<?php    
    $year=$price="";
    if(isset($_POST['add'])){
        //Function to sanitize values received from the form. Prevents SQL injection
        function clean($str) {
    		$str = @trim($str);
    		if(get_magic_quotes_gpc()) {
    			$str = stripslashes($str);
    		}
    		return mysql_real_escape_string($str);
    	}
        
        $course = $id;
        $year = clean($_POST['year']);
        $staff = $staffID;
        
        if(!$course){
            echo'<div class="alert alert-danger absolue center text-center" role="alert">
                    <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                        <span aria-hidden="true">×</span>
                    </button>
                    <span class="text-danger">Failed to identify Course!</span>
                </div>';
        }else
        if(!$staff){
            echo'<div class="alert alert-danger absolue center text-center" role="alert">
                    <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                        <span aria-hidden="true">×</span>
                    </button>
                    <span class="text-danger">Failed to identify Accounts User!</span>
                </div>';
        }else    
        if(!$year){
            echo'<div class="alert alert-danger absolue center text-center" role="alert">
                    <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                        <span aria-hidden="true">×</span>
                    </button>
                    <span class="text-danger">Select Year of Study!</span>
                </div>';
        }else
        if(!isset($_POST["miss"]) && !is_array($_POST["miss"])){
            echo'<div class="alert alert-warning absolue center text-center" role="alert">
                    <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                        <span aria-hidden="true">×</span>
                    </button>
                    <span class="text-warning">Error: Failed to identify Misscellanious!</span>
                </div>';            
        }else
        if(!isset($_POST["fee"]) && !is_array($_POST["fee"])){
            echo'<div class="alert alert-danger absolue center text-center" role="alert">
                    <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                        <span aria-hidden="true">×</span>
                    </button>
                    <span class="text-danger">Enter Quantity!</span>
                </div>';
        }else
            {
                $fee=$_POST["fee"];
                $item = $_POST['miss'];
                    
                    $selectx=mysql_query("SELECT COUNT(*)AS num FROM misscellanioused_course WHERE courseID ='$course' AND year='$year'");
                    $pagesx = mysql_fetch_array($selectx);
                    $total = $pagesx['num'];   
                    
                    if($total > 0){
                         echo'<div class="alert alert-warning absolue center text-center" role="alert">
                                <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                                    <span aria-hidden="true">×</span>
                                </button>
                                <span class="text-warning">
                                    Misscellanious already exists for this course and year of study
                                </span>
                            </div>';
                    }else
                    {
                        for($i=0;$i<count($item);$i++){}
                        
                        $officer = array_fill(0,$i,$staff);
                        $yr = array_fill(0,$i,$year);
                        $courseID = array_fill(0,$i,$course);
                        $date = array_fill(0,$i,date("Y-m-d G:i:s"));
                        $staf_No = array_fill(0,$i,$stafNo);
                        
                        $c = array_map(function ($item,$courseID,$yr,$fee,$date,$officer,$staf_No){return "'$item','$courseID','$yr','$fee','$date','$officer','$staf_No'";} ,$item,$courseID,$yr,$fee,$date,$officer,$staf_No);
                       
                        if(!$insert_row =mysql_query("INSERT INTO misscellanioused_course(miscellaneousID,courseID,year,amount,added,staffID,added_by) VALUES (".implode('),(', $c).")"))
                        {
                            echo'<div class="alert alert-warning absolue center text-center" role="alert">
                                    <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                                        <span aria-hidden="true">×</span>
                                    </button>
                                    <span class="text-warning">'.mysql_error().'</span>
                                </div>';
                        }
                         else{
                            $_SESSION['miss_success']='True';
                            header("Location:course-misscellanious.php?id=".$course);
                            exit();
                        }
                    }
                }
            
        }
?>                                                             