<?php
/*
* date last modified 28-11-2017
* Edited by PI-Digi Logical Solutions
* HTML Files - add_user.html.php
* Mysql Tables - tbl_designation, tbl_staff
*/
include('includes/imgFunctions.php');
include('includes/functions.php'); # general functions

$isEdit = FALSE;


if(isset($_REQUEST['id']) && $_REQUEST['id']!=''){
	
	$isEdit = TRUE;
	$editId = mysqli_real_escape_string($con, trim($_REQUEST['id']));
	
	//delete image
	if(isset($_REQUEST['action']) && $_REQUEST['action']=='del_image'){
		$recImg = mysqli_fetch_array(mysqli_query($con, "SELECT image FROM tbl_staff WHERE id = '".$editId."'"));
		if(($recImg['image']!='') && file_exists(STAFF_IMG_FOLDER.$recImg['image'])){
			unlink(STAFF_IMG_FOLDER.$recImg['image']);
			unlink(STAFF_IMG_FOLDER.'thumb/'.$recImg['image']);
		}
		$update = mysqli_query($con, "UPDATE tbl_staff SET image = '' WHERE id = '".$editId."'");
		$success = 'Staff image has been deleted';
	}	
	
	$editRs = mysqli_query($con, "SELECT * FROM tbl_staff WHERE id = '".$editId."'");
	if(mysqli_num_rows($editRs)>0){
		$resEdit = mysqli_fetch_array($editRs);
	} else {
		$error = 'Staff does not exist!';
	}

} 

if(isset($_POST['add'])) {
	
	
	
	if(isset($_FILES['photo']) && $_FILES['photo']['size'] > 0) {		
		if($_FILES['photo']['type'] == 'image/gif' || $_FILES['photo']['type'] == 'image/jpeg' || 
		   $_FILES['photo']['type'] == 'image/png' || $_FILES['photo']['type'] == 'image/pjpeg') {
			$photo_name = $_FILES['photo']['name'];			
			$photo_temp_name = $_FILES['photo']['tmp_name'];
			$photo_extension = pathinfo($photo_name, PATHINFO_EXTENSION);
		} else {
			$photo_name = FALSE;
			$photo_temp_name = FALSE;
			$error = "Invalid Image type. Only gif, jpg and png allowed";
		}
	}
	
	if(strlen(trim($_POST['salary'])) > 0) {
		$salary = trim($_POST['salary']);
		if(is_numeric($salary) && $salary>0){
			//ok
		} else {
			$error = 'Please enter positive digits.';
		}
	} else {
		$error = 'Please enter salary';
	}
	
	if(strlen(trim($_POST['designation'])) > 0) {
		$designation = trim($_POST['designation']);
	} else {
		$error = 'Please select designation';
	}
	
	if(strlen(trim($_POST['address'])) > 0) {
		$address = trim($_POST['address']);
	} else {
		$error = 'Please enter address';
	}	
		
	if(strlen(trim($_POST['phone'])) > 0) {
		$phone = trim($_POST['phone']);
	} else {
		$error = 'Please enter Phone Number';
	}
	
	if(isset($_POST['email']) && strlen(trim($_POST['email'])) > 0) {
		$email = trim($_POST['email']);
		if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
			$error =  "E-mail is not valid";
		} else {
			// check Email
			$checkEmail = mysqli_query($con,'SELECT id FROM tbl_staff WHERE email="'.mysqli_real_escape_string($con,$email).'"');
			if(isset($checkEmail) && mysqli_num_rows($checkEmail)>0) {
				$error = 'Email Already Taken';
			}
		}
	} else {
		$error = 'Please enter Email';
	}
	
	if(isset($_POST['name']) && strlen($_POST['name'])>0) {
		$name = trim($_POST['name']);
	} else {
		$error = 'Please enter Name of Staff';
	}	
	
	
	
	if(empty($error)) {
						
		/* Adding New staff Details */		
		$insertQry = "INSERT INTO tbl_staff(name, email, phone, address, designation, salary, date, status, added_by) VALUES (
		'".mysqli_real_escape_string($con, $name)."',
		 '".mysqli_real_escape_string($con, $email)."',
		 '".mysqli_real_escape_string($con, $phone)."',
		 '".mysqli_real_escape_string($con, $address)."',
		 '".mysqli_real_escape_string($con, $designation)."',
		 '".mysqli_real_escape_string($con, $salary)."',		 
		 NOW(),
		 'Active',
		 '".$_SESSION['adminId']."')";
		
