<?php

include('init.php');
include('libs/functions.php');

$fname = scrub_sql(scrub_white_list(trim($_POST['fname']),'ALPHAONLY'), 20);
$lname = scrub_sql(scrub_white_list(trim($_POST['lname']),'ALPHAONLY'), 30);
$email = scrub_sql(scrub_white_list(trim($_POST['email']),'USER'), 150);
$phone = scrub_sql(scrub_white_list(trim($_POST['phone']),'USER'), 20);
$user = scrub_sql(scrub_white_list(trim($_POST['user']),'DATA'), 16);
$password = trim($_POST['password']);
$ext = scrub_sql(scrub_white_list(trim($_POST['ext']),'USER'), 10);



if(isset($_POST['vrss_automated']) && ($_POST['vrss_automated'] == "1")){
	$vrss_automated = "1";
}
else{
	$vrss_automated = "0";
	
}

$court_type = scrub_sql(scrub_white_list(trim($_POST['court_type']),'NUMBERONLY'), 9);
$state = scrub_sql(scrub_white_list(trim($_POST['state']),'ALPHAONLY'), 50);
$court_county = scrub_sql(scrub_white_list(trim($_POST['court_county']),'ALPHAONLY'), 50);
$court_name = $_POST['court_name'];

//echo "Fname " . $fname . "<BR>";
//echo "Lname " . $lname . "<BR>";
//echo "email " .$email . "<BR>";
//echo "phone " .$phone . "<BR>";
//echo "username " .$user . "<BR>";
//echo "pwd " .$password . "<BR>";
//echo "ext " .$ext . "<BR>";
//echo "court type " .$court_type . "<BR>";
//echo "court state " . $state . "<BR>";
//echo "court county " .$court_county . "<BR>";
//echo "court name " .$court_name . "<BR>";

$errors=0;

if ($fname == "" || $lname == "" || $email == "" || $phone == "" || $user == "" || $password == "" || $court_name == "") {
$errors = 1;
$message = "Incomplete Form. Please fill out all required fields.";
}

else if (strlen($fname) < 1 || strlen($lname) < 1 || strlen($email) < 4 || strlen($phone) < 10 || strlen($user) < 4 || strlen($password) < 8 || strlen($fname) > 20 || strlen($lname) > 30 || strlen($email) > 120 || strlen($phone) > 20  || strlen($user) > 15 || strlen($password) > 20 || strlen($ext) > 10) {
$errors = 1;
$message = "One or more fields are incorrect length.";
}

else if (check_bad_char($user)) {
$errors = 1;
$message = "Username contains invalid characters.";
}

else if (!check_password($password)) {
$errors = 1;
$message = "Password does not meet requirements";
}

else if (check_bad_char($email)) {
$errors = 1;
$message = "Email contains invalid characters.";
}


// check if username exists
if ($errors == 0) {
$sql = "SELECT count(username) AS cnt FROM tb_user WHERE username='$user'";
$rs = $db->Execute($sql);
$cnt = $rs->fields('cnt');
if ($cnt > 0) {
$errors = 1;
$message = "Username already exists.";
}
}

// check if email exists
if ($errors == 0) {
$sql = "SELECT count(email) AS cnt FROM tb_user WHERE email='$email'";
$rs = $db->Execute($sql);
$cnt = $rs->fields('cnt');
if ($cnt > 0) {
$errors = 1;
$message = "Email address already exists.";
}
}


if ($errors == 0) {
$password = md5("gingerbreadcookies".$password);

if ($vrss_automated == "1"){
	$sql = "INSERT INTO tb_user (username, password, fname, lname, email, phone, cs_id, register_date, status, ext, account_type, vrss_automated) VALUES ('$user', '$password', '$fname', '$lname', '$email', '$phone', 0 , getdate(), 0,'$ext', 'CS','1')";
}
else{
	$sql = "INSERT INTO tb_user (username, password, fname, lname, email, phone, cs_id, register_date, status, ext, account_type, vrss_automated) VALUES ('$user', '$password', '$fname', '$lname', '$email', '$phone', 0 , getdate(), 0,'$ext', 'CS','0')";
}
$rs = $db->Execute($sql);


$sql = "SELECT user_id FROM tb_user WHERE username='$user'";
$rs = $db->Execute($sql);
$user_id = $rs->fields('user_id');

$code = createRandom(16);
$sql = "INSERT INTO tb_email_confirmation VALUES ($user_id, '$code', 0)";
$rs = $db->Execute($sql);

$sql = "INSERT INTO tb_password_update VALUES ($user_id, getdate(), 0, NULL )";
$rs = $db->Execute($sql);

$sql = "INSERT INTO tb_court_system (user_id, court_type_id, state, county, court_name) VALUES ($user_id,'$court_type','$state','$court_county','$court_name')";
$rs = $db->Execute($sql);


$sql = "INSERT INTO tb_audit (user_id, event, event_date) VALUES ($user_id, 'User self-registered', getdate())";
$rs = $db->Execute($sql);



$message = ("

<HTML>
<BODY>


$fname,
<BR><BR>
Thank you for registering for the Veterans Re-Entry Search Service!
<BR><BR>

Please click on the link below or copy and paste the web address into your browser to confirm your account:
<BR><BR>
<A HREF=https://test.vrss.domain/confirm_account.php?c=$code>https://test.vrss.domain/confirm_account.php?c=$code</A>
<BR><BR>
Very Best,
<BR>
VRSS Administrator
<BR><HR><BR>
</BODY></HTML>

");

$headers = "To: $fname $lname <$email>\n" . "From: Veterans Re-Entry Search Service <noreply@domain>\n" . "MIME-Version: 1.0\n" . "Content-type: text/html; charset=iso-8859-1";


mail( $email, "Welcome to Veterans Re-Entry Search Service",
	$message, $headers );





print_header();
print ("

<table width=800 align=center>
<tr><td>
<BR>
<HR>
<H1 align=center>Thank You!</H1>
<BR>
<HR>
<H3 align=center>Your account registration has been submitted. You must next confirm your email address. An email message has been sent to $email. Please check your email and click on the link to confirm your email address.</H3>
<BR>
<BR>
	<H3 align=center><a href='login.php' target='_self'>Back to Login Page</a></H3>
<HR>
</td></tr></table>
");
print_footer();
} // end if no errors


// display error message
else {
print_header();
print "<br><hr><h1 align=center>$message</h1><hr><h3 align=center>Please press the Back button to return to previous page</h3>";
print_footer();
}


?>
