File Manager

Editing:submit.php

<?php
// orders/submit.php

header('Content-Type: application/json');

require_once '../includes/db.php';
require_once '../includes/functions.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(['success' => false, 'message' => 'Invalid request method.']);
    exit;
}

try {
    // 1. Extract and sanitize inputs
    $customer_name = trim($_POST['customer_name'] ?? '');
    $email = trim($_POST['email'] ?? '');
    $phone = trim($_POST['phone'] ?? '');
    $whatsapp = trim($_POST['whatsapp'] ?? '');
    $address = trim($_POST['address'] ?? '');
    $curtain_type = trim($_POST['curtain_type'] ?? '');
    $fabric = trim($_POST['fabric'] ?? '');
    $color = trim($_POST['color'] ?? '');
    $width = filter_var($_POST['width'] ?? null, FILTER_VALIDATE_FLOAT);
    $height = filter_var($_POST['height'] ?? null, FILTER_VALIDATE_FLOAT);
    $quantity = filter_var($_POST['quantity'] ?? 1, FILTER_VALIDATE_INT);
    $notes = trim($_POST['notes'] ?? '');

// 2. Core validations
    if (empty($customer_name) || empty($email) || empty($phone) || empty($whatsapp) || empty($address) || 
        empty($curtain_type) || empty($fabric) || empty($color) || $width === false || $height === false || $quantity === false) {
        
        echo json_encode(['success' => false, 'message' => 'Please fill in all required fields with valid values.']);
        exit;
    }

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        echo json_encode(['success' => false, 'message' => 'Please enter a valid email address.']);
        exit;
    }

if ($width <= 0 || $height <= 0 || $quantity <= 0) {
        echo json_encode(['success' => false, 'message' => 'Sizes and quantities must be greater than zero.']);
        exit;
    }

// 3. Handle reference image upload
    $image_filename = null;
    if (isset($_FILES['reference_image']) && $_FILES['reference_image']['error'] !== UPLOAD_ERR_NO_FILE) {
        $file = $_FILES['reference_image'];
        
        // Check for upload error codes
        if ($file['error'] !== UPLOAD_ERR_OK) {
            echo json_encode(['success' => false, 'message' => 'File upload error code: ' . $file['error']]);
            exit;
        }

// Limit size (5MB)
        if ($file['size'] > 5 * 1024 * 1024) {
            echo json_encode(['success' => false, 'message' => 'File size is too large. Maximum allowed size is 5MB.']);
            exit;
        }

// Validate extension and mime-type
        $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'webp'];
        $allowed_mimetypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
        
        $file_ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
        
        // Robust mime-type detection with fallback logic
        $file_mime = null;
        if (function_exists('finfo_open')) {
            $finfo = @finfo_open(FILEINFO_MIME_TYPE);
            if ($finfo) {
                $file_mime = @finfo_file($finfo, $file['tmp_name']);
                @finfo_close($finfo);
            }
        }
        
        if (empty($file_mime) && function_exists('mime_content_type')) {
            $file_mime = @mime_content_type($file['tmp_name']);
        }
        
        if (empty($file_mime) && function_exists('getimagesize')) {
            $image_info = @getimagesize($file['tmp_name']);
            if ($image_info !== false) {
                $file_mime = $image_info['mime'];
            }
        }

// If safe mime-type checking is available, validate against allowed mimetypes
        $mime_valid = true;
        if ($file_mime !== null) {
            $mime_valid = in_array($file_mime, $allowed_mimetypes);
        }

if (!in_array($file_ext, $allowed_extensions) || !$mime_valid) {
            echo json_encode(['success' => false, 'message' => 'Invalid file type. Only JPG, PNG, GIF, and WEBP files are allowed.']);
            exit;
        }

// Generate unique filename
        $upload_dir = '../uploads/';
        // Ensure folder exists (failsafe)
        if (!is_dir($upload_dir)) {
            mkdir($upload_dir, 0755, true);
        }

// Failsafe: Attempt to resolve permission issues dynamically
        if (!is_writable($upload_dir)) {
            @chmod($upload_dir, 0755);
            if (!is_writable($upload_dir)) {
                @chmod($upload_dir, 0777);
            }
        }

// Verify if writable before moving file
        if (!is_writable($upload_dir)) {
            echo json_encode([
                'success' => false, 
                'message' => 'Failed to save uploaded image: The uploads directory exists but is not writable by the web server. Please change the "uploads" folder permissions to 755 (or 777 for local test environments).'
            ]);
            exit;
        }

$image_filename = 'order_' . time() . '_' . bin2hex(random_bytes(4)) . '.' . $file_ext;
        $target_path = $upload_dir . $image_filename;

if (!move_uploaded_file($file['tmp_name'], $target_path)) {
            echo json_encode(['success' => false, 'message' => 'Failed to save uploaded image. Check server upload limits or folder permissions.']);
            exit;
        }
    }

// 4. Generate order number
    $order_no = generate_order_number($pdo);

// 5. Insert order into database
    $sql = "INSERT INTO orders (order_no, customer_name, phone, whatsapp, email, address, curtain_type, fabric, color, width, height, quantity, notes, image, status)
            VALUES (:order_no, :customer_name, :phone, :whatsapp, :email, :address, :curtain_type, :fabric, :color, :width, :height, :quantity, :notes, :image, 'Pending')";
            
    $stmt = $pdo->prepare($sql);
    $stmt->execute([
        ':order_no' => $order_no,
        ':customer_name' => $customer_name,
        ':phone' => $phone,
        ':whatsapp' => $whatsapp,
        ':email' => $email,
        ':address' => $address,
        ':curtain_type' => $curtain_type,
        ':fabric' => $fabric,
        ':color' => $color,
        ':width' => $width,
        ':height' => $height,
        ':quantity' => $quantity,
        ':notes' => $notes,
        ':image' => $image_filename
    ]);

// 6. Retrieve admin settings for WhatsApp number
    $settings = get_admin_settings($pdo);
    $admin_phone = $settings['admin_whatsapp'] ?? '94771234567';

// 7. Structure the order array for message builder
    $order_data = [
        'customer_name' => $customer_name,
        'phone' => $phone,
        'whatsapp' => $whatsapp,
        'email' => $email,
        'curtain_type' => $curtain_type,
        'fabric' => $fabric,
        'color' => $color,
        'width' => $width,
        'height' => $height,
        'quantity' => $quantity,
        'notes' => $notes
    ];

$whatsapp_message = generate_whatsapp_message($order_data);
    $whatsapp_link = get_whatsapp_link($admin_phone, $whatsapp_message);

echo json_encode([
        'success' => true,
        'order_no' => $order_no,
        'whatsapp_message' => $whatsapp_message,
        'whatsapp_link' => $whatsapp_link,
        'message' => 'Order submitted successfully.'
    ]);

} catch (Throwable $e) {
    echo json_encode([
        'success' => false,
        'message' => 'An unexpected server error occurred: ' . $e->getMessage()
    ]);
}
?>

Cancel

🤩 File Manager - Mr.X

Editing:submit.php