<?php

    function isAllowedMessage($message) {
        $allowedChars = '/^[a-zA-Z0-9,@. ]*$/';
        return preg_match($allowedChars, $message);
    }
    
    if ($_SERVER["REQUEST_METHOD"] === "POST") {
        if (isset($_POST['submit'])) {
            $name = $_POST['name'];
            $phone = $_POST['phone'];
            $email = $_POST['email'];
            $message = $_POST['message'];
            date_default_timezone_set("Asia/Kolkata");
            $currentTime = date("Y-m-d H:i:s");
            $errors = array();
    
            // Validate input
            if (empty($name)) {
                $errors[] = "Name field is required.";
            } elseif (!preg_match('/^[a-zA-Z ]+$/', $name)) {
                $errors[] = "Name can only contain alphabets.";
            }
    
            if (empty($email)) {
                $errors[] = "Email field is required.";
            } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
                $errors[] = "Invalid email format.";
            }
    
            if (empty($phone)) {
                $errors[] = "Phone field is required.";
            } elseif (!preg_match('/^\d{10}$/', $phone)) {
                $errors[] = "Phone number should have exactly 10 digits.";
            }
    
            // Sanitize input
            $name = filter_var($name, FILTER_SANITIZE_STRING);
            $phone = filter_var($phone, FILTER_SANITIZE_NUMBER_INT);
            $email = filter_var($email, FILTER_SANITIZE_EMAIL);
            $message = htmlspecialchars($message, ENT_QUOTES, 'UTF-8');
    
            // Check for potentially malicious content in the message
            if (!isAllowedMessage($message)) {
                $errors[] = "Your message contains potentially malicious content or disallowed characters.";
            }
    
    if (empty($errors)) {
        // Your existing code for successful submission
        $query = "INSERT INTO `tbl_queries` (`name`, `phone`, `email`, `message`, `datetime`) VALUES (?, ?, ?, ?, ?)";
        $stmt = mysqli_prepare($db, $query);
    
        if ($stmt) {
            mysqli_stmt_bind_param($stmt, "sssss", $name, $phone, $email, $message, $currentTime);
            $result = mysqli_stmt_execute($stmt);
            mysqli_stmt_close($stmt);
    
            if ($result) {
                $to = "gudoogulzar@gmail.com";
                // $to = "fastelevatorandescalator@gmail.com";
                $subject = "New Query Submitted";
                $emailMessage = "A new query has been submitted:\n\n";
                $emailMessage .= "Name: $name\n";
                $emailMessage .= "Phone: $phone\n";
                $emailMessage .= "Email: $email\n";
                $emailMessage .= "Message: $message\n";
                
                $headers = "From: $email";
                
                if (mail($to, $subject, $emailMessage, $headers)) {
                echo "<script>
                window.alert('Successfully Sent! We will contact you soon');
                window.location.href = '$wspath';
                </script>";
            } else {
               echo "Error sending email.";
                }
            } else {
                $errors[] = "Error in processing your request. Please try again later.";
            }
        } else {
            $errors[] = "Error in preparing the statement.";
        }
    } else {
        // Display validation errors in an alert
        echo "<script>
            var errorMessage = '";
        foreach ($errors as $error) {
            echo addslashes($error) . "\\n";
        }
        echo "';
            window.alert(errorMessage);
        </script>";
    }
        }
    }
?>
    <section class="faq-rqa-section faq-style-one sec-pad pb0">
        <div class="container">
            <div class="row">
                <div class="col-lg-7 col-md-8 col-sm-12 col-xs-12 pull-left">
                    <div class="sec-title">
                        <h3><?php echo $datal['site_name'];?> <span>FAQ</span></h3>
                        <p>You will find yourself working in a true partnership that results in an incredible experience, and an end product that is the best. </p>
                    </div><!-- /.sec-title -->
                    <div class="accrodion-grp" data-grp-name="faq-accrodion">
                        <div class="accrodion active">
                            <div class="accrodion-title">
                                <h4>What type of accommodation does Guddu Guest House offer?</h4>
                            </div>
                            <div class="accrodion-content">
                                <div class="inner">
                                    <p>Guddu Guest House provides hotel accommodation with various room options suitable for both leisure and business travelers.</p>
                                </div><!-- /.inner -->
                            </div>
                        </div>
                        <div class="accrodion ">
                            <div class="accrodion-title">
                                <h4>What amenities are included in the rooms?</h4>
                            </div>
                            <div class="accrodion-content">
                                <div class="inner">
                                    <p>Our rooms come equipped with essential amenities such as comfortable bedding, clean linens, air conditioning, television, and attached bathrooms with hot/cold water facilities.</p>
                                </div><!-- /.inner -->
                            </div>
                        </div>
                        <div class="accrodion">
                            <div class="accrodion-title">
                                <h4>Is there room service available?</h4>
                            </div>
                            <div class="accrodion-content">
                                <div class="inner">
                                    <p>Yes, we offer room service to ensure our guests' comfort and convenience throughout their stay. You can enjoy a variety of food and beverages right in your room.</p>
                                </div><!-- /.inner -->
                            </div>
                        </div>
                    </div>
                    <!--<a href="#" class="more-info">Get more informations <i class="fa fa-arrow-right"></i></a>-->
                </div>
                <div class="col-lg-4 col-md-4 col-sm-12 col-xs-12 pull-right">
                    <div class="rqa-box">
                        <h3>Request a <span>Quote</span></h3>
                        <p>Fill all information details to consult with us to get sevices from us</p>
                        <form action="<?php $_PHP_SELF?>" method="POST" class="rqa-form">
                            <input type="text" placeholder="Your name" name="name" required>
                            <?php if (isset($errors) && in_array("Name field is required.", $errors)) { ?>
                                <p class="error">Name field is required.</p>
                            <?php } elseif (isset($errors) && in_array("Name can only contain alphabets.", $errors)) { ?>
                                <p class="error">Name can only contain alphabets.</p>
                            <?php } ?>
                            
                            <input type="text" placeholder="Your email" name="email" required>
                            <?php if (isset($errors) && in_array("Email field is required.", $errors)) { ?>
                                <p class="error">Email field is required.</p>
                            <?php } ?>
                            
                            <input type="text" placeholder="Your Phone" name="phone" minlength="10" maxlength="10" onkeypress="return isNumberKey(event)" pattern=".{10,10}" onpaste="return false;" required>
                            <?php if (isset($errors) && in_array("Phone field is required.", $errors)) { ?>
                                <p class="error">Phone field is required.</p>
                            <?php } elseif (isset($errors) && in_array("Phone number should have exactly 10 digits.", $errors)) { ?>
                                <p class="error">Phone number should have exactly 10 digits.</p>
                            <?php } ?>
                            
                            <textarea placeholder="Write Message..." name="message"></textarea>
                            <button type="submit" name="submit" class="hvr-sweep-to-right">Get a qoute <i class="fa fa-arrow-right"></i></button>
                        </form>
                    </div>
                </div>
            </div>
        </div>
    </section>
    <?php include "locations.php";?>