	
		}
		
		/****************************** Load Div Address *************************************/
		
		if (array_key_exists('get_div_address', $_POST)) {

			$div = htmlspecialchars(strip_tags(trim($_POST['div'])), ENT_QUOTES, 'UTF-8');
			$sql = mysqli_fetch_assoc(mysqli_query($conn, "SELECT * FROM division WHERE division='$div'"));
			echo json_encode($sql);
		}		
				

		/******************************************************************/		

	} else{
		$redirectUrl = "index.php";
		echo "<script type=\"text/javascript\">";
		echo "window.location.href = '$redirectUrl'";
		echo "</script>";	
	}
}
?>