<?php

require_once('../common.php');
require_once('checklogin.php');

$msg = '';

// Handle deletion using prepared statements to prevent SQL injection
if (isset($_GET['delete'])) {
    $delete_id = (int)$_GET['delete'];
    $poet_id   = (int)($cPoet['id'] ?? 0);

    $stmt = $pdo->prepare("DELETE FROM sm_submissions WHERE id = :delete_id AND poetid = :poet_id");
    $stmt->bindValue(':delete_id', $delete_id, PDO::PARAM_INT);
    $stmt->bindValue(':poet_id',   $poet_id,   PDO::PARAM_INT);
    if ($stmt->execute()) {
        $msg = '&nbsp; You have successfully deleted your Submission! &nbsp;';
    } else {
        $msg = '&nbsp; Error: Unable to delete the submission. &nbsp;';
    }
}

include_once('header.php');
include_once('editors-menu.php');

// Sorting and ordering logic with a strict whitelist to prevent SQL injection
$allowed_sorts = ['date_submitted', 'title', 'type', 'editionid', 'ptype'];
$sort  = (isset($_REQUEST['sort']) && in_array($_REQUEST['sort'], $allowed_sorts, true)) ? $_REQUEST['sort'] : 'date_submitted';
$order = (isset($_REQUEST['order']) && strtolower((string)$_REQUEST['order']) === 'asc') ? 'ASC' : 'DESC';
$order_new = ($order === 'ASC') ? 'desc' : 'asc';

?>
<h2>Slush Pile</h2>
<span class="msg"><?= $msg !== '' ? htmlspecialchars($msg, ENT_QUOTES, 'UTF-8') : ''; ?></span>
<form method="post" action="editors-update-edition.php">
    <table border="5" cellpadding="5" align="center">
        <tr>
            <th>Select</th>
            <th><a href="?sort=date_submitted&order=<?= htmlspecialchars($order_new, ENT_QUOTES, 'UTF-8'); ?>">Date Submitted</a></th>
            <th><a href="?sort=title&order=<?= htmlspecialchars($order_new, ENT_QUOTES, 'UTF-8'); ?>">Title</a></th>
            <th><a href="?sort=type&order=<?= htmlspecialchars($order_new, ENT_QUOTES, 'UTF-8'); ?>">Submission Type</a></th>
            <th><a href="?sort=editionid&order=<?= htmlspecialchars($order_new, ENT_QUOTES, 'UTF-8'); ?>">Edition</a></th>
            <th>Status</th>
            <th><a href="?sort=ptype&order=<?= htmlspecialchars($order_new, ENT_QUOTES, 'UTF-8'); ?>">Payment Type</a></th>
            <th>&nbsp;</th>
        </tr>
        <?php
        // Fetch and display submissions. $sort is whitelisted and $order is forced
        // to ASC/DESC above, so this interpolation is safe.
        $query = "SELECT a.*, a.id AS sid FROM sm_submissions AS a
                  INNER JOIN sm_poets AS b ON a.poetid = b.id
                  WHERE a.status = 0
                  ORDER BY $sort $order";

        $result = $pdo->query($query);
        foreach ($result as $row) {
            foreach ($row as $k => $v) {
                $row[$k] = stripslashes((string)($v ?? ''));  // Unescaping any special characters
            }
            ?>
            <tr <?php if (($row['ptype'] ?? '') == 'paid') echo 'style="background-color:#F00;"'; ?>>
                <td>
                    <input type="checkbox" name="checked[]" value="<?= htmlspecialchars($row['editionid'] . '_' . $row['sid'], ENT_QUOTES, 'UTF-8'); ?>" />
                </td>
                <td><?= htmlspecialchars(date('M. d, Y h:ia', strtotime($row['date_submitted'])), ENT_QUOTES, 'UTF-8'); ?></td>
                <td><a href="view-submission.php?id=<?= (int)$row['sid']; ?>"><?= htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8'); ?></a></td>
                <td><?= htmlspecialchars($row['type'], ENT_QUOTES, 'UTF-8'); ?></td>
                <td><?= htmlspecialchars(getEditionName($row['editionid']), ENT_QUOTES, 'UTF-8'); ?></td>
                <td><?= htmlspecialchars($submission_status[$row['status']] ?? '', ENT_QUOTES, 'UTF-8'); ?></td>
                <td><?= htmlspecialchars($row['ptype'], ENT_QUOTES, 'UTF-8'); ?></td>
                <td>[<a href="editors-update-status.php?id=<?= (int)$row['sid']; ?>">Update Status</a>]</td>
            </tr>
            <?php
        }
        ?>
        <tr>
            <td colspan="8"><input type="submit" name="submit" value="Move To Another Edition" /></td>
        </tr>
    </table>
</form>

<?php
include_once('footer.php');
?>
