<?php
// Start session if not already started (harden the cookie first)
if (session_status() === PHP_SESSION_NONE) {
    ini_set('session.use_strict_mode', '1');
    ini_set('session.cookie_httponly', '1');
    ini_set('session.cookie_samesite', 'Lax');
    if (!empty($_SERVER['HTTPS'])) {
        ini_set('session.cookie_secure', '1');
    }
    session_start();
}

// Include the database connection
require_once('common.php'); // Ensure this file includes config.php where the $pdo connection is established

// Check if the poet is logged in and has a valid ID
if (!isset($_SESSION['poet_is_logged']) || !$_SESSION['poet_is_logged'] || intval($_SESSION['poet_id']) < 1) {
    header('Location: login.php?loginrequired');
    exit;
}

// Securely fetch the poet's information using a function (you should implement this function to use $pdo)
$cPoet = getPoet(intval($_SESSION['poet_id']));  // Assume getPoet uses $pdo

// SQL query for fetching submission statuses
$query = "SELECT id, status FROM sm_status WHERE id > :status_id ORDER BY id";

try {
    // Prepare the SQL statement using PDO
    $stmt = $pdo->prepare($query);

    // Bind the parameter (status_id > 2)
    $status_id = 2;
    $stmt->bindParam(':status_id', $status_id, PDO::PARAM_INT);

    // Execute the statement
    $stmt->execute();

    // Fetch results
    $submission_status = [];
    while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
        // Store the status, escaping for security
        $submission_status[$row['id']] = htmlspecialchars($row['status'], ENT_QUOTES, 'UTF-8');
    }

} catch (PDOException $e) {
    // Handle database errors
    die("Error preparing the query: " . htmlspecialchars($e->getMessage()));
}

// PHP version compatibility check for older versions of PHP (e.g., 5.6)
if (version_compare(PHP_VERSION, '7.0.0', '<')) {
    // Handle any PHP 5.6-specific logic if needed
    // For now, no need to change much as prepared statements are supported in PHP 5.6.
}

?>
