<?

php
include("config.php");
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

function generateRandomPassword($length = 8) {
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$charactersLength = strlen($characters);
$randomPassword = '';
for ($i = 0; $i < $length; $i++) {
$randomPassword .= $characters[rand(0, $charactersLength - 1)];
}
return $randomPassword;
}
if (isset($_POST['bulk_import'])) {
if (!isset($_FILES['csv_file']) || $_FILES['csv_file']['error'] !==
UPLOAD_ERR_OK) {
echo "<script>alert('Please