2 * 1024 * 1024) { throw new Exception("File size too large. Maximum size is 2MB."); } $filename = 'teacher_' . time() . '_' . uniqid() . '.' . $file_extension; $destination = $upload_dir . $filename; if (move_uploaded_file($_FILES['image']['tmp_name'], $destination)) { $image_path = 'images/staff/' . $filename; } else { $upload_error = $_FILES['image']['error']; $error_messages = [ 1 => 'The uploaded file exceeds the upload_max_filesize directive in php.ini', 2 => 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form', 3 => 'The uploaded file was only partially uploaded', 4 => 'No file was uploaded', 6 => 'Missing a temporary folder', 7 => 'Failed to write file to disk', 8 => 'A PHP extension stopped the file upload' ]; throw new Exception("Failed to upload image: " . ($error_messages[$upload_error] ?? 'Unknown error')); } } else { throw new Exception("Invalid file type. Only JPG, PNG, GIF, and WebP are allowed."); } } // Insert into database if (!empty($image_path)) { $stmt = $DBcon->prepare("INSERT INTO teachers (name, position, section, image, qualification, experience, email, phone, bio, display_order, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); $stmt->execute([$name, $position, $section, $image_path, $qualification, $experience, $email, $phone, $bio, $display_order, $status]); } else { $stmt = $DBcon->prepare("INSERT INTO teachers (name, position, section, qualification, experience, email, phone, bio, display_order, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); $stmt->execute([$name, $position, $section, $qualification, $experience, $email, $phone, $bio, $display_order, $status]); } $message = "Teacher added successfully!"; } elseif (isset($_POST['edit_teacher'])) { // Update teacher $id = $_POST['id']; $name = sanitize_input($_POST['name']); $position = sanitize_input($_POST['position']); $section = sanitize_input($_POST['section']); $qualification = sanitize_input($_POST['qualification'] ?? ''); $experience = sanitize_input($_POST['experience'] ?? ''); $email = sanitize_input($_POST['email'] ?? ''); $phone = sanitize_input($_POST['phone'] ?? ''); $bio = sanitize_input($_POST['bio'] ?? ''); $display_order = intval($_POST['display_order'] ?? 0); $status = sanitize_input($_POST['status'] ?? 'active'); if (isset($_FILES['image']) && $_FILES['image']['error'] === 0) { // Handle new image upload $upload_dir = $_SERVER['DOCUMENT_ROOT'] . '/raymond/raymond/images/staff/'; // Create directory if it doesn't exist if (!is_dir($upload_dir)) { if (!mkdir($upload_dir, 0755, true)) { throw new Exception("Failed to create upload directory. Please check permissions."); } } // Check if directory is writable if (!is_writable($upload_dir)) { throw new Exception("Upload directory is not writable. Please check permissions."); } $file_extension = strtolower(pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION)); $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; if (in_array($file_extension, $allowed_extensions)) { // Check file size (2MB limit) if ($_FILES['image']['size'] > 2 * 1024 * 1024) { throw new Exception("File size too large. Maximum size is 2MB."); } $filename = 'teacher_' . time() . '_' . uniqid() . '.' . $file_extension; $destination = $upload_dir . $filename; if (move_uploaded_file($_FILES['image']['tmp_name'], $destination)) { $image_path = 'images/staff/' . $filename; // Delete old image $stmt = $DBcon->prepare("SELECT image FROM teachers WHERE id = ?"); $stmt->execute([$id]); $old_image = $stmt->fetchColumn(); if ($old_image && !empty($old_image)) { $old_image_path = $_SERVER['DOCUMENT_ROOT'] . '/raymond/raymond/' . $old_image; if (file_exists($old_image_path)) { unlink($old_image_path); } } $stmt = $DBcon->prepare("UPDATE