<?php

// Set response header

header('Content-Type: application/json');



// Include database connection

include 'dbconnection.php';



// Check request method

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    // Honeypot field check

    $honeypot = trim($_POST['honeypot'] ?? '');



    if (!empty($honeypot)) {

        // Optional bot log

        file_put_contents('honeypot_log.txt', date('Y-m-d H:i:s') . " | IP: {$_SERVER['REMOTE_ADDR']}\n", FILE_APPEND);

        echo json_encode(['status' => 'error', 'message' => 'Bot detected.']);

        exit();

    }



    // Sanitize form inputs

    $name = trim($_POST['name'] ?? '');

    $email = trim($_POST['email'] ?? '');

    $message = trim($_POST['message'] ?? '');

    $stdname = trim($_POST['stdname'] ?? '');

    $adno = trim($_POST['adno'] ?? '');



    // Validate required fields

    if (empty($name) || empty($email) || empty($message)) {

        echo json_encode(['status' => 'error', 'message' => 'All fields are required.']);

        exit();

    }



    // Validate email format

    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {

        echo json_encode(['status' => 'error', 'message' => 'Invalid email address.']);

        exit();

    }



    // File validation

    $allowedTypes = ['application/pdf', 'image/jpeg', 'image/png'];

    $maxFileSize = 2 * 1024 * 1024; // 2MB



    $filename = $_FILES['file']['name'] ?? null;

    $filetype = $_FILES['file']['type'] ?? null;

    $filesize = $_FILES['file']['size'] ?? null;

    $filedata = null;



    if (!empty($_FILES['file']['tmp_name'])) {

        if (!in_array($filetype, $allowedTypes)) {

            echo json_encode(['status' => 'error', 'message' => 'Unsupported file type.']);

            exit();

        }



        if ($filesize > $maxFileSize) {

            echo json_encode(['status' => 'error', 'message' => 'File size exceeds the 2MB limit.']);

            exit();

        }



        $filedata = file_get_contents($_FILES['file']['tmp_name']);

    }



    // Prepare insert query using prepared statements

    $stmt = $con->prepare("INSERT INTO feedback (stdname, admission_no, name, email, message, file_name, file_type, file_size, file_data) 

                           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");



    if (!$stmt) {

        echo json_encode(['status' => 'error', 'message' => 'Database error: failed to prepare statement.']);

        exit();

    }



    // Bind parameters

    $stmt->bind_param(

        "sssssssib",

        $stdname,

        $adno,

        $name,

        $email,

        $message,

        $filename,

        $filetype,

        $filesize,

        $filedata

    );



    // Execute and respond

    if ($stmt->execute()) {

        echo json_encode(['status' => 'success', 'message' => 'Thank you for your feedback!']);

    } else {

        echo json_encode(['status' => 'error', 'message' => 'Submission failed. Try again.']);

    }



    $stmt->close();

} else {

    echo json_encode(['status' => 'error', 'message' => 'Invalid request method.']);

}

?>

