<?php
class User{
    // database connection and table name
    private $conn;
    private $table_name = "user";
 
    // object properties
	public $id;	
    public $username;
	public $password;
	public $userrole;
	public $profilepicture;
	public $city;
	public $accounting_view;

	public $code;
	public $currentpassword;
 
    public function __construct($db){
        $this->conn = $db;
    }		
    
    function update(){
		$query = "UPDATE " . $this->table_name . " SET username=:username, password=:password WHERE id=:id";
		$stmt = $this->conn->prepare($query);

		$stmt->bindParam(":id", $this->id);
		$stmt->bindParam(":username", $this->username);
		$stmt->bindParam(":password", $this->password);
		// $stmt->bindParam(":city", $this->city);
		if($stmt->execute()){
			return true;
		}	 
		return false;
	}
//createaccount

	function getAllRows(){
		$query = "SELECT user.*,date_time as last_login FROM user LEFT JOIN
		(SELECT `log`.* FROM (SELECT MAX(id) AS mxid FROM `log` GROUP BY staff_id) AS a
		LEFT JOIN `log` ON a.mxid=`log`.id) AS b ON user.id=b.staff_id
		 ORDER BY id";
		$stmt = $this->conn->prepare($query);
		$stmt->execute();
		return $stmt;
	}

	function delete(){
		$query = "DELETE FROM " . $this->table_name . " WHERE id = ?";
		$stmt = $this->conn->prepare($query);
		$this->id = htmlspecialchars(strip_tags($this->id));
		$stmt->bindParam(1, $this->id);
		if($stmt->execute()){
			return true;
		}
		return false;
	}

	function create(){
		$query = "INSERT INTO " . $this->table_name . " SET username=:username, userrole=:userrole, city=:city, accounting_view=:accounting_view, password=:password, profilepicture=:profilepicture";
		$stmt = $this->conn->prepare($query);

		$stmt->bindParam(":username", $this->username);
		$stmt->bindParam(":userrole", $this->userrole);
		$stmt->bindParam(":city", $this->city);
		$stmt->bindParam(":accounting_view", $this->accounting_view);
		$stmt->bindParam(":password", $this->password);
		$stmt->bindParam(":profilepicture", $this->profilepicture);
	 
		if($stmt->execute()){
			return true;
		}	 
		return false;
	}

	function exist2(){
		$condition = "";	
		
		if($this->username){
			if($condition!=""){
				$condition .= " OR ";
			}
			$condition .= " username=:username";
		}

		if($condition!=""){
			$condition = " WHERE " . $condition;
		}

		$query = "SELECT * FROM " . $this->table_name . $condition;
		$stmt = $this->conn->prepare( $query );
		$this->username=htmlspecialchars(strip_tags($this->username));
		if($this->username) $stmt->bindParam(":username", $this->username);
		
		$stmt->execute();
		if($stmt->rowCount()>0){
			return true;
		}
		return false;
	}

	function edit(){
		$condition = ""; 
		if($this->profilepicture!=""){
			$condition = ", profilepicture=:profilepicture";
		}

		$query = "UPDATE  " . $this->table_name . " SET userrole=:userrole, city=:city, accounting_view=:accounting_view " . $condition  . " WHERE username=:username";
		$stmt = $this->conn->prepare($query);	

		$stmt->bindParam(":username", $this->username);
		$stmt->bindParam(":userrole", $this->userrole);
		$stmt->bindParam(":city", $this->city);
		$stmt->bindParam(":accounting_view", $this->accounting_view);
		if($this->profilepicture!="") $stmt->bindParam(":profilepicture", $this->profilepicture);

		if($stmt->execute()){
			return true;
		}	 
		return false;
	}

	//userlist
	function getOneRow(){
		$query = "SELECT * FROM " . $this->table_name . "  WHERE id = ?";
		$stmt = $this->conn->prepare($query);
		$stmt->bindParam(1, $this->id);
		$stmt->execute();
		$row = $stmt->fetch(PDO::FETCH_ASSOC);
		$this->username = $row['username'];
		$this->userrole = $row['userrole'];
		$this->profilepicture = $row['profilepicture'];
	}

	//changepassword
	function exist3(){
		$query = "SELECT id FROM " . $this->table_name . " WHERE username = ? and password = ? LIMIT 0,1";
		$stmt = $this->conn->prepare( $query );

		$stmt->bindParam(1, $this->username);
		$stmt->bindParam(2, $this->currentpassword);
		
		$stmt->execute();
		if($stmt->rowCount()>0){
			$row = $stmt->fetch(PDO::FETCH_ASSOC);
			$this->id = $row['id'];
			return true;
		}
		return false;
	}



	function exist(){
		echo $query = "SELECT " . $this->table_name . ".*,code FROM " . $this->table_name . " left join city on " . $this->table_name . ".city=city.name WHERE username = ? and password = ? LIMIT 0,1";
		$stmt = $this->conn->prepare( $query );
		$this->username=htmlspecialchars(strip_tags($this->username));
		$this->password=htmlspecialchars(strip_tags($this->password));
	 
		$stmt->bindParam(1, $this->username);
		$stmt->bindParam(2, $this->password);
		
		$stmt->execute();
		if($stmt->rowCount()>0){
			$row = $stmt->fetch(PDO::FETCH_ASSOC);
			extract($row);
			$this->id = $id;	
			$this->username = $username;
			$this->userrole = $userrole;
			$this->accounting_view = $accounting_view;
			$this->city = $city;
			$this->code = $code;
			return true;
		}
		return false;
	}
}
?>