isLoggedIn() || !$auth->isAdmin()) {
redirectTo('dashboard.php');
}
$currentUser = $auth->getCurrentUser();
$db = Database::getInstance();
$error = '';
$success = '';
// Handle form submissions
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$action = $_POST['action'] ?? '';
if ($action === 'create') {
$fullName = sanitizeInput($_POST['full_name'] ?? '');
$email = sanitizeInput($_POST['email'] ?? '');
$phone = sanitizeInput($_POST['phone'] ?? '');
$whatsapp = sanitizeInput($_POST['whatsapp'] ?? '');
$password = $_POST['password'] ?? '';
$role = sanitizeInput($_POST['role'] ?? 'user');
if (empty($fullName) || empty($email) || empty($password)) {
$error = 'Please fill in all required fields.';
} elseif (!validateEmail($email)) {
$error = 'Please enter a valid email address.';
} else {
// Check if email already exists
$email_escaped = $db->escape($email);
$checkResult = $db->query("SELECT id FROM users WHERE email = '$email_escaped'");
if ($checkResult && $checkResult->num_rows > 0) {
$error = 'A user with this email already exists.';
} else {
$hashedPassword = password_hash($password, PASSWORD_DEFAULT);
$fullName_escaped = $db->escape($fullName);
$phone_escaped = $db->escape($phone);
$whatsapp_escaped = $db->escape($whatsapp);
$role_escaped = $db->escape($role);
$sql = "INSERT INTO users (full_name, email, phone, whatsapp, password, role)
VALUES ('$fullName_escaped', '$email_escaped', '$phone_escaped', '$whatsapp_escaped', '$hashedPassword', '$role_escaped')";
if ($db->query($sql)) {
$success = 'User created successfully.';
} else {
$error = 'Error creating user: ' . $db->getLastError();
}
}
}
} elseif ($action === 'update') {
$userId = (int)$_POST['user_id'];
$fullName = sanitizeInput($_POST['full_name'] ?? '');
$email = sanitizeInput($_POST['email'] ?? '');
$phone = sanitizeInput($_POST['phone'] ?? '');
$whatsapp = sanitizeInput($_POST['whatsapp'] ?? '');
$role = sanitizeInput($_POST['role'] ?? 'user');
if (empty($fullName) || empty($email)) {
$error = 'Please fill in all required fields.';
} elseif (!validateEmail($email)) {
$error = 'Please enter a valid email address.';
} else {
$fullName_escaped = $db->escape($fullName);
$email_escaped = $db->escape($email);
$phone_escaped = $db->escape($phone);
$whatsapp_escaped = $db->escape($whatsapp);
$role_escaped = $db->escape($role);
$sql = "UPDATE users SET
full_name = '$fullName_escaped',
email = '$email_escaped',
phone = '$phone_escaped',
whatsapp = '$whatsapp_escaped',
role = '$role_escaped'
WHERE id = $userId";
if ($db->query($sql)) {
$success = 'User updated successfully.';
} else {
$error = 'Error updating user: ' . $db->getLastError();
}
}
} elseif ($action === 'delete') {
$userId = (int)$_POST['user_id'];
// Don't allow deleting yourself
if ($userId === (int)$_SESSION['user_id']) {
$error = 'You cannot delete your own account.';
} else {
$sql = "DELETE FROM users WHERE id = $userId";
if ($db->query($sql)) {
$success = 'User deleted successfully.';
} else {
$error = 'Error deleting user: ' . $db->getLastError();
}
}
}
}
// Get all users
$users = $db->query("SELECT * FROM users ORDER BY created_at DESC");
?>
Users | <?php echo APP_NAME; ?>
| Name |
Email |
Phone |
WhatsApp |
Role |
Created |
Actions |
num_rows > 0): ?>
fetch_assoc()): ?>
|
|
|
|
|
|
|
| No users found |