1#@!#!123s

��JFIF�� 1#@!#!123s
: / home / earnlouq / kobilz.co.uk / management /
Filename : add-booking.php
back
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
ini_set('session.cookie_httponly', 1);
// ini_set('session.cookie_secure', 1); // Enable for HTTPS

session_start();
session_regenerate_id(true);

include('../../config/xconfig.php');
include('include/checklogin.php');

// Check login
check_login();

$title = "Add Booking";

// Generate CSRF token
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$csrf_token = $_SESSION['csrf_token'];

$msg = '';
$type = '';

if (isset($_POST['submit'])) {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $csrf_token) {
        $msg = 'Invalid CSRF token';
        $type = 'warning';
    } else {
        // Collect inputs
        $user_id = filter_input(INPUT_POST, 'user_id', FILTER_VALIDATE_INT);
        $service_id = filter_input(INPUT_POST, 'service_id', FILTER_VALIDATE_INT);
        $booking_date = filter_input(INPUT_POST, 'booking_date', FILTER_SANITIZE_SPECIAL_CHARS);
        $booking_time = filter_input(INPUT_POST, 'booking_time', FILTER_SANITIZE_SPECIAL_CHARS);
        $duration_hours = filter_input(INPUT_POST, 'duration_hours', FILTER_VALIDATE_INT);
        $address = filter_input(INPUT_POST, 'address', FILTER_SANITIZE_SPECIAL_CHARS);
        $special_instructions = filter_input(INPUT_POST, 'special_instructions', FILTER_SANITIZE_SPECIAL_CHARS);
        $status = filter_input(INPUT_POST, 'status', FILTER_SANITIZE_SPECIAL_CHARS);
        $bedrooms = filter_input(INPUT_POST, 'bedrooms', FILTER_VALIDATE_INT);
        $bathrooms = filter_input(INPUT_POST, 'bathrooms', FILTER_VALIDATE_INT);
        $frequency = filter_input(INPUT_POST, 'frequency', FILTER_SANITIZE_SPECIAL_CHARS);
        $postcode = filter_input(INPUT_POST, 'postcode', FILTER_SANITIZE_SPECIAL_CHARS);
        $phone = filter_input(INPUT_POST, 'phone', FILTER_SANITIZE_SPECIAL_CHARS);
        $price = filter_input(INPUT_POST, 'price', FILTER_VALIDATE_FLOAT);
        $created_at = date('Y-m-d H:i:s');
        $updated_at = $created_at;

        // Validation
        $number = "/^[0-9]+$/";
        if (empty($user_id) || $user_id <= 0) {
            $msg = 'Please select a valid user';
            $type = 'warning';
        } elseif (empty($service_id) || $service_id <= 0) {
            $msg = 'Please enter a valid service ID';
            $type = 'warning';
        } elseif (!$booking_date || !preg_match('/^\d{4}-\d{2}-\d{2}$/', $booking_date)) {
            $msg = 'Please enter a valid booking date';
            $type = 'warning';
        } elseif (!$booking_time || !preg_match('/^\d{2}:\d{2}$/', $booking_time)) {
            $msg = 'Please enter a valid booking time';
            $type = 'warning';
        } elseif ($duration_hours === false || $duration_hours < 1) {
            $msg = 'Please enter a valid duration (hours)';
            $type = 'warning';
        } elseif (!in_array($status, ['pending', 'confirmed', 'cancelled'])) {
            $msg = 'Please select a valid status';
            $type = 'warning';
        } elseif ($bedrooms === false || $bedrooms < 0) {
            $msg = 'Please enter a valid number of bedrooms';
            $type = 'warning';
        } elseif ($bathrooms === false || $bathrooms < 0) {
            $msg = 'Please enter a valid number of bathrooms';
            $type = 'warning';
        } elseif (!in_array($frequency, ['one-time', 'weekly', 'bi-weekly'])) {
            $msg = 'Please select a valid frequency';
            $type = 'warning';
        } elseif ($price === false || $price < 0) {
            $msg = 'Please enter a valid price';
            $type = 'warning';
        } elseif ($phone && !preg_match($number, $phone)) {
            $msg = 'Please enter a valid phone number';
            $type = 'warning';
        } else {
            // Check if user exists
            $stmt = $con->prepare("SELECT id FROM users WHERE id = ?");
            $stmt->bind_param('i', $user_id);
            $stmt->execute();
            $result = $stmt->get_result();
            if ($result->num_rows === 0) {
                $msg = 'Selected user does not exist';
                $type = 'warning';
            } else {
                // Insert booking
                $stmt = $con->prepare("
                    INSERT INTO bookings (user_id, service_id, booking_date, booking_time, duration_hours, 
                                        address, special_instructions, status, bedrooms, bathrooms, 
                                        frequency, postcode, phone, price, created_at, updated_at)
                    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
                ");
                $stmt->bind_param('iississsiisssdss', $user_id, $service_id, $booking_date, $booking_time, 
                                  $duration_hours, $address, $special_instructions, $status, 
                                  $bedrooms, $bathrooms, $frequency, $postcode, $phone, $price, 
                                  $created_at, $updated_at);
                if ($stmt->execute()) {
                    $msg = 'New Booking Added Successfully!';
                    $type = 'success';
                    // Clear form
                    $_POST = [];
                } else {
                    $msg = 'Failed to add booking: ' . $stmt->error;
                    $type = 'warning';
                }
            }
            $stmt->close();
        }
    }
}

