<?php
// initializing variables
$branch= "";
$role= "";
$username = "";
$fname= "";
$lname= "";
$phone1= "";
$phone2= "";
$email= "";
$idno="";
$errors = array(); 
// registration form phpside
if (isset($_POST['submit'])) {

  // receive all input values from the form
  $role = mysqli_real_escape_string($db, $_POST['role']);
  $branch = mysqli_real_escape_string($db, $_POST['branch']);
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $fname = mysqli_real_escape_string($db, $_POST['fname']);
  $lname = mysqli_real_escape_string($db, $_POST['lname']);
  $idno = mysqli_real_escape_string($db, $_POST['idno']);
  $email = mysqli_real_escape_string($db, $_POST['email']);
  $phone1 = mysqli_real_escape_string($db, $_POST['phone1']);
  $phone2 = mysqli_real_escape_string($db, $_POST['phone2']);
  $password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
  $password_2 = mysqli_real_escape_string($db, $_POST['password_2']);

  // form validation: ensure that the form is correctly filled ...
  // by adding (array_push()) corresponding error unto $errors array
  if (empty($branch)) { array_push($errors, "branch name is required"); }
   if (empty($username)) { array_push($errors, "Username is required"); }
  if (empty($password_1)) { array_push($errors, "Password is required"); }
  if ($password_1 != $password_2) {
  array_push($errors, "The two passwords do not match");
  
}

  
  $user_check_query = "SELECT * FROM users WHERE Username='$username' AND Branch='$branch' LIMIT 1";//verify that only one user exists with the same emeail
  $result = mysqli_query($db, $user_check_query);
  $user = mysqli_fetch_assoc($result);
  
  if ($user) { // if user exists
    if ($user['Username'] === $username) {
      array_push($errors, "Username already exists");
    }

    if ($user['Branch'] === $branch) {
      array_push($errors, "Account already exists in this branch");
    }
  }



    $sql_a = "SELECT * FROM users WHERE Phone1='$phone1'";
    $sql_b = "SELECT * FROM users  WHERE Idno='$idno'";
    $sql_c = "SELECT * FROM users  WHERE Username='$username'";
  
    $res_a = mysqli_query($db, $sql_a);
    $res_b = mysqli_query($db, $sql_b);
    $res_c = mysqli_query($db, $sql_c);


    if (mysqli_num_rows($res_a) > 0) {
      array_push($errors, "Sorry! There exist a staff with that phone No - 1");
    }else if(mysqli_num_rows($res_b) > 0){
      array_push($errors, "Sorry! There exist a staff member with that Idno"); 
    }else if(mysqli_num_rows($res_c) > 0){
      array_push($errors, "Sorry! There exist a staff member with that Username");
    }


  // Finally, register user if there are no errors in the form
   else if (count($errors) == 0) {
    $password = md5($password_1);//encrypt the password before saving in the database

    $query = "INSERT INTO users (Branch,Role,Fname, Lname, Username, Phone1, Phone2, Email, Idno, Password) 
          VALUES('$branch','$role', '$fname','$lname', '$username', '$phone1', '$phone2','$email','$idno',
           '$password')";
   
if ($db->query($query) === TRUE) {
          
echo "<script type= 'text/javascript'>alert(' $fname -  Account  created successfully.');</script>";
echo "<script type= 'text/javascript'>window.location.href='logout.php'</script>";


    }
   else{   echo "<script type= 'text/javascript'>alert(' Error while inserting your record.');</script>"; }



  }
  
}

?>