<?php
require_once("include/db.class.php"); 
require_once("include/constants.php");
session_start();
//if(isset($_COOKIE['complete'])){

//}
$error="";

$fail=false;
if(isset($_POST['nameText']) && ($_POST['nameText']==null || $_POST['nameText']=="")){
	$fail=true;
    $error=$error."name,";
}
if(isset($_POST['emailText']) && ($_POST['emailText']==null || $_POST['emailText']=="" || !checkEmailFormat($_POST['emailText'], $_POST['emailCheckText']))){
	$fail=true;
    $error=$error."email,";
	//header('Location:suggestion.php?error=true');
}
if(isset($_POST['suggestionText']) && $_POST['suggestionText']==""){
	$fail=true;
    $error=$error."subject,";
}
if(!isset($_POST['description']) || $_POST['description']==null || $_POST['description']==""){
	$fail=true;
	if(isset($error)){
        $error=$error."description,";
    }
}
if(!isset($_POST['security']) || !checkSecurityCode($_POST['security'])){
	$fail=true;
    $error=$error."code,";
}
if(isset($_POST['zipText']) && ($_POST['zipText']!="" && !checkZipCode($_POST['zipText']))){
	$fail=true;
    $error=$error."zip,";
}
if(!isset($_POST['category']) || $_POST['category']=="-1"){
    $fail=true;
    $error=$error."category,";
}
    $user="";$email="";$suggestion="";$descript="";$emailCheck="";
    $city="";$state="";$zipcode="";$appid="";$subappid="";$statusNotified="";
	//store information
	if(isset($_POST['nameText']))$user=$_POST['nameText'];
	if(isset($_POST['emailText']))$email=$_POST['emailText'];
	if(isset($_POST['suggestionText']))$suggestion=$_POST['suggestionText'];
	if(isset($_POST['description']))$descript=$_POST['description'];
	if(isset($_POST['emailCheckText']))$emailCheck=$_POST['emailCheckText'];
	if(isset($_POST['cityText']))$city=$_POST['cityText'];
	if(isset($_POST['state']))$state=$_POST['state'];
    if(isset($state) && $state=="--SELECT--"){
        $state="";
    }
	if(isset($_POST['zipText']))$zipcode=$_POST['zipText'];
	if(isset($_POST['appid']))$appid=$_POST['appid'];
    $cryptAppid=$appid;
	if(isset($_POST['appsubid']))$subappid=$_POST['appsubid'];
    if((!isset($appid) || !isset($subappid)) || !comfirmAppID($appid, $subappid)){
        $fail=true;
        $error="ErrorAppID";
    }

	if(isset($_POST['statusNotice']))$statusNotified=$_POST['statusNotice'];
	if(isset($statusNotified) && $statusNotified!="1"){
		$statusNotified="0";
	}
	if(isset($_POST['category']))$categoryid=$_POST['category'];


if($fail==true){
	$returnValue="error=".$error."&userName=".$user."&email=".$email."&emailCheck=".$emailCheck."&city=".$city.
    "&state=".$state."&zipcode=".$zipcode."&statusNofitied=".$statusNotified."&description=".$descript."&suggestion=".
    $suggestion."&appid=".$_POST['appid']."&appsubid=".$_POST['appsubid']."&category=".$_POST['category'];

	header('Location:suggestion.php?'.$returnValue);
}else{
	$user=checkSpecialChar($user);
	$suggestion=checkSpecialChar($suggestion);
	$descript=checkSpecialChar($descript);
    if((time()-$_SESSION['complete'])<60){
        header('Location:resultPage.php?intime=true');
    }else if(insert_Data($appid, $subappid, $categoryid, $user, $email, $city, $state, $zipcode, $suggestion, $descript, $statusNotified)){
	   $_SESSION['complete']=time();
	   header('Location:resultPage.php');
	}else{
		print "<html><body><center> Submission Failed.  <a href='suggestion.php?appid=".$cryptAppid."&appsubid=".$subappid."'>Click here to go back to Suggestion page.</a>";
	}
	
}

function checkFormat($string){
    if(strpos($string, "'")){
        return false;
    }else{
        return true;
    }
    
}
function checkEmailFormat($email, $emailCheck){
    checkFormat($email);
	if(!preg_match("/^[_\.0-9a-zA-Z-]+@([0-9a-zA-Z][0-9a-zA-Z-]+\.)+[a-zA-Z]{2,6}$/i", $email)){
		return false;
	}else if($email!=$emailCheck){
		return false;
	}else{
		return true;
	}
}
function checkSecurityCode($code){
	if($_SESSION['secCode']==$code){
		return true;
	}
}
function checkZipCode($code){
	return preg_match("/^([0-9]{5})(-[0-9]{4})?$/i",$code);
}

function insert_Data($appid, $subappid, $categoryid, $name, $email, $city, $state, $zipcode, $subject, $description, $statuNotified)
{
		
        $name= mysql_real_escape_string($name);
        $email= mysql_real_escape_string($email);
        $city= mysql_real_escape_string($city);
        $state= mysql_real_escape_string($state);
        $zipcode= mysql_real_escape_string($zipcode);
        $subject= mysql_real_escape_string($subject);
        $description= mysql_real_escape_string($description);
        $statusNotified= mysql_real_escape_string($statusNotified);
        
        $db = new DB(); 
         
		$completed=$db->query("INSERT INTO Suggestion(appID,appSubLocationID, suggestionStatusCode,suggestionCategoryID, submissionDateTime, submitterName, SubmitterEmail,
         submitterCity, submitterState, submitterZipCode, suggestionSubject, suggestionDescription, submitterRequestedNotification, enablePublicView)
          VALUES ('".$appid."','".$subappid."','1','".$categoryid."',NOW(),'".$name."','".$email."','".$city."','".$state."','".$zipcode."','".$subject.
          "','".$description."','".$statuNotified."','0')");
		
		return $completed;
		
}

function checkSpecialChar($des){
	$des=str_replace("\'", "''", $des);
	return $des;
}
function comfirmAppID($appID, $subAppID){
        $db = new DB();  
        $mysqlString="SELECT * FROM Application app LEFT JOIN AppSubLocation sub ON app.appID=sub.appID WHERE app.appCode='" .$appID. "' and sub.appSubLocationID='" .$subAppID. "'";
        $finder=$db->query($mysqlString);
        global $appid;
        $appid  = mysql_result($finder,0,"appid");
        if((mysql_numrows($finder)<1)){
            return false;
        }else{
            return true;
        }
}

?>