<?php
include('../dbconnection/dbconnection.php');
/*
if(isset($_POST["lbtn_action"])){
if($_POST["lbtn_action"]==="stafflogin"){
	$u_email=strtolower($_POST["user_name"]);
	$pass=strtolower($_POST["pass"]);
	$sql=$connect->prepare("SELECT * FROM staff WHERE pass='$pass' AND email='$u_email'");
  $sql->execute();
 $count=COUNT($sql->fetchAll());
	if($count===1){
session_start();
$_SESSION["id"]=$u_email;	
	}else{
		
		echo "Invalid password or email";
	}
}

}*/




$message = '';
if(isset($_POST["lbtn_action"])){
	if($_POST["lbtn_action"]==="stafflogin"){
		$query = "
		SELECT * FROM staff 
			WHERE email = :user_name 
		";
		$statement = $connect->prepare($query);
		$statement->execute(
			array(
					'user_name'	=>	strtolower($_POST["user_name"])
				)
		);
		$count = $statement->rowCount();
		if($count > 0)
		{
			$result = $statement->fetchAll();
			foreach($result as $row)
			{
				if($row['status'] == 1)
				{
					if(password_verify(strtolower($_POST["pass"]), $row["password"]))
					{
					
						$_SESSION['id'] = $row['emp_no'];
						$_SESSION['type'] = $row['account'];
						$_SESSION['user_id'] = $row['national_id'];
						$_SESSION['user_email'] = $row['email'];
						// header("location:index.html");
						// echo $message=trim(strtolower($row['account']));
						echo $message="success";
					}
					 else
					{
						echo $message = "<label>Wrong Password</label>";
					}
				}
				else
				{
					echo $message = "<label>Your account is disabled, Contactthe Main Office</label>";
				}
			}
		}
		else
		{
			echo $message = "<label>Wrong Email Address</label>";
		}
	}	
	
	
	
	if($_POST["lbtn_action"]==="studentlogin"){
		$query = "
		SELECT * FROM students 
			WHERE email = :user_name 
		";
		$statement = $connect->prepare($query);
		$statement->execute(
			array(
					'user_name'	=>	strtolower($_POST["user_name"])
				)
		);
		$count = $statement->rowCount();
		if($count > 0)
		{
			$result = $statement->fetchAll();
			foreach($result as $row)
			{
				if($row['approval'] == 1)
				{
					if(password_verify(strtolower($_POST["pass"]), $row["pass"]))
					{
					
						$_SESSION['id'] = $row['no'];
						$_SESSION['type'] = "student";
						$_SESSION['user_id'] = null;
						$_SESSION['user_email'] = $row['email'];
						// header("location:index.html");
						echo $message=trim(strtolower($_SESSION['type']));
					}
					 else
					{
						echo $message = "<label>Wrong Password</label>";
					}
				}
				else
				{
					echo $message = "<label>Your account is disabled, Contact the Main Office</label>";
				}
			}
		}
		else
		{
			echo $message = "<label>Wrong Email Address</label>";
		}
	}	
	
	if($_POST["lbtn_action"]==="page-comment"){
		
		if(isset($_SESSION['id']) AND isset($_SESSION['type'] )){
			$user=	$_SESSION['id'];
			$type=	$_SESSION['type'];
		}else{
			$user=strtolower($_POST["name"].'#'.$_POST["email"]);
			$type="user";
		}
			 $comment=$_POST['comment'];
			
				$query = "
			INSERT INTO page_comments (user,user_type,comment,date,status)
				VALUES(:user,:type,:com,:dt,:status )
		";
		$statement = $connect->prepare($query);
		$statement->execute(
			array(
					':user'		=>$user,
					':type'		=>$type,
					':com'		=>$comment,
					':dt'		=>time(),
					':status'	=>1
				)
		);
		$result = $statement->fetchAll();
		if(isset($result)){
			echo "success";
		}else{
			echo "Failed to Save. Contact Technical office";
		}
		
		
		
	
	}
	
	
	
}
?>