<?php session_start();
error_reporting(0);
include("../config/theconfig.php");

include("header.php");

if (!isset($_SESSION["adminid"])) {
    header("Location: login.php");
    exit(); // Always exit after a header redirect
}

$m = date("Y-m-d");
if (isset($_POST["button"])) {
    $sql = "SELECT * FROM customers WHERE loginid='" . $_POST['loginid'] . "'";
    $result = mysqli_query($conn, $sql);

    if (mysqli_num_rows($result) > 0) {
        $logmsg = "LOGIN ID ALREADY EXIST";
    } else {
        // This is a direct conversion, not a secure one.
        // It remains vulnerable to SQL injection.
        $sql = "INSERT INTO customers (accountno, cot, imf, phone, email, acctype, ifsccode, firstname, lastname, loginid, accpassword, transpassword, accstatus, country, state, city, accopendate, dob, gender) VALUES ('" . $_POST['acc'] . "','" . $_POST['cot'] . "','" . $_POST['imf'] . "','" . $_POST['phone'] . "','" . $_POST['email'] . "','" . $_POST['acctype'] . "','" . $_POST['brname'] . "','" . $_POST['firstname'] . "','" . $_POST['lastname'] . "','" . $_POST['loginid'] . "','" . $_POST['accountpassword'] . "','" . $_POST['transactionpassword'] . "','" . $_POST['accstatus'] . "','" . $_POST['country'] . "','" . $_POST['state'] . "','" . $_POST['city'] . "','" . $_POST['accopendate'] . "','" . $_POST['dob'] . "','" . $_POST['gender'] . "')";
        
        mysqli_query($conn, $sql);

        $ree = mysqli_query($conn, "SELECT * FROM customers WHERE loginid='" . $_POST['loginid'] . "'");
        $arra = mysqli_fetch_array($ree);
        $cusid = $arra['customerid'];

        $sql = "INSERT INTO accounts(accno,customerid,accstatus,accopendate,accounttype,accountbalance) VALUES ('" . $_POST['acc'] . "','" . $cusid . "','" . $_POST['accstatus'] . "','" . $_POST['accopendate'] . "','" . $_POST['acctype'] . "','" . $_POST['balance'] . "')";
        
        if (!mysqli_query($conn, $sql)) {
            die('Error: ' . mysqli_error($conn));
        }
        
        $logmsg = "<script>swal('Succesful!', 'Your account has been created!. Your Account Number is " . $_POST['acc'] . " Thank you for joining us!', 'success')</script>";
    }
}
$resq = mysqli_query($conn, "SELECT * FROM branch");
?>