<?php
if($__TOKEN = "hardcodeshitbykernstudios"){
	if(isset($_SESSION['nEMID'])){
		$conn = sqlsrv_connect($__CONFIG['SQLHost'], array("Database"=>$__CONFIG['SQLDB'], "UID"=>$__CONFIG['SQLUID'], "PWD"=>$__CONFIG['SQLPWD']));
		$cat = null;
		$item = null;
		
		if(isset($_GET['item'])){
			$item = mssql_escape_string($_GET['item']);
		}
		if(isset($_GET['cat'])){
			$cat = mssql_escape_string($_GET['cat']);
		}
		
		if($cat != null && $item != null){
			if(isset($_POST['buyItem'])){
				$goodsNo = mssql_escape_string($_POST['itemID']);
				$checkItem = sqlsrv_query($conn, "SELECT * FROM tMallItems WHERE goodsNo = ? AND sEnabled = 1;", array($goodsNo), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
				if(sqlsrv_num_rows($checkItem) == 1){
					$fetchItem = sqlsrv_fetch_array($checkItem);
					$nRET = false;
					$points = null;
					$status = null;

					if($nRET == false){
						$selectAccount = sqlsrv_query($conn, "SELECT * FROM tAccounts WHERE nEMID = ? AND nAGPoints >= ?;", array($_SESSION['nEMID'], $fetchItem['sPrice']), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
						if(sqlsrv_has_rows($selectAccount) == 1){
							$deletePoints = sqlsrv_query($conn, "UPDATE tAccounts SET nAGPoints -= ? WHERE nEMID = ?;", array($fetchItem['sPrice'], $_SESSION['nEMID']));
							$points = $fetchItem['sPrice'];
							$status = 2;
						}else{
							$nRET = true;
						}
					}
					If ($points == null){
					$points = '00';
					}
					
					if($nRET == false){
						if($points != null && $status != null){
							$insertItem = sqlsrv_query($conn, "INSERT INTO tPurchases (nAGID, nPrice, nGoodsNo, nQuantity, nUsed, sIP, nIsGift, nStatus) VALUES (?, ?, ?, ?, ?, ?, ?, ?);", array($_SESSION['nEMID'], $points, $fetchItem['goodsNo'], $fetchItem['sUnit'],0 , getRemoteIP(), 0, $status));
							if($insertItem && $deletePoints){
								showMessage('success', 'Bought item successfully!');
							}else{
								showMessage('error', 'sqlsrv error: '.print_r(sqlsrv_errors(), true));
							}
						}else{
							showMessage('error', 'SP Error RS-0');
						}
					}else{
						showMessage('error', 'You not have enough Coins to buy this Item!');
					}
				}else{
					showMessage('error', 'Tampered ? Item not exists bitch!');
				}
			}
			$selectCategory = sqlsrv_query($conn, "SELECT nNo, sName FROM tMallCategory WHERE sEnabled = 1;", array(), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
			if(sqlsrv_has_rows($selectCategory) == 1){
				echo '<div id="cssmenu" style="float: left; padding-right: 50px;"><ul>';
				while ($fetchCategory = sqlsrv_fetch_array($selectCategory)){
					if($fetchCategory[0] == $cat){
						echo '<li class="active">';
					}else{
						echo '<li>';
					}
					echo '<a href="?module=mall&cat='.$fetchCategory['nNo'].'"><span>'.$fetchCategory['sName'].'</span></a></li>';
				}
				echo '</ul></div>';
			}else{
				showMessage('info', 'Currently no category has been added or enabled!');
			}
			