teachers SET name = ?, position = ?, section = ?, image = ?, qualification = ?, experience = ?, email = ?, phone = ?, bio = ?, display_order = ?, status = ? WHERE id = ?"); $stmt->execute([$name, $position, $section, $image_path, $qualification, $experience, $email, $phone, $bio, $display_order, $status, $id]); $message = "Teacher updated successfully!"; } else { $upload_error = $_FILES['image']['error']; $error_messages = [ 1 => 'The uploaded file exceeds the upload_max_filesize directive in php.ini', 2 => 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form', 3 => 'The uploaded file was only partially uploaded', 4 => 'No file was uploaded', 6 => 'Missing a temporary folder', 7 => 'Failed to write file to disk', 8 => 'A PHP extension stopped the file upload' ]; throw new Exception("Failed to upload image: " . ($error_messages[$upload_error] ?? 'Unknown error')); } } else { throw new Exception("Invalid file type. Only JPG, PNG, GIF, and WebP are allowed."); } } else { // Update without new image $stmt = $DBcon->prepare("UPDATE teachers SET name = ?, position = ?, section = ?, qualification = ?, experience = ?, email = ?, phone = ?, bio = ?, display_order = ?, status = ? WHERE id = ?"); $stmt->execute([$name, $position, $section, $qualification, $experience, $email, $phone, $bio, $display_order, $status, $id]); $message = "Teacher updated successfully!"; } } } catch (Exception $e) { $error = $e->getMessage(); } } } // Handle delete action if (isset($_GET['delete'])) { $id = $_GET['delete']; $csrf_token = $_GET['csrf_token'] ?? ''; if (validate_csrf_token($csrf_token)) { try { // Get image path before deletion $stmt = $DBcon->prepare("SELECT image FROM teachers WHERE id = ?"); $stmt->execute([$id]); $image_path = $stmt->fetchColumn(); // Delete from database $stmt = $DBcon->prepare("DELETE FROM teachers WHERE id = ?"); $stmt->execute([$id]); // Delete image file if ($image_path && !empty($image_path)) { $full_image_path = $_SERVER['DOCUMENT_ROOT'] . '/raymond/raymond/' . $image_path; if (file_exists($full_image_path)) { unlink($full_image_path); } } $message = "Teacher deleted successfully!"; } catch (Exception $e) { $error = "Error deleting teacher: " . $e->getMessage(); } } else { $error = "Security token invalid."; } } // Handle status toggle if (isset($_GET['toggle_status'])) { $id = $_GET['toggle_status']; $csrf_token = $_GET['csrf_token'] ?? ''; if (validate_csrf_token($csrf_token)) { try { $stmt = $DBcon->prepare("SELECT status FROM teachers WHERE id = ?"); $stmt->execute([$id]); $current_status = $stmt->fetchColumn(); $new_status = ($current_status == 'active') ? 'inactive' : 'active'; $stmt = $DBcon->prepare("UPDATE teachers SET status = ? WHERE id = ?"); $stmt->execute([$new_status, $id]); $message = "Teacher status updated successfully!"; } catch (Exception $e) { $error = "Error updating teacher status: " . $e->getMessage(); } } else { $error = "Security token invalid."; } } // Fetch teachers for listing try { $stmt = $DBcon->prepare("SELECT * FROM teachers ORDER BY section, display_order ASC, id DESC"); $stmt->execute(); $teachers = $stmt->fetchAll(PDO::FETCH_ASSOC); } catch (Exception $e) { $error = "Error fetching teachers: " . $e->getMessage(); $teachers = []; } // Fetch single teacher for editing $edit_teacher = null; if ($action === 'edit' && isset($_GET['id'])) { try { $stmt = $DBcon->prepare("SELECT * FROM teachers WHERE id = ?"); $stmt->execute([$_GET['id']]); $edit_teacher = $stmt->fetch(PDO::FETCH_ASSOC); if (!$edit_teacher) { $error = "Teacher not found."; $action = 'list'; } } catch (Exception $e) { $error = "Error fetching teacher: " . $e->getMessage(); $action = 'list'; } } // Generate CSRF token $csrf_token = generate_csrf_token(); ?>