<?php
require_once('../common.php');
require_once('checklogin.php');

include_once('header.php');
include_once('editors-menu.php');
?>

<center><h2>Rejected</h2></center>
<span class="msg"><?php if (isset($msg)) { echo htmlspecialchars($msg, ENT_QUOTES, 'UTF-8'); } ?></span>
<center>
<table width="1000" align="center" cellpadding="15" border="5">
	<tr>
		<th>Date Submitted</th>
		<th>Title</th>
		<th>Contributor</th>
		<th>Email</th>		
		<th>Edition</th>		
		<th>&nbsp;</th>
	</tr>
<?php
// Use prepared statements with PDO to protect against SQL injection
$query = "SELECT a.*, a.id AS sid, b.author_name, b.author_lastname, b.email 
		  FROM sm_submissions AS a
		  INNER JOIN sm_poets AS b ON a.poetid = b.id
		  WHERE a.status = :status
		  ORDER BY a.date_submitted DESC";

$status = 2;
$stmt = $pdo->prepare($query);
$stmt->bindParam(':status', $status, PDO::PARAM_INT);
$stmt->execute();
$result = $stmt->fetchAll(PDO::FETCH_ASSOC);

foreach ($result as $row) {
    // Escape output to prevent XSS
    $date_submitted = htmlspecialchars(date('M. d, Y h:ia', strtotime($row['date_submitted'])), ENT_QUOTES, 'UTF-8');
    $sid = (int) $row['sid']; // Make sure ID is an integer
    $title = htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8');
    $author_name = htmlspecialchars($row['author_name'], ENT_QUOTES, 'UTF-8');
    $author_lastname = htmlspecialchars($row['author_lastname'], ENT_QUOTES, 'UTF-8');
    $email = htmlspecialchars($row['email'], ENT_QUOTES, 'UTF-8');
    $edition_name = htmlspecialchars(getEditionName($row['editionid']), ENT_QUOTES, 'UTF-8');
?>
	<tr>
		<td><?= $date_submitted ?></td>
		<td><a href="view-submission.php?id=<?= $sid ?>"><?= $title ?></a></td>
		<td><?= $author_name ?> <?= $author_lastname ?></td>
		<td><a href="mailto:<?= $email ?>"><?= $email ?></a></td>		
		<td><?= $edition_name ?></td>
		<td>[<a href="editors-update-status.php?id=<?= $sid ?>">Update Status</a>]</td>
	</tr>
<?php
}
?>
</table></center>

<?php include_once('footer.php'); ?>
