<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $name = $_POST["name"];
    $email = $_POST["email"];
    $number = $_POST["number"];
    $profile = $_POST["profile"];
    $experience = $_POST["experience"];

    // Check if all required fields are filled
    if (empty($name) || empty($email) || empty($number) || empty($profile) || empty($experience)) {
        die("Error: All fields are required.");
    }

    // Check if the file is uploaded and no errors occurred
    if (isset($_FILES["image"]) && $_FILES["image"]["error"] === UPLOAD_ERR_OK) {
        $targetDir = "uploads/"; // Directory to store uploaded images
        $targetFile = $targetDir . basename($_FILES["image"]["name"]);
        $imageFileType = strtolower(pathinfo($targetFile, PATHINFO_EXTENSION));

        // Check if the file is an actual image
        $check = getimagesize($_FILES["image"]["tmp_name"]);
        if ($check === false) {
            die("Error: File is not an image.");
        }

        // Check if the file already exists (you might want to handle this differently if you don't want to overwrite existing images)
        // if (file_exists($targetFile)) {
        //     die("Error: File already exists.");
        // }

        // Check file size (you can adjust this as per your requirement)
        if ($_FILES["image"]["size"] > 500000) {
            die("Error: File is too large.");
        }

        // Allow only certain image file formats (you can add more formats as needed)
        if ($imageFileType != "jpg" && $imageFileType != "jpeg" && $imageFileType != "png") {
            die("Error: Only JPG, JPEG, and PNG files are allowed.");
        }

        // Move the uploaded file to the target directory
        if (!move_uploaded_file($_FILES["image"]["tmp_name"], $targetFile)) {
            die("Error: Unable to upload the file.");
        }
    } else {
        die("Error: File upload failed.");
    }

    // Perform database insert as before
    $conn = mysqli_connect("localhost", "root", "", "workstatus");
    if (!$conn) {
        die("Error: Unable to connect to the database. " . mysqli_connect_error());
    }

    // Escape user inputs to prevent SQL injection
    $name = mysqli_real_escape_string($conn, $name);
    $email = mysqli_real_escape_string($conn, $email);
    $number = mysqli_real_escape_string($conn, $number);
    $profile = mysqli_real_escape_string($conn, $profile);
    $experience = mysqli_real_escape_string($conn, $experience);
    $imagePath = mysqli_real_escape_string($conn, $targetFile);

    // Create the SQL query with proper column names and values
    $insert = "INSERT INTO create_proforma (name, email, number, profile, experience, image) VALUES ('$name', '$email', '$number', '$profile', '$experience', '$imagePath')";

    // Perform the query and check for errors
    if (mysqli_query($conn, $insert)) {

        header("location:showdata-proforma.php");

    } else {
        echo 'Error: ' . mysqli_error($conn);
    }

    // Close the database connection
    mysqli_close($conn);
}
?>