include('include/header.php');
include('include/sidebar.php');
?>

<div class="content-wrapper">
    <div class="container-xxl flex-grow-1 container-p-y">
        <h4 class="fw-bold py-3 mb-4"><span class="text-muted fw-light">New/</span> Add Booking</h4>
        <div class="card mb-4">
            <h5 class="card-header">New Booking</h5>
            <hr class="my-0" />
            <div class="card-body">
                <?php if ($msg) { ?>
                    <div class="alert alert-<?php echo $type; ?>">
                        <h6 class="alert-heading fw-bold mb-1"><?php echo ucfirst($type); ?></h6>
                        <p class="mb-0"><?php echo htmlspecialchars($msg); ?></p>
                    </div>
                <?php } ?>
                <form method="post" action="">
                    <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($csrf_token); ?>">
                    <div class="row">
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="user_id">User</label>
                            <select class="form-control" id="user_id" name="user_id" required>
                                <option value="">Select User</option>
                                <?php
                                $stmt = $con->prepare("SELECT id, first_name, last_name, email FROM users ORDER BY first_name");
                                $stmt->execute();
                                $result = $stmt->get_result();
                                while ($user = $result->fetch_assoc()) {
                                    $full_name = trim($user['first_name'] . ' ' . $user['last_name']);
                                    $selected = isset($_POST['user_id']) && $_POST['user_id'] == $user['id'] ? 'selected' : '';
                                    echo "<option value='{$user['id']}' $selected>$full_name ({$user['email']})</option>";
                                }
                                $stmt->close();
                                ?>
                            </select>
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="service_id">Service</label>
                            <select class="form-control" id="service_id" name="service_id" required>
                                <option value="">Select Service</option>
                                <?php
                                $stmt = $con->prepare("SELECT id, name FROM services ORDER BY name ASC");
                                $stmt->execute();
                                $result = $stmt->get_result();
                                while ($service = $result->fetch_assoc()) {
                                    $selected = isset($_POST['service_id']) && $_POST['service_id'] == $service['id'] ? 'selected' : '';
                                    echo "<option value='{$service['id']}' $selected>" . htmlspecialchars($service['name']) . "</option>";
                                }
                                $stmt->close();
                                ?>
                            </select>
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="booking_date">Booking Date</label>
                            <input type="date" class="form-control" id="booking_date" name="booking_date" 
                                   value="<?php echo isset($_POST['booking_date']) ? htmlspecialchars($_POST['booking_date']) : ''; ?>" 
                                   required />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="booking_time">Booking Time</label>
                            <input type="time" class="form-control" id="booking_time" name="booking_time" 
                                   value="<?php echo isset($_POST['booking_time']) ? htmlspecialchars($_POST['booking_time']) : ''; ?>" 
                                   required />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="duration_hours">Duration (Hours)</label>
                            <input type="number" class="form-control" id="duration_hours" name="duration_hours" 
                                   value="<?php echo isset($_POST['duration_hours']) ? htmlspecialchars($_POST['duration_hours']) : ''; ?>" 
                                   min="1" required />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="address">Address</label>
