<?php
class User{
    // database connection and table name
    private $conn;
    private $table_name = "user";
 
    // object properties
	public $id;	
	public $staff_id;
    public $username;
	public $password;
	public $userrole_id;
	public $profilepicture;

	public $rolename;
 
    public function __construct($db){
        $this->conn = $db;
    }		

	function create(){
		$query = "INSERT INTO " . $this->table_name . " SET staff_id=:staff_id, username=:username, userrole_id=:userrole_id, password=:password, profilepicture=:profilepicture";
		$stmt = $this->conn->prepare($query);

		$stmt->bindParam(":staff_id", $this->staff_id);
		$stmt->bindParam(":username", $this->username);
		$stmt->bindParam(":userrole_id", $this->userrole_id);
		$stmt->bindParam(":password", $this->password);
		$stmt->bindParam(":profilepicture", $this->profilepicture);
	 
		if($stmt->execute()){
			return true;
		}	 
		return false;
	}

	function update(){
		$condition = ""; 
		if($this->profilepicture!=""){
			$condition = ", profilepicture=:profilepicture";
		}

		$query = "UPDATE  " . $this->table_name . " SET staff_id=:staff_id, username=:username, userrole_id=:userrole_id, password=:password " . $condition  . " WHERE id=:id";
		$stmt = $this->conn->prepare($query);	

		$stmt->bindParam(":id", $this->id);
		$stmt->bindParam(":staff_id", $this->staff_id);
		$stmt->bindParam(":username", $this->username);
		$stmt->bindParam(":userrole_id", $this->userrole_id);
		$stmt->bindParam(":password", $this->password);
		if($this->profilepicture!="") $stmt->bindParam(":profilepicture", $this->profilepicture);

		if($stmt->execute()){
			return true;
		}	 
		return false;
	}

	function delete(){
		$query = "DELETE FROM " . $this->table_name . " WHERE id = ?";
		$stmt = $this->conn->prepare($query);
		$this->id = htmlspecialchars(strip_tags($this->id));
		$stmt->bindParam(1, $this->id);
		if($stmt->execute()){
			return true;
		}
		return false;
	}

	//userlist
	function getOneRow(){
		$query = "SELECT user.*,rolename FROM " . $this->table_name . " left join userrole on user.userrole_id=userrole.id left join staff on user.staff_id=staff.id WHERE user.id = ?";
		$stmt = $this->conn->prepare($query);
		$stmt->bindParam(1, $this->id);
		$stmt->execute();
		$row = $stmt->fetch(PDO::FETCH_ASSOC);
		$this->id = $row['id'];
		$this->staff_id = $row['staff_id'];
		$this->username = $row['username'];
		$this->password = $row['password'];
		$this->userrole_id = $row['userrole_id'];
		$this->rolename = $row['rolename'];
		$this->profilepicture = $row['profilepicture'];
	}

	function getAllRows(){
		$query = "SELECT user.*,userrole.rolename,staff.name FROM " . $this->table_name . " left join userrole on user.userrole_id=userrole.id left join staff on user.staff_id=staff.id ORDER BY id";
		$stmt = $this->conn->prepare($query);
		$stmt->execute();
		return $stmt;
	}

	function exist(){
		$query = "SELECT * FROM " . $this->table_name . " WHERE username = ? and password = ? LIMIT 0,1";
		$stmt = $this->conn->prepare( $query );
		$this->username=htmlspecialchars(strip_tags($this->username));
		$this->password=htmlspecialchars(strip_tags($this->password));
	 
		$stmt->bindParam(1, $this->username);
		$stmt->bindParam(2, $this->password);
		
		$stmt->execute();
		if($stmt->rowCount()>0){
			$row = $stmt->fetch(PDO::FETCH_ASSOC);
			extract($row);
			$this->id = $id;	
			$this->staff_id = $staff_id;
			$this->userrole_id = $userrole_id;
			$this->profilepicture = $profilepicture;
			// $this->username = $username;
			return true;
		}
		return false;
	}

	function exist2(){
		$condition = "";	
		
		if($this->username){
			if($condition!=""){
				$condition .= " OR ";
			}
			$condition .= " username=:username";
		}

		if($this->staff_id){
			if($condition!=""){
				$condition .= " OR ";
			}
			$condition .= " staff_id=:staff_id";
		}

		if($condition!=""){
			$condition = " WHERE " . $condition;
		}

		$query = "SELECT * FROM " . $this->table_name . $condition;
		$stmt = $this->conn->prepare( $query );
		$this->username=htmlspecialchars(strip_tags($this->username));
		if($this->username) $stmt->bindParam(":username", $this->username);
		if($this->staff_id) $stmt->bindParam(":staff_id", $this->staff_id);
		$stmt->execute();
		if($stmt->rowCount()>0){
			return true;
		}
		return false;
	}

	//changepassword
	function exist3(){
		$query = "SELECT id FROM " . $this->table_name . " WHERE username = ? and password = ? LIMIT 0,1";
		$stmt = $this->conn->prepare( $query );

		$stmt->bindParam(1, $this->username);
		$stmt->bindParam(2, $this->currentpassword);
		
		$stmt->execute();
		if($stmt->rowCount()>0){
			$row = $stmt->fetch(PDO::FETCH_ASSOC);
			$this->id = $row['id'];
			return true;
		}
		return false;
	}




}
?>