<?php
session_start();
include_once("../config/db.php");

// Security: Ensure user is an admin before performing any action.
if(!isset($_SESSION['admin'])){
    header("Location: login.php");
    exit();
}
include 'admin_header.php';
$message = '';

if(isset($_POST['submit'])){
    $title = $_POST['title'];
    $category = $_POST['category'];
    $description = $_POST['description'];
    $date = date("Y-m-d");

    // File upload handling
    if (isset($_FILES['image']) && $_FILES['image']['error'] == 0) {
        $allowed = ['jpg', 'jpeg', 'png', 'gif'];
        $filename = $_FILES['image']['name'];
        $filetype = pathinfo($filename, PATHINFO_EXTENSION);

        if (in_array(strtolower($filetype), $allowed)) {
            // Create a unique filename to prevent overwriting
            $new_filename = uniqid('', true) . '.' . $filetype;
            $upload_path = "uploads/" . $new_filename;

            if (move_uploaded_file($_FILES['image']['tmp_name'], $upload_path)) {
                // Use prepared statements to prevent SQL injection
                $sql = "INSERT INTO blog(title, category, description, image, created_at) VALUES(?,?,?,?,?)";
                $stmt = mysqli_prepare($conn, $sql);
                mysqli_stmt_bind_param($stmt, "sssss", $title, $category, $description, $new_filename, $date);
                
                if (mysqli_stmt_execute($stmt)) {
                    $message = "<div class='success'>Blog Post Added Successfully.</div>";
                } else {
                    $message = "<div class='error'>Database error: Could not add post.</div>";
                }
            } else {
                $message = "<div class='error'>Error: Could not move uploaded file.</div>";
            }
        } else {
            $message = "<div class='error'>Error: Invalid file type. Only JPG, JPEG, PNG, GIF are allowed.</div>";
        }
    } else {
        $message = "<div class='error'>Error: No file uploaded or an upload error occurred.</div>";
    }
}
?>
<div class="page-header">
    <h1>Add New Blog Post</h1>
    <a href="manage_blog.php" class="btn">Back to Blog</a>
</div>

<div class="content-wrapper">
    <?php if(!empty($message)) echo $message; ?>

    <form method="POST" enctype="multipart/form-data">
        <div class="form-group">
            <label for="title">Post Title</label>
            <input type="text" id="title" name="title" placeholder="e.g., A Day on the Water" required>
        </div>

        <div class="form-group">
            <label for="category">Category</label>
            <input type="text" id="category" name="category" placeholder="e.g., Travel" required>
        </div>

        <div class="form-group">
            <label for="description">Description</label>
            <textarea id="description" name="description" placeholder="Write your blog post here..."></textarea>
        </div>

        <div class="form-group">
            <label for="image">Featured Image</label>
            <input type="file" id="image" name="image" required>
        </div>

        <button type="submit" name="submit">Add Post</button>
    </form>
</div>
<?php include 'admin_footer.php'; ?>