<?php

// 確保所有輸入都進行 HTML Escape，防止 XSS
function sanitizeInput($input) {
    return is_string($input) ? htmlspecialchars($input, ENT_QUOTES, 'UTF-8') : '';
}

// 取得所有 GET 參數，並進行 HTML Escape
$sanitized_get = [];
foreach ($_GET as $key => $value) {
    $sanitized_get[$key] = sanitizeInput($value);
}


//set ini_set debug
if ($_SERVER['REMOTE_ADDR'] === 'localhost') {
    ini_set('display_errors', 1);
    ini_set('display_startup_errors', 1);
    error_reporting(E_ALL);
}

//Get time by timezone Asia/Taipei
date_default_timezone_set('Asia/Taipei');
$time = date('Y-m-d H:i:s');


//Get ip
$ip = $_SERVER['REMOTE_ADDR'];

$allowed_status = ['on-site', 'online', 'not attending'];
$allowed_status_map = [
    'on-site'=>'實體參加',
    'online'=>'線上參加',
    'not attending'=>'不克參加',
    'invalid status'=>'惡意回應'

];

$presence_status = strtolower($sanitized_get['presence_status'] ?? '');
if (!in_array($presence_status, $allowed_status, true)) {
    $presence_status = 'invalid status';
}


//Get email
$email = $sanitized_get['email'] ?? '';
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    $email = 'invalid email';
}


//Get device
$device = $_SERVER['HTTP_USER_AGENT'];

// print_r( [$time, $ip, $presence_status, $email, $device]);

//example
//https://workshop202503.aiacademy.tw/attendance_confirmation_by_email/?presence_status=on-site&email={email}
//https://workshop202503.aiacademy.tw/attendance_confirmation_by_email/?presence_status=online&email={email}
//https://workshop202503.aiacademy.tw/attendance_confirmation_by_email/?presence_status=not attending&email={email}


//save data to csv
$csv = fopen(__DIR__ . '/data/djoaeju187_j1_0927{fj1i28d812ju0d7u12093u8s0981ck-1jd8_.csv', 'a');
if ($csv === FALSE) {
    die('Failed to open djoaeju187_j1_0927{_.csv');
} else {
    fputcsv($csv, [$time, $ip, $allowed_status_map[$presence_status], $email, $device]);
    fclose($csv);
}


// Redirect to the Thank You page
header("Location: /?thanks-for-confirm=1&status={$presence_status}");
exit(); // Ensure script execution stops after the redirect