FSCash/html/new_entry.php

<?php
require 'config.php';
if (!isset($_SESSION['user_id'])) {
    header('Location: index.php');
    exit;
}
?>
<!DOCTYPE html>
<html lang="de">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=0.8">
    <title>FSCash - Neuer Eintrag</title>
    <link rel="stylesheet" href="assets/css/style.css">
</head>
<body>
<?php
$data_saved = "nix";
$loggedInUserId = "nix";
$debug = "";
$users = [];
$categories = [];

// save-Logik
if (!empty($_POST) && isset($DEBUG)) { //  $_SERVER['REQUEST_METHOD'] === 'POST') {
    echo "<h3>Empfangene POST-Daten:</h3>";
    echo "<ul>";
    // Durch alle POST-Variablen iterieren
    foreach ($_POST as $key => $value) {
        // Wert escapen, um XSS zu vermeiden
        $escapedValue = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
        echo "<li><strong>$key:</strong> $escapedValue</li>";
    }
    echo "</ul>";
        // POST-Daten abrufen und escapen
        $date = isset($_POST['date']) ? trim($_POST['date']) : '';
        $user_id = isset($_POST['user_id']) ? trim($_POST['user_id']) : '';
        $person = isset($_POST['person']) ? trim($_POST['person']) : '';
        $category = isset($_POST['category']) ? trim($_POST['category']) : '';
        $subject = isset($_POST['subject']) ? trim($_POST['subject']) : '';
        $amount = isset($_POST['amount']) ? (float)$_POST['amount'] : 0.0;
        $payment_method = isset($_POST['payment_method']) ? trim($_POST['payment_method']) : '';

        // SQL-Statement vorbereiten
        try {
            $stmt = $pdo->prepare("
                INSERT INTO entries (date, user_id, person, category, subject, amount, payment_method)
                VALUES (:date, :user_id, :person, :category, :subject, :amount, :payment_method)
            ");
            $stmt->bindParam(':date', $date);
            $stmt->bindParam(':user_id', $user_id);
            $stmt->bindParam(':person', $person);
            $stmt->bindParam(':category', $category);
            $stmt->bindParam(':subject', $subject);
            $stmt->bindParam(':amount', $amount);
            $stmt->bindParam(':payment_method', $payment_method);

            // Statement ausführen
            $stmt->execute();
            $data_saved = "true";

        } catch (PDOException $e) {
            // Fehlerbehandlung
            $data_saved = "Fehler: "; // . $e->getMessage();
        }

}

try {
    // Alle Benutzer aus der Tabelle 'users' laden
    $stmtUsers = $pdo->prepare("SELECT * FROM users;");
    $stmtUsers->execute();
    $users = $stmtUsers->fetchAll(PDO::FETCH_ASSOC);

    foreach ($users as $user) {
        if ($user['id'] == $_SESSION['user_id']) {
            $loggedInUserId = $user['id'];
            break; // Schleife beenden, sobald gefunden
        }
    }

    // Alle Kategorien aus der Tabelle 'categories' laden
    $stmtCategories = $pdo->prepare("SELECT * FROM categories");
    $debug = $stmtCategories->queryString; // Enthält das reine SQL-Statement
    $stmtCategories->execute();
    $categories = $stmtCategories->fetchAll(PDO::FETCH_ASSOC);
} catch (PDOException $e) {
    $data_saved = "Fehler: "; // . $e->getMessage();
}
    // Aktuelles Datum im Format YYYY-MM-DD erzeugen
    $currentDate = date('Y-m-d');


?>
    <?php echo "<!-- data_saved:" . $data_saved . " Datum2: " . $currentDate . " -->"; ?>
    <?php if ($data_saved != "nix"): ?>
    <div id="data-notice" class="data-notice">
    Data
    </div>
    <?php endif; ?>
    <div class="container">

        <!-- Navigation -->
        <nav class="nav">
            <button class="hamburger">☰</button>
            <ul class="nav-list">
                <li><a href="dashboard.php">Start</a></li>
                <li><a href="register.php">Neue User</a></li>
                <li><a href="menu3.php" style="display: none;">Menüpunkt 3</a></li>
                <li><a href="menu4.php" style="display: none;">Menüpunkt 4</a></li>
                <li><a href="menu5.php" style="display: none;">Menüpunkt 5</a></li>
            </ul>
            <a href="logout.php" class="logout">Logout</a>
        </nav>

        <!-- <h1>Neuer Eintrag</h1> -->
        <form action="new_entry.php" method="post" class="form-container">
            <div class="form-group">
                <input type="date" name="date" value="<?php echo $currentDate; ?>" required>
            </div>
            <div class="form-group">
            <select name="user_id" id="user_id">
                <?php foreach ($users as $user): ?>
                    <option value="<?php echo htmlspecialchars($user['id']); ?>"
                    <?php if ($user['id'] == $loggedInUserId): ?> selected <?php endif; ?>
                    >
                    <?php echo htmlspecialchars($user['username']); ?>
                    </option>
                <?php endforeach; ?>
            </select>
            </div>
            <!-- Person (Multiselect, alle vorselektiert) -->
            <div class="form-group">
                <label for="person">für wen</label>
                <select name="person[]" id="person" multiple required size="4">
                    <?php foreach ($users as $user): ?>
                        <option value="<?php echo htmlspecialchars($user['id']); ?>" selected>
                        <?php echo htmlspecialchars($user['username']); ?>
                        </option>
                    <?php endforeach; ?>
                </select>
            </div>
            <!-- Category (Einkaufen vorselektiert) -->
            <div class="form-group">
                <!-- label for="category">Kategorie</label -->
                <select name="category" id="category" required>
                <?php foreach ($categories as $category): ?>
                    <option value="<?php echo htmlspecialchars($category['category_id']); ?>"
                    <?php echo ($category['name'] === 'Einkaufen' ? 'selected' : ''); ?>>
                    <?php echo htmlspecialchars($category['name']); ?>
                    </option>
                <?php endforeach; ?>
                </select>
            </div>
            <div class="form-group">
                <input type="text" name="subject" placeholder="Betreff" required>
            </div>
            <div class="form-group">
                <input type="number" name="amount" placeholder="Betrag" required>
            </div>
            <div class="form-group">
                <input type="text" name="payment_method" placeholder="Zahlweise">
            </div>
            <button type="submit" class="btn-xr">Speichern</button>
        </form>

    </div>
    <script src="assets/js/script.js"></script>
</body>
</html>