			$selectItems = sqlsrv_query($conn, "SELECT * FROM tMallItems WHERE goodsNo = ? AND sEnabled = 1;", array($item), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
			if(sqlsrv_has_rows($selectItems) == 1){
				echo '<div class="mallmain">';
				while ($fetchItems = sqlsrv_fetch_array($selectItems)){
					if($fetchItems['sPrice'] > 0){
						$price = $fetchItems['sPrice'].' <i class="fa fa-usd"></i>';
					}else{
						$price = 'Free';
					}
					echo '<div class="mallIten"><h1>'.$fetchItems['sName'].'</h1>(Lot x'.$fetchItems['sUnit'].')<br><img style="box-shadow: 10px 20px 30px grey;" width="80px" height="80px" src="./images/mall/'.$fetchItems['sImage'].'.png" alt="'.$fetchItems['sName'].'" width="80px" heigth="80px"><br>'.$price.'<br><form method="post"><input type="hidden" name="itemID" value="'.$fetchItems['goodsNo'].'"><input type="submit" name="buyItem" value="Buy" class="myButton"></div>';
					echo '<div style="float: left; padding-top: 20px;"><h1>Description: </h1>'.$fetchItems['sDescription'].'</div>';
				}
				echo '</div>';
			}else{
				echo '<div style="float: left;width: 50%;">';
				showMessage('info', 'No items exists in this category!');
				echo '</div>';
			}
		}elseif($cat != null){
			$selectCategory = sqlsrv_query($conn, "SELECT nNo, sName FROM tMallCategory WHERE sEnabled = 1;", array(), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
			if(sqlsrv_has_rows($selectCategory) == 1){
				echo '<div id="cssmenu" style="float: left; padding-right: 50px;"><ul>';
				while ($fetchCategory = sqlsrv_fetch_array($selectCategory)){
					if($fetchCategory[0] == $cat){
						echo '<li class="active">';
					}else{
						echo '<li>';
					}
					echo '<a href="?module=mall&cat='.$fetchCategory['nNo'].'"><span>'.$fetchCategory['sName'].'</span></a></li>';
				}
				echo '</ul></div>';
			}else{
				showMessage('info', 'Currently no category has been added or enabled!');
			}
			
			$selectItems = sqlsrv_query($conn, "SELECT * FROM tMallItems WHERE sCategory = ? AND sEnabled = 1;", array($cat), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
			if(sqlsrv_has_rows($selectItems) == 1){
				echo '<div class="mallmain">';
				echo '<div class="mallcontent">';
				while ($fetchItems = sqlsrv_fetch_array($selectItems)){
					if($fetchItems['sPrice'] > 0){
						$price = $fetchItems['sPrice'].' <i class="fa fa-usd"></i>';
				
					}else{
						$price = 'Free';
					}
					echo '<div class="mallIten"><a href="?module=mall&cat='.$cat.'&item='.$fetchItems['goodsNo'].'">'.$fetchItems['sName'].'(x'.$fetchItems['sUnit'].')<br><img style="box-shadow: 10px 20px 30px grey;" width="80px" height="80px" src="./images/mall/'.$fetchItems['sImage'].'.png" alt="'.$fetchItems['sName'].'" width="80px" heigth="80px"><br>'.$price.'<br><input type="submit" name="buyNow" value="View" class="myButton"></a></div>';
				}
				echo '</div>';
				echo '</div>';
			}else{
				echo '<div style="float: left;width: 50%;">';
				showMessage('info', 'No items exists in this category!');
				echo '</div>';
			}
		}else{
			$selectCategory = sqlsrv_query($conn, "SELECT nNo, sName FROM tMallCategory WHERE sEnabled = 1;", array(), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
			if(sqlsrv_has_rows($selectCategory) == 1){
				echo '<div id="cssmenu" style="float: left; padding-right: 50px;"><ul>';
				while ($fetchCategory = sqlsrv_fetch_array($selectCategory)){
					echo '<a href="?module=mall&cat='.$fetchCategory['nNo'].'"><span>'.$fetchCategory['sName'].'</span></a></li>';
				}
				echo '</ul></div>';
			}else{
				showMessage('info', 'Currently no category has been added or enabled!');
			}
			
			echo '<div style="float:">
			<center>
			Welcome to Charisma Gaming Item Mall. Select one category to see around what you need!
			<br>
			<a class="myButton" href="?module=Payment">Donate</a>
			</center>
			</div>';
		}
	}else{
				if(isset($_POST['submit'])){
			$username = mssql_escape_string($_POST['username']);
			$password = mssql_escape_string($_POST['password']);
			
			$conn = sqlsrv_connect($__CONFIG['SQLHost'], array("Database"=>$__CONFIG['SQLDB'], "UID"=>$__CONFIG['SQLUID'], "PWD"=>$__CONFIG['SQLPWD']));
			if(!$conn){
				echo print_r(sqlsrv_errors(), true);
			}else{
				$checkAccount = sqlsrv_query($conn, "SELECT * FROM tAccounts WHERE sUsername = ? AND sUserPass = ?;", array($username, md5($password)), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
				if(sqlsrv_num_rows($checkAccount) == 1){
					$fetchAccount = sqlsrv_fetch_array($checkAccount);
					$_SESSION['nEMID'] = $fetchAccount['nEMID'];
					showMessage('success', 'Successfully logged in!', 3, '?module=mall');
				}else{
					showMessage('error', 'Username and/or Password wrong!!');
				}
			}
		}else{
			echo '<center><form method="post">
				Username: <input type="text" name="username" required>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Password:&nbsp;<input type="password" name="password" required>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="submit" name="submit" value="Submit" class="myButton">
			</form></center>';
		}
	}
}
?>