=============================
File: /home/ayrshireaccounts/manage/api/create_client.php
=============================
'Missing required fields']);
exit;
}
// Sanitize and prepare
$first_name = $mysqli->real_escape_string($data['first_name']);
$surname = $mysqli->real_escape_string($data['surname']);
$email = $mysqli->real_escape_string($data['email']);
$telephone = $mysqli->real_escape_string($data['telephone'] ?? '');
$address1 = $mysqli->real_escape_string($data['address1'] ?? '');
$town = $mysqli->real_escape_string($data['town'] ?? '');
$postcode = $mysqli->real_escape_string($data['postcode'] ?? '');
// Insert client
$stmt = $mysqli->prepare("INSERT INTO clients (first_name, surname, email, telephone, address1, town, postcode, username) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
$username = $email; // Reuse email as login
$stmt->bind_param("ssssssss", $first_name, $surname, $email, $telephone, $address1, $town, $postcode, $username);
$stmt->execute();
echo json_encode(['success' => true, 'client_id' => $stmt->insert_id]);
=============================
File: /home/ayrshireaccounts/manage/config/db.php
=============================
app_env('APP_ENV', 'production'),
'key' => app_env('APP_KEY', ''), // can be used for your own crypto/HMAC later
];
/* --------------------------
DATABASE (PDO)
-------------------------- */
$dbHost = app_env('DB_HOST', 'localhost');
$dbName = app_env('DB_NAME', '');
$dbUser = app_env('DB_USER', '');
$dbPass = app_env('DB_PASS', '');
try {
$pdo = new PDO(
"mysql:host={$dbHost};dbname={$dbName};charset=utf8mb4",
$dbUser,
$dbPass,
[
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
PDO::MYSQL_ATTR_FOUND_ROWS => true,
]
);
} catch (Throwable $e) {
http_response_code(500);
echo "Database connection failed.";
if (($appConfig['env'] ?? 'production') !== 'production') {
echo "" . e($e->getMessage()) . "
";
}
exit;
}
/* --------------------------
MAIL CONFIG (for PHPMailer or similar)
-------------------------- */
$mailConfig = [
'host' => app_env('MAIL_HOST', ''),
'port' => (int) app_env('MAIL_PORT', 587),
'user' => app_env('MAIL_USER', ''),
'pass' => app_env('MAIL_PASS', ''),
'from' => app_env('MAIL_FROM', 'no-reply@example.com'),
'encr' => app_env('MAIL_ENCRYPTION', 'tls'), // tls|ssl|none
];
/**
* Optional factory for PHPMailer (if you use it).
* Usage:
* require_once __DIR__ . '/bootstrap.php';
* $mail = newMailer();
* $mail->addAddress('client@example.com');
* $mail->Subject = 'Hello';
* $mail->Body = 'Message';
* $mail->send();
*/
function newMailer(): ?PHPMailer\PHPMailer\PHPMailer {
if (!class_exists(PHPMailer\PHPMailer\PHPMailer::class)) {
return null; // PHPMailer not loaded; include it where appropriate
}
global $mailConfig;
$mail = new PHPMailer\PHPMailer\PHPMailer(true);
$mail->isSMTP();
$mail->Host = $mailConfig['host'];
$mail->Port = $mailConfig['port'];
$mail->SMTPAuth = true;
$mail->Username = $mailConfig['user'];
$mail->Password = $mailConfig['pass'];
$mail->setFrom($mailConfig['from']);
$enc = strtolower((string)$mailConfig['encr']);
if ($enc === 'ssl') {
$mail->SMTPSecure = PHPMailer\PHPMailer\PHPMailer::ENCRYPTION_SMTPS;
} elseif ($enc === 'tls') {
$mail->SMTPSecure = PHPMailer\PHPMailer\PHPMailer::ENCRYPTION_STARTTLS;
} else {
$mail->SMTPSecure = false;
}
return $mail;
}
/* --------------------------
CSRF TOKEN (global, simple)
-------------------------- */
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
function csrf_field(): string {
return '';
}
function csrf_check(): void {
$ok = isset($_POST['csrf_token']) && hash_equals($_SESSION['csrf_token'], $_POST['csrf_token']);
if (!$ok) {
http_response_code(400);
exit('Invalid CSRF token');
}
}
/* --------------------------
ROLE GUARD (owner/staff)
-------------------------- */
function requireRole(array $roles): void {
$role = $_SESSION['role'] ?? null;
if (!$role || !in_array($role, $roles, true)) {
http_response_code(403);
exit('Forbidden');
}
}
/**
* Lightweight PDO helpers
* Usage:
* $rows = db_all("SELECT * FROM clients WHERE active = ?", [1]);
* $row = db_one("SELECT * FROM clients WHERE id = ?", [$id]);
* $count = db_exec("UPDATE clients SET active=0 WHERE id=?", [$id]);
* $id = db_insert("INSERT INTO clients(first_name,surname,email) VALUES(?,?,?)",
* [$first, $last, $email]);
*/
function db_all(string $sql, array $params = []): array {
global $pdo;
$st = $pdo->prepare($sql);
$st->execute($params);
return $st->fetchAll();
}
function db_one(string $sql, array $params = []): ?array {
global $pdo;
$st = $pdo->prepare($sql);
$st->execute($params);
$row = $st->fetch();
return $row === false ? null : $row;
}
function db_exec(string $sql, array $params = []): int {
global $pdo;
$st = $pdo->prepare($sql);
$st->execute($params);
return $st->rowCount();
}
function db_insert(string $sql, array $params = []): int {
global $pdo;
$st = $pdo->prepare($sql);
$st->execute($params);
return (int)$pdo->lastInsertId();
}
function auth_user(): array {
return [
'id' => (int)($_SESSION['user_id'] ?? 0),
'username' => (string)($_SESSION['username'] ?? ''),
];
}
function user_roles(int $user_id): array {
$rows = db_all("
SELECT r.name
FROM user_roles ur
JOIN roles r ON ur.role_id = r.id
WHERE ur.user_id = ?
", [$user_id]);
return array_map(fn($r) => $r['name'], $rows ?: []);
}
function user_permissions(int $user_id): array {
$rows = db_all("
SELECT DISTINCT p.code
FROM user_roles ur
JOIN role_permissions rp ON ur.role_id = rp.role_id
JOIN permissions p ON rp.permission_id = p.id
WHERE ur.user_id = ?
", [$user_id]);
return array_map(fn($r) => $r['code'], $rows ?: []);
}
function can(string $perm): bool {
$u = auth_user(); if (!$u['id']) return false;
$perms = user_permissions($u['id']);
return in_array($perm, $perms, true);
}
function requirePermission(string $perm): void {
if (!can($perm)) {
http_response_code(403);
exit('Forbidden');
}
}
=============================
File: /home/ayrshireaccounts/manage/config/db_old.php
=============================
connect_errno) {
echo "Failed to connect to MySQL: " . $mysqli->connect_error;
exit();
}
?>
=============================
File: /home/ayrshireaccounts/manage/includes/footer.php
=============================