'History', 'Vision' => 'Vision', 'Mission' => 'Mission', 'Core Values' => 'Core Values', 'Phones' => 'Phones', 'Address' => 'Address', 'Emails' => 'Emails' ]; // Initialize variables $sn = $title = $content = ''; $error = $success = ''; $edit_mode = false; // CSRF Token $csrf_token = generate_csrf_token(); // Handle form submissions if ($_SERVER['REQUEST_METHOD'] == 'POST') { if (!validate_csrf_token($_POST['csrf_token'])) { $error = "Security token validation failed."; } else { $title = sanitize_input($_POST['title']); $content = sanitize_input($_POST['content']); // Validation if (empty($title) || empty($content)) { $error = "Please fill in all fields."; } else { try { if (isset($_POST['update']) && isset($_POST['sn'])) { // Update existing record $sn = intval($_POST['sn']); $stmt = $DBcon->prepare("UPDATE siteinfo SET title = :title, content = :content WHERE sn = :sn"); $stmt->bindParam(':sn', $sn, PDO::PARAM_INT); $stmt->bindParam(':title', $title); $stmt->bindParam(':content', $content); if ($stmt->execute()) { $success = "Record updated successfully!"; $edit_mode = false; $title = $content = ''; } } else { // Insert new record // Check if title already exists $check_stmt = $DBcon->prepare("SELECT COUNT(*) FROM siteinfo WHERE title = :title"); $check_stmt->bindParam(':title', $title); $check_stmt->execute(); if ($check_stmt->fetchColumn() > 0) { $error = "This title already exists. Please choose a different one or edit the existing record."; } else { $stmt = $DBcon->prepare("INSERT INTO siteinfo (title, content) VALUES (:title, :content)"); $stmt->bindParam(':title', $title); $stmt->bindParam(':content', $content); if ($stmt->execute()) { $success = "Record added successfully!"; $title = $content = ''; } } } } catch(PDOException $e) { $error = "Database error: " . $e->getMessage(); } } } } // Handle delete request if (isset($_GET['delete']) && is_numeric($_GET['delete'])) { if (isset($_GET['csrf_token']) && validate_csrf_token($_GET['csrf_token'])) { try { $delete_id = intval($_GET['delete']); $stmt = $DBcon->prepare("DELETE FROM siteinfo WHERE sn = :sn"); $stmt->bindParam(':sn', $delete_id, PDO::PARAM_INT); if ($stmt->execute()) { $success = "Record deleted successfully!"; } } catch(PDOException $e) { $error = "Error deleting record: " . $e->getMessage(); } } else { $error = "Security token validation failed for delete action."; } } // Handle edit request if (isset($_GET['edit']) && is_numeric($_GET['edit'])) { try { $edit_id = intval($_GET['edit']); $stmt = $DBcon->prepare("SELECT * FROM siteinfo WHERE sn = :sn"); $stmt->bindParam(':sn', $edit_id, PDO::PARAM_INT); $stmt->execute(); if ($row = $stmt->fetch(PDO::FETCH_ASSOC)) { $sn = $row['sn']; $title = $row['title']; $content = $row['content']; $edit_mode = true; } } catch(PDOException $e) { $error = "Error loading record: " . $e->getMessage(); } } // Fetch all records for display try { $stmt = $DBcon->query("SELECT * FROM siteinfo ORDER BY FIELD(title, 'History', 'Vision', 'Mission', 'Core Values', 'Phones', 'Address', 'Emails'), title"); $records = $stmt->fetchAll(PDO::FETCH_ASSOC); } catch(PDOException $e) { $error = "Error loading records: " . $e->getMessage(); $records = []; } ?>