<?php

if(!isset($_SESSION)) {
session_start();
}
require_once('fnect.php'); //login to db
require_once('errors.php'); //login to db
require_once('success.php'); //login to db

$sid = mysqli_real_escape_string($fpecon, $_POST['staffNo']);
	//validate staff number
	if( strlen($sid) > 6 ){
	errors('Your Staff Number is incorrect. Please enter it as <b>S00XXX</b>!<br />');
	}
/*else {
	header("Location:../form/?fpe=pictures"); 
}
*/

// next validate and return if errors	
if(!is_uploaded_file($_FILES['staffpic']['tmp_name']) && getimagesize($_FILES['staffpic']['tmp_name']) != true){
	die(errors('Please upload a <strong>VALID Image</strong><br />'));
}

// now process if no error
$img_name = mysqli_real_escape_string($fpecon, $_FILES['staffpic']['name']);
$img_temp = mysqli_real_escape_string($fpecon, $_FILES['staffpic']['tmp_name']);
$img_size = mysqli_real_escape_string($fpecon, $_FILES['staffpic']['size']);
$img_type = mysqli_real_escape_string($fpecon, $_FILES['staffpic']['type']);


###############   check width  ############################
list($width, $height, $type, $attr) = getimagesize($_FILES['staffpic']['tmp_name']);
###############   end width check  ########################

$img_size = $_FILES['staffpic']['size'];
	if($img_size > 1000000){
	errors('Your image has exceded the image size limits. Please reduce it to below 1MB');
}

// determine extension type
$image_ext = substr($img_name, strpos($img_name, '.'), strlen($img_name) - 1); //check for image type
if (($image_ext != ".jpg")
&& 	($image_ext != ".jpeg")
&& 	($image_ext != ".png")){
	errors('Please upload a <strong>VALID Image or Picture Format</strong>.<br />
			Approved image format for this site is <strong>\'.jpg\',\'.jpeg\', and \'.png\' format only</strong>');
}

$image_store = "../emages/" . $img_name; //where to store the image
move_uploaded_file($_FILES['staffpic']['tmp_name'], $image_store); // move image to folder
	

//#######################################################################
// condition on where to insert image query
//#######################################################################
$fpesql = "UPDATE staff_profile_images SET Filename = '$img_name', MimeType ='$img_type', Filesize ='$img_size', Location = '$image_store' WHERE StaffNo ='$sid'";


// valdate query and tell user if successful or failed
$ok = @mysqli_query( $fpecon, $fpesql);
	if(!$ok){
	errors('Database Error: ' . mysqli_error());
	mysqli_close($fpecon);
	}
	else {
	success("The <strong>$fpem</strong> page was successfully updated in Staff Profile");
	}

?>