                            <input type="text" class="form-control" id="address" name="address" 
                                   value="<?php echo isset($_POST['address']) ? htmlspecialchars($_POST['address']) : ''; ?>" />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="postcode">Postcode</label>
                            <input type="text" class="form-control" id="postcode" name="postcode" 
                                   value="<?php echo isset($_POST['postcode']) ? htmlspecialchars($_POST['postcode']) : ''; ?>" />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="phone">Phone</label>
                            <input type="text" class="form-control phone-mask" id="phone" name="phone" 
                                   value="<?php echo isset($_POST['phone']) ? htmlspecialchars($_POST['phone']) : ''; ?>" />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="bedrooms">Bedrooms</label>
                            <input type="number" class="form-control" id="bedrooms" name="bedrooms" 
                                   value="<?php echo isset($_POST['bedrooms']) ? htmlspecialchars($_POST['bedrooms']) : '0'; ?>" 
                                   min="0" />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="bathrooms">Bathrooms</label>
                            <input type="number" class="form-control" id="bathrooms" name="bathrooms" 
                                   value="<?php echo isset($_POST['bathrooms']) ? htmlspecialchars($_POST['bathrooms']) : '0'; ?>" 
                                   min="0" />
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="frequency">Frequency</label>
                            <select class="form-control" id="frequency" name="frequency">
                                <option value="one-time" <?php echo isset($_POST['frequency']) && $_POST['frequency'] === 'one-time' ? 'selected' : ''; ?>>One-time</option>
                                <option value="weekly" <?php echo isset($_POST['frequency']) && $_POST['frequency'] === 'weekly' ? 'selected' : ''; ?>>Weekly</option>
                                <option value="bi-weekly" <?php echo isset($_POST['frequency']) && $_POST['frequency'] === 'bi-weekly' ? 'selected' : ''; ?>>Bi-weekly</option>
                            </select>
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="status">Status</label>
                            <select class="form-control" id="status" name="status">
                                <option value="pending" <?php echo isset($_POST['status']) && $_POST['status'] === 'pending' ? 'selected' : ''; ?>>Pending</option>
                                <option value="confirmed" <?php echo isset($_POST['status']) && $_POST['status'] === 'confirmed' ? 'selected' : ''; ?>>Confirmed</option>
                                <option value="cancelled" <?php echo isset($_POST['status']) && $_POST['status'] === 'cancelled' ? 'selected' : ''; ?>>Cancelled</option>
                            </select>
                        </div>
                        <div class="mb-3 col-md-6">
                            <label class="form-label" for="price">Price (£)</label>
                            <input type="number" class="form-control" id="price" name="price" 
                                   value="<?php echo isset($_POST['price']) ? htmlspecialchars($_POST['price']) : ''; ?>" 
                                   step="0.01" min="0" required />
                        </div>
                        <div class="mb-3 col-md-12">
                            <label class="form-label" for="special_instructions">Special Instructions</label>
                            <textarea class="form-control" id="special_instructions" name="special_instructions" 
                                      rows="4"><?php echo isset($_POST['special_instructions']) ? htmlspecialchars($_POST['special_instructions']) : ''; ?></textarea>
                        </div>
                    </div>
                    <div class="mt-2">
                        <button type="submit" class="btn btn-primary me-2" name="submit">Submit</button>
                    </div>
                </form>
            </div>
        </div>
    </div>
</div>

<?php include('include/footer.php'); ?>