<?php
include('db.php'); 
session_start();

if (!isset($_SESSION['my_id'])) {
    header("Location: login.php");
    exit();
}
$user_id = $_SESSION['my_id'];       

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $ref = mysqli_real_escape_string($con, $_POST['transaction_ref']);
    $amount = isset($_SESSION['amount']) ? $_SESSION['amount'] : 0;
    $plan = isset($_SESSION['selected_plan']) ? $_SESSION['selected_plan'] : 'Plan';

    if (empty($ref)) {
        header("Location: payment_page.php?error=empty");
        exit();
    }

    $check = mysqli_query($con, "SELECT my_id FROM payments WHERE transaction_ref = '$ref'");
    if (mysqli_num_rows($check) > 0) {
        header("Location: payment_page.php?status=pending&ref=$ref&msg=already_submitted");
        exit();
    }

    // Insert with status pending. Expiry is NULL until admin approves.
    $sql = "INSERT INTO payments (my_id, transaction_ref, amount, plan, status, expiry_date) 
            VALUES ('$user_id', '$ref', '$amount', '$plan', 'pending', NULL)";

    if (mysqli_query($con, $sql)) {
        header("Location: payment_page.php?status=pending&ref=" . urlencode($ref));
        exit();
    }
}
?>