<?php
include '../db/db.php';
session_start();
$log = htmlspecialchars(strip_tags(trim($_SESSION['user'])), ENT_QUOTES, 'UTF-8');
$menu = htmlspecialchars(trim($_SESSION['menu']), ENT_QUOTES, 'UTF-8');
$emp_id = htmlspecialchars(trim($_SESSION['emp_id']), ENT_QUOTES, 'UTF-8');

if (empty($log)) {     
	$redirectUrl = "../";
	echo "<script type=\"text/javascript\">";
	echo "window.location.href = '$redirectUrl'";
	echo "</script>";
	 
} else {
	$sqlu = "SELECT * FROM user_priv_q WHERE emp_id='$emp_id' AND user='$log' AND menu_id='$menu'";
	$stmtu = mysqli_query($conn, $sqlu);
	$countu = mysqli_num_rows($stmtu);
	
	if($countu == 1){
		$rowuser = mysqli_fetch_assoc($stmtu);
		$uid = $rowuser['user_id'];
		
		date_default_timezone_set('Asia/Colombo');
		$date = date("Y-m-d");
				
		/****************************** Insert *************************************/
		
		if(isset($_POST["s_name"])) {
			$s_name = htmlspecialchars(strip_tags(trim($_POST['s_name'])), ENT_QUOTES, 'UTF-8');
			$desig = htmlspecialchars(strip_tags(trim($_POST['desig'])), ENT_QUOTES, 'UTF-8');
			$nic_no = htmlspecialchars(strip_tags(trim($_POST['nic_no'])), ENT_QUOTES, 'UTF-8');
			$address = htmlspecialchars(strip_tags(trim($_POST['address'])), ENT_QUOTES, 'UTF-8');
			$tel_no = htmlspecialchars(strip_tags(trim($_POST['tel_no'])), ENT_QUOTES, 'UTF-8');
			$email = htmlspecialchars(strip_tags(trim($_POST['email'])), ENT_QUOTES, 'UTF-8');
			
			if(empty($s_name) || empty($nic_no)) {
				echo 'empty';
			
			} else {
				$sqln = mysqli_query($conn, "SELECT * FROM staff_members WHERE nic_no='$nic_no'");
				if(mysqli_num_rows($sqln) == 0) {	
					$sql = "INSERT INTO staff_members SET name='$s_name', designation='$desig', address='$address', nic_no='$nic_no', contact_no='$tel_no', email='$email', user='$uid', date='$date'";
					$stmt_log = mysqli_query($conn, $sql);

					if( $stmt_log === false ) {
						echo 'error';
					
					} else {
						echo 'success';
					}
				
				} else {
					echo 'exist';
				}
			}
		}
		
		/****************************** Load Form Data *************************************/
	    
		if (array_key_exists('get_dataset', $_POST)) {
	      $id = htmlspecialchars(strip_tags(trim($_POST['id'])), ENT_QUOTES, 'UTF-8');

	      $sql = mysqli_query($conn, "SELECT * FROM staff_members WHERE id=$id"); 
	      $row = mysqli_fetch_assoc($sql);
	      
	      echo json_encode($row);
	    }	
		
		/****************************** Edit *************************************/
		
		if(isset($_POST['id_up'])) {
			$id = htmlspecialchars(strip_tags(trim($_POST['id_up'])), ENT_QUOTES, 'UTF-8'); 
			$s_name = htmlspecialchars(strip_tags(trim($_POST['s_name_up'])), ENT_QUOTES, 'UTF-8');
			$desig = htmlspecialchars(strip_tags(trim($_POST['desig_up'])), ENT_QUOTES, 'UTF-8');
			$nic_no = htmlspecialchars(strip_tags(trim($_POST['nic_no_up'])), ENT_QUOTES, 'UTF-8');
			$address = htmlspecialchars(strip_tags(trim($_POST['address_up'])), ENT_QUOTES, 'UTF-8');
			$tel_no = htmlspecialchars(strip_tags(trim($_POST['tel_no_up'])), ENT_QUOTES, 'UTF-8');
			$email = htmlspecialchars(strip_tags(trim($_POST['email_up'])), ENT_QUOTES, 'UTF-8');
			
			if(empty($s_name) || empty($nic_no) || empty($id)) {
				echo 'empty';
			
			} else {
				$sqln = mysqli_query($conn, "SELECT * FROM staff_members WHERE nic_no='$nic_no' and id!='$id'");
				if(mysqli_num_rows($sqln) == 0) {	
					$sql = "UPDATE staff_members SET name='$s_name', designation='$desig', address='$address', nic_no='$nic_no', contact_no='$tel_no', email='$email', user='$uid' WHERE id='$id'";
					$stmt_log = mysqli_query($conn, $sql);

					if( $stmt_log === false ) {
						echo 'error';
					
					} else {
						echo 'success';
					}
				
				} else {
					echo 'exist';
				}
			}

		}
		
		/****************************** Remove *************************************/
		
	    if (array_key_exists('remove_data', $_POST)) {

	        $id = htmlspecialchars(trim($_POST['id']), ENT_QUOTES, 'UTF-8');
			$sql_c = mysqli_fetch_assoc(mysqli_query($conn, "SELECT prof_pic FROM staff_members WHERE id=$id"));	  
		  
		    $stmt = mysqli_query( $conn, "SELECT emp_id FROM user_acc_tbl WHERE emp_id=$id");
		    $row_count = mysqli_num_rows( $stmt );
			
			if($row_count == 0) {
				$sql = "DELETE FROM staff_members WHERE id=$id";
				$stmt_log = mysqli_query($conn, $sql);
				
				if( $stmt_log === false ) {
					echo json_encode(array("msgType" => 2, "msg" => "Sorry ! not deleted"));
				
				} else {
					if(!empty($sql_c['prof_pic'])) {
						$path_c = "../../upload_img/staff/".$sql_c['prof_pic'];
						$files = glob($path_c);
						foreach($files as $file) {
							unlink($file);
						}
					}
					echo json_encode(array("msgType" => 1, "msg" => "Successfully Removed"));
				}
			
			} else {
				echo json_encode(array("msgType" => 3, "msg" => "data exist"));
			}
	    }
		
		/**************************************************************************/
	
	} else{
		$redirectUrl = "../";
		echo "<script type=\"text/javascript\">";
		echo "window.location.href = '$redirectUrl'";
		echo "</script>";
	}
}
?>