<?php
  header("Access-Control-Allow-Origin: *");
  header("Content-Type: application/json; charset=UTF-8");
  header("Access-Control-Allow-Methods: POST");
  header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");

	require_once('../../utils/config.php');
	require_once('../../utils/db.php');
	require_once('../../utils/tools.php');
	
  $authorization = $_SERVER["HTTP_AUTHORIZATION"];
  if(strcmp($authorization, INTERNAL_API_KEY) !== 0) {
    echo 'STOP TRYING TO STEAL MY DATA!';
    exit;
  }
 
  $method = $_SERVER['REQUEST_METHOD'];
  if ('POST' === $method) {
    parse_str(file_get_contents('php://input'), $_POST);
  } 
 
	$connection = connect();
 
  $sid = intval($_POST["sid"]);
  $firstname = escape($connection, $_POST["firstname"]);
  $lastname = escape($connection, $_POST["lastname"]);
  $birthday = escape($connection, $_POST["birthday"]);
  $gender = intval($_POST["gender"]);
  $street = escape($connection, $_POST["street"]);
  $house = intval($_POST["house"]);
  $house_suffix = escape($connection, $_POST["house_suffix"]);
  $zip = escape($connection, $_POST["zip"]);
  $city = escape($connection, $_POST["city"]);
  $phone = escape($connection, $_POST["phone"]);
  $email = escape($connection, $_POST["email"]);

  $querystr = "SELECT * FROM li_students 
                WHERE li_students.sid = ${sid}";
                
  $result = mysqli_query($connection, $querystr);
  if($result->num_rows !== 0) {
    $querystr = "UPDATE li_students SET firstname='${firstname}', lastname='${lastname}', birthday='${birthday}',
                                        gender=${gender}, street='${street}', house=${house}, house_suffix='${house_suffix}',
                                        zip='${zip}', city='${city}', phone='${phone}', email='${email}'
                  WHERE sid=${sid}";
  } else {
    $querystr = "INSERT INTO li_students (firstname, lastname, birthday, gender, street, house, house_suffix, zip, city, phone, email) 
                 VALUES('{$firstname}', '{$lastname}', '{$birthday}', {$gender}, '{$street}', {$house}, '{$house_suffix}', '{$zip}', '{$city}', '{$phone}', '{$email}')";
  }             

  $result = mysqli_query($connection, $querystr);

  echo json_encode('{ "result": "' . $result . '" }');
?>