<?php
    ob_start();
    session_start();
    
    date_default_timezone_set("Africa/Nairobi");
    include('../../../../db_connect.php');
    
    if(isset($_POST['staff'])){
        //Function to sanitize values received from the form. Prevents SQL injection
        function clean($str) {
    		$str = @trim($str);
    		if(get_magic_quotes_gpc()) {
    			$str = stripslashes($str);
    		}
    		return mysql_real_escape_string($str);
    	}
        /*end of function*/
        $request = clean($_POST['request']);
        $user = clean($_POST['staff']);
        
            $qry1="SELECT * FROM gatepass WHERE gatepassID='$request' AND  status='1'";
            $res1=mysql_query($qry1); 
            $nm=mysql_num_rows($res1);
            
            
            //Check whether the query was successful or not
            if(!$res1) {
                echo "SQL_error";
            }else
            if($nm >= 1) {
                echo "request_error";
            }else
            {
                if(!$update = mysql_query("UPDATE gate_pass SET status='1',staffID='$user',approval_date=NOW(),updated_by='$stafNo' WHERE gatepassID='$request' ")){
                    echo'<div class="alert alert-danger absolue center text-center" role="alert">
                            <button type="button" class="close" data-dismiss="alert" aria-label="Close">
                                <span aria-hidden="true">×</span>
                            </button>
                            <span class="text-danger">'.mysql_error().'</span>
                        </div>';
                }else
                {
                    echo "approval_success";                
                }
            }
        }   
    
?>