		$execInsert = mysqli_query($con,$insertQry);
		$insert_id = mysqli_insert_id($con);		
		
		if($execInsert) {
			if(isset($_FILES['photo']) && $_FILES['photo']['size'] > 0) {
				$photo_dir = STAFF_IMG_FOLDER;
				$photo_name = $insert_id.'_'.time().'.'.$photo_extension; 
				if(move_uploaded_file($photo_temp_name, $photo_dir.$photo_name)){
					resize2(STAFF_IMG_FOLDER.$photo_name, 200, 150, STAFF_IMG_FOLDER.'thumb/'.$photo_name);
					// update passport copy
					mysqli_query($con, "UPDATE tbl_staff SET image = '".$photo_name."' WHERE id = ".$insert_id);
					//echo "UPDATE tbl_staff SET image = '".$photo_name."' WHERE id = ".$insert_id; exit;
				}			
			}	
			
			$success = 'Staff Added Successfully';
			header('Location:index.php?page=manage_staff&success='.$success);
			exit();			
		}				
	} 
}

if(isset($_POST['update'])) {
	
	if(isset($_FILES['photo']) && $_FILES['photo']['size'] > 0) {		
		if($_FILES['photo']['type'] == 'image/gif' || $_FILES['photo']['type'] == 'image/jpeg' || 
		   $_FILES['photo']['type'] == 'image/png' || $_FILES['photo']['type'] == 'image/pjpeg') {
			$photo_name = $_FILES['photo']['name'];			
			$photo_temp_name = $_FILES['photo']['tmp_name'];
			$photo_extension = pathinfo($photo_name, PATHINFO_EXTENSION);
		} else {
			$photo_name = FALSE;
			$photo_temp_name = FALSE;
			$error = "Invalid Image type. Only gif, jpg and png allowed";
		}
	}
	
	if(strlen(trim($_POST['salary'])) > 0) {
		$salary = trim($_POST['salary']);
		if(is_numeric($salary) && $salary>0){
			//ok
		} else {
			$error = 'Please enter positive digits.';
		}
	} else {
		$error = 'Please enter salary';
	}
	
	if(strlen(trim($_POST['designation'])) > 0) {
		$designation = trim($_POST['designation']);
	} else {
		$error = 'Please select designation';
	}
	
	if(strlen(trim($_POST['address'])) > 0) {
		$address = trim($_POST['address']);
	} else {
		$error = 'Please enter address';
	}	
		
	if(strlen(trim($_POST['phone'])) > 0) {
		$phone = trim($_POST['phone']);
	} else {
		$error = 'Please enter Phone Number';
	}
	
	if(isset($_POST['email']) && strlen(trim($_POST['email'])) > 0) {
		$email = trim($_POST['email']);
		if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
			$error =  "E-mail is not valid";
		} else {
			// check Email
			$checkEmail = mysqli_query($con,"SELECT id FROM tbl_staff WHERE email='".mysqli_real_escape_string($con,$email)."' AND id != '".$editId."'");
			if(isset($checkEmail) && mysqli_num_rows($checkEmail)>0) {
				$error = 'Email Already Taken';
			}
		}
	} else {
		$error = 'Please enter Email';
	}
	
	if(isset($_POST['name']) && strlen($_POST['name'])>0) {
		$name = trim($_POST['name']);
	} else {
		$error = 'Please enter Name of Staff';
	}	
	
	if(empty($error)) {					
			
		$updateQry = "UPDATE tbl_staff SET name = '".$name."', email = '".$email."', phone = '".$phone."', address = '".$address."', designation = '".$designation."', salary = '".$salary."', updated_by = '".$_SESSION['adminId']."', updated_on = NOW()  WHERE id = '".$editId."'";
		
		$execUpdate = mysqli_query($con,$updateQry);			
		
		if($execUpdate) {
			$success = 'Staff Updated Successfully';
			header('Location:index.php?page=manage_staff&success='.$success);
			exit();			
		}				
	} 
}

?>