<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

require_once "adminpanel/config.php";

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    // Honeypot check (bot protection)
    if (!empty($_POST["company"])) {
        header("Location: contact.php?status=spam");
        exit;
    }

    // Collect + sanitize inputs
    $name    = isset($_POST['name']) ? trim($_POST['name']) : '';
    $email   = isset($_POST['email']) ? trim($_POST['email']) : '';
        $phone   = isset($_POST['phone']) ? trim($_POST['phone']) : '';
    $subject = isset($_POST['subject']) ? trim($_POST['subject']) : '';
    $message = isset($_POST['message']) ? trim($_POST['message']) : '';

    // Prevent empty values
    if ($name === '' || $email === '' || $subject === '' || $message === '') {
        header("Location: contact.php?status=empty");
        exit;
    }

    // Sanitize further for output
    $name    = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
    $email   = filter_var($email, FILTER_SANITIZE_EMAIL);
    $subject = htmlspecialchars($subject, ENT_QUOTES, 'UTF-8');
    $message = htmlspecialchars($message, ENT_QUOTES, 'UTF-8');

    // Capture server info
    $ip    = $_SERVER['REMOTE_ADDR'] ?? 'UNKNOWN';
    $agent = $_SERVER['HTTP_USER_AGENT'] ?? 'UNKNOWN';

    try {
        // Insert into DB
        $sql = "INSERT INTO sunrediant_contacts 
                (name, email, phone,subject, message, ip_address, user_agent, submitted_at) 
                VALUES (:name, :email, :phone, :subject, :message, :ip, :agent, NOW())";

        $stmt = $conn->prepare($sql);
        $stmt->execute([
            ':name'    => $name,
            ':email'   => $email,
            ':phone'   => $phone,
            ':subject' => $subject,
            ':message' => $message,
            ':ip'      => $ip,
            ':agent'   => $agent
        ]);

        /** ---- SEND EMAIL ---- **/
        $to = "yourmail@example.com"; // ✅ Change to your receiving email
        $subject_line = "New Contact Form Submission - " . $subject;

        $headers  = "MIME-Version: 1.0\r\n";
        $headers .= "Content-Type: text/html; charset=UTF-8\r\n";
        $headers .= "From: " . $name . " <" . $email . ">\r\n";
        $headers .= "Reply-To: " . $email . "\r\n";

        $email_body = "
            <h2>New Contact Form Submission</h2>
            <p><strong>Name:</strong> {$name}</p>
            <p><strong>Email:</strong> {$email}</p>
             <p><strong>Phone:</strong> {$phone}</p>
            <p><strong>Subject:</strong> {$subject}</p>
            <p><strong>Message:</strong><br>" . nl2br($message) . "</p>
            <hr>
            <p><small>IP: {$ip}<br>User Agent: {$agent}</small></p>
        ";

        if (mail($to, $subject_line, $email_body, $headers)) {
            header("Location: contact.php?status=success");
        } else {
            header("Location: contact.php?status=mail_failed");
        }
        exit;

    } catch (PDOException $e) {
        header("Location: contact.php?status=db_error&msg=" . urlencode($e->getMessage()));
        exit;
    } catch (Exception $e) {
        header("Location: contact.php?status=error&msg=" . urlencode($e->getMessage()));
        exit;
    }

} else {
    header("Location: contact.php?status=invalid");
    exit;
}
