<?php

require_once('../common.php');
require_once('checklogin.php');

$msg = '';

// Handle submission deletion securely with prepared statements
if (isset($_GET['delete'])) {
    // Ensure IDs are integers to avoid SQL injection
    $delete_id = (int)$_GET['delete'];
    $poet_id   = (int)($cPoet['id'] ?? 0);

    $stmt = $pdo->prepare("DELETE FROM sm_submissions WHERE id = :delete_id AND poetid = :poet_id");
    $stmt->bindValue(':delete_id', $delete_id, PDO::PARAM_INT);
    $stmt->bindValue(':poet_id',   $poet_id,   PDO::PARAM_INT);
    if ($stmt->execute()) {
        $msg = '&nbsp; You have successfully deleted your submission! &nbsp;';
    }
}

include_once('header.php');
include_once('editors-menu.php');
?>

<center><h2>Contest Entries</h2></center>
<span class="msg"><?= $msg !== '' ? htmlspecialchars($msg, ENT_QUOTES, 'UTF-8') : ''; ?></span>
<center>
    <table width="1000" align="center" border="5" cellpadding="15">
        <tr>
            <th>Date Submitted</th>
            <th>Title</th>
            <th>Contributor</th>
            <th>Submission Type</th>
            <th>Email</th>
            <th>Edition</th>
            <th>Status</th>
            <th>Payment Type</th>
            <th>IP Address</th>
            <th>&nbsp;</th>
        </tr>
        <?php
        // Fixed query (no user-supplied sort), executed via PDO
        $query = "SELECT *, a.id AS sid
                  FROM sm_submissions AS a
                  INNER JOIN sm_poets AS b ON a.poetid = b.id
                  WHERE a.ptype = 'paid'
                  ORDER BY a.date_submitted DESC";

        $result = $pdo->query($query);

        foreach ($result as $row) {
            // Sanitize all output to prevent XSS attacks
            $date_submitted = htmlspecialchars(date('M. d, Y h:ia', strtotime($row['date_submitted'])), ENT_QUOTES, 'UTF-8');
            $sid = (int)$row['sid']; // Ensure this is an integer
            $title = htmlspecialchars((string)($row['title'] ?? ''), ENT_QUOTES, 'UTF-8');
            $author_name = htmlspecialchars((string)($row['author_name'] ?? ''), ENT_QUOTES, 'UTF-8');
            $author_lastname = htmlspecialchars((string)($row['author_lastname'] ?? ''), ENT_QUOTES, 'UTF-8');
            $type = htmlspecialchars((string)($row['type'] ?? ''), ENT_QUOTES, 'UTF-8');
            $email = htmlspecialchars((string)($row['email'] ?? ''), ENT_QUOTES, 'UTF-8');
            $edition_name = htmlspecialchars(getEditionName($row['editionid']), ENT_QUOTES, 'UTF-8');
            $submission_status_value = htmlspecialchars($submission_status[$row['status']] ?? '', ENT_QUOTES, 'UTF-8');
            $payment_type = htmlspecialchars((string)($row['ptype'] ?? ''), ENT_QUOTES, 'UTF-8');
            $ip_address = htmlspecialchars((string)($row['ip_address'] ?? ''), ENT_QUOTES, 'UTF-8');
        ?>
            <tr>
                <td><?= $date_submitted ?></td>
                <td><a href="view-submission.php?id=<?= (int)$sid ?>"><?= $title ?></a></td>
                <td><?= $author_name ?> <?= $author_lastname ?></td>
                <td><?= $type ?></td>
                <td><a href="mailto:<?= $email ?>"><?= $email ?></a></td>
                <td><?= $edition_name ?></td>
                <td><?= $submission_status_value ?></td>
                <td><?= $payment_type ?></td>
                <td><?= $ip_address ?></td>
                <td>[<a href="editors-update-status.php?id=<?= $sid ?>">Update Status</a>]</td>
            </tr>
        <?php
        }
        ?>
    </table>
</center>

<?php include_once('footer.php'); ?>
