prepare("SELECT * FROM orders WHERE id = ?"); $stmt->execute([$id]); $order = $stmt->fetch(); if (!$order) { admin_set_flash('error', 'Order not found'); header('Location: ' . ADMIN_PATH . 'pages/orders.php'); exit; } $order_items = get_order_items($id); if ($_SERVER['REQUEST_METHOD'] == 'POST' && verify_csrf($_POST[CSRF_TOKEN_NAME] ?? '')) { $order_status = $_POST['order_status'] ?? $order['order_status']; $payment_status = $_POST['payment_status'] ?? $order['payment_status']; $stmt = $db->prepare("UPDATE orders SET order_status = ?, payment_status = ? WHERE id = ?"); $stmt->execute([$order_status, $payment_status, $id]); admin_set_flash('success', 'Order updated'); header('Location: ' . ADMIN_PATH . 'pages/order-details.php?id=' . $id); exit; } ?>
| Product | Qty | Price | Total |
|---|---|---|---|
|
|
= $item['quantity'] ?> | = format_currency($item['price']) ?> | = format_currency($item['total']) ?> |
= htmlspecialchars($order['first_name'] . ' ' . $order['last_name']) ?>
= htmlspecialchars($order['email']) ?>
= htmlspecialchars($order['phone']) ?>