<?php

require_once('../common.php');
require_once('checklogin.php');

$msg = '';

// Handling deletion of a submission using prepared statements to prevent SQL injection
if (isset($_GET['delete'])) {
    // Ensure IDs are integers for safety
    $delete_id = (int)$_GET['delete'];
    $poet_id   = (int)($cPoet['id'] ?? 0);

    $stmt = $pdo->prepare("DELETE FROM sm_submissions WHERE id = :delete_id AND poetid = :poet_id");
    $stmt->bindValue(':delete_id', $delete_id, PDO::PARAM_INT);
    $stmt->bindValue(':poet_id',   $poet_id,   PDO::PARAM_INT);
    if ($stmt->execute()) {
        $msg = '&nbsp; You have successfully deleted your Submission! &nbsp;';
    } else {
        $msg = '&nbsp; Error: Unable to delete the submission. &nbsp;';
    }
}

include_once('header.php');
include_once('editors-menu.php');
?>

<center><h2>Contest Entries</h2></center>
<span class="msg"><?= $msg !== '' ? htmlspecialchars($msg, ENT_QUOTES, 'UTF-8') : ''; ?></span>
<center>Some information is hidden because you are in blind reading mode.</center>
<center>
    <table width="1000" align="center" border="5" cellpadding="15">
        <tr>
            <th>Date Submitted</th>
            <th>Title</th>
            <th>Submission Type</th>
            <th>Edition</th>
            <th>Status</th>
            <th>Payment Type</th>
            <th>&nbsp;</th>
        </tr>
        <?php
        // Fixed query (no user-supplied sort), executed via PDO
        $query = "SELECT a.*, a.id AS sid FROM sm_submissions AS a
                  INNER JOIN sm_poets AS b ON a.poetid = b.id
                  WHERE a.ptype = 'paid' ORDER BY a.date_submitted DESC";

        $result = $pdo->query($query);
        foreach ($result as $row) {
            // Securely display content with htmlspecialchars to prevent XSS
            ?>
            <tr>
                <td><?= htmlspecialchars(date('M. d, Y h:ia', strtotime($row['date_submitted'])), ENT_QUOTES, 'UTF-8') ?></td>
                <td><a href="view-submission.php?id=<?= (int)$row['sid'] ?>"><?= htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8') ?></a></td>
                <td><?= htmlspecialchars($row['type'], ENT_QUOTES, 'UTF-8') ?></td>
                <td><?= htmlspecialchars(getEditionName($row['editionid']), ENT_QUOTES, 'UTF-8') ?></td>
                <td><?= htmlspecialchars($submission_status[$row['status']] ?? '', ENT_QUOTES, 'UTF-8') ?></td>
                <td><?= htmlspecialchars($row['ptype'], ENT_QUOTES, 'UTF-8') ?></td>
                <td>[<a href="editors-update-status.php?id=<?= (int)$row['sid'] ?>">Update Status</a>]</td>
            </tr>
            <?php
        }
        ?>
    </table>
</center>

<?php
include_once('footer.php');
?>
