<?php
    include_once('admin/config.php');
    include_once('site-main-query.php');
    
    if ($_SERVER["REQUEST_METHOD"] === "POST") {
        if (isset($_POST['submit2'])) {
            function isAllowedMessage($messages) {
                $allowedChars = '/^[a-zA-Z0-9,@. ]*$/';
                return preg_match($allowedChars, $messages);
            }
            $name = $_POST['name'];
            $phone = $_POST['phone'];
            $email = $_POST['email'];
            $messages = $_POST['message'];
            $subject = $_POST['subject'];
            date_default_timezone_set("Asia/Kolkata");
            $currentTime = date("Y-m-d H:i:s");
            $errors = array();
    
            // Validate input
            if (empty($name)) {
                $errors[] = "Name field is required.";
            } elseif (!preg_match('/^[a-zA-Z ]+$/', $name)) {
                $errors[] = "Name can only contain alphabets.";
            }
    
            if (empty($email)) {
                $errors[] = "Email field is required.";
            } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
                $errors[] = "Invalid email format.";
            }
    
            if (empty($phone)) {
                $errors[] = "Phone field is required.";
            } elseif (!preg_match('/^\d{10}$/', $phone)) {
                $errors[] = "Phone number should have exactly 10 digits.";
            }
    
            // Sanitize input
            $name = filter_var($name, FILTER_SANITIZE_STRING);
            $phone = filter_var($phone, FILTER_SANITIZE_NUMBER_INT);
            $email = filter_var($email, FILTER_SANITIZE_EMAIL);
            $messages = htmlspecialchars($messages, ENT_QUOTES, 'UTF-8');
            $subject = htmlspecialchars($subject, ENT_QUOTES, 'UTF-8');
    
            // Check for potentially malicious content in the message
            if (!isAllowedMessage($messages)) {
                $errors[] = "Your message contains potentially malicious content or disallowed characters.";
            }
    
    if (empty($errors)) {
        // Your existing code for successful submission
        $query = "INSERT INTO `tbl_queries` (`name`, `phone`, `email`, `subject`, `message`, `datetime`) VALUES (?, ?, ?, ?, ?, ?)";
        $stmt = mysqli_prepare($db, $query);
    
        if ($stmt) {
            mysqli_stmt_bind_param($stmt, "ssssss", $name, $phone, $email, $subject, $messages, $currentTime);
            $result = mysqli_stmt_execute($stmt);
            mysqli_stmt_close($stmt);
    
            if ($result) {
                $sendmail=$data1["email"];
                // $to = "digitalsaleem12@gmail.com";
                $to = $sendmail;
                $subjects = "New Query Submitted From $site_name";
                $emailMessage = "A new query has been submitted:\n\n";
                $emailMessage .= "Name: $name\n";
                $emailMessage .= "Phone: $phone\n";
                $emailMessage .= "Email: $email\n";
                $emailMessage .= "Subject: $subject\n";
                $emailMessage .= "Message: $messages\n";
                
                $headers = "From: $email";
                
                if (mail($to, $subjects, $emailMessage, $headers)) {
                echo "<script>
                window.alert('Successfully Sent! We will contact you soon');
                window.location.href = '$wspath' + 'index.html';
                </script>";
            } else {
               echo "Error sending email.";
                }
            } else {
                $errors[] = "Error in processing your request. Please try again later.";
            }
        } else {
            $errors[] = "Error in preparing the statement.";
        }
    } else {
        // Display validation errors in an alert
        echo "<script>
            var errorMessage = '";
        foreach ($errors as $error) {
            echo addslashes($error) . "\\n";
        }
        echo "';
            window.alert(errorMessage);
        </script>";
    }
        }
    }
?>
    <div class="contact-sec5 space" data-bg-src="assets/img/bg/contact_bg_5.png">
        <div class="container">
            <div class="row">
                <div class="col-xl-6 offset-xl-5 text-center text-xl-start">
                    <div class="title-area"><span class="sub-title2">
                        <img src="assets/img/theme-img/title_icon5_white.svg" alt="<?= $site_name?>" title="<?= $site_name?>">Book an appointment</span>
                        <h2 class="sec-title text-white">Request a quote</h2>
                    </div>
                    <form action="<?php $_PHP_SELF?>" method="POST" class="input-transparent">
                        <div class="row">
                            <div class="form-group col-md-6">
                                <input type="text" class="form-control" name="name" id="name" placeholder="Your Name" required>
                                <?php if (isset($errors) && in_array("Name field is required.", $errors)) { ?>
                                    <p class="error">Name field is required.</p>
                                <?php } elseif (isset($errors) && in_array("Name can only contain alphabets.", $errors)) { ?>
                                    <p class="error">Name can only contain alphabets.</p>
                                <?php } ?>
                            </div>
                            <div class="form-group col-md-6">
                                <input type="email" class="form-control" name="email" id="email" placeholder="Email Address" required> <i class="fal fa-envelope"></i>
                                <?php if (isset($errors) && in_array("Email field is required.", $errors)) { ?>
                                    <p class="error">Email field is required.</p>
                                <?php } ?>
                            </div>
                            <div class="form-group col-md-6">
                                <input type="text" class="form-control" name="phone" placeholder="Phone Number" minlength="10" maxlength="10" onkeypress="return isNumberKey(event)" pattern=".{10,10}" onpaste="return false;" required> <i class="fal fa-phone"></i>
                                <?php if (isset($errors) && in_array("Phone field is required.", $errors)) { ?>
                                    <p class="error">Phone field is required.</p>
                                <?php } elseif (isset($errors) && in_array("Phone number should have exactly 10 digits.", $errors)) { ?>
                                    <p class="error">Phone number should have exactly 10 digits.</p>
                                <?php } ?>
                            </div>
                            <div class="form-group col-md-6">
                                <input type="text" class="form-control" name="subject" id="subject" placeholder="Subject" required> <i class="fal fa-chevron-down"></i>
                            </div>
                            <div class="form-group col-12">
                                <textarea name="message" id="message" cols="30" rows="3" class="form-control" placeholder="Your Message"></textarea> <i class="fal fa-pencil"></i>
                            </div>
                            <div class="form-btn col-12">
                                <button class="th-btn" type="submit" name="submit2">Submit Request<i class="fas fa-paper-plane ms-2"></i></button>
                            </div>
                        </div>
                        <p class="form-messages mb-0 mt-3"></p>
                    </form>
                </div>
            </div>
        </div>
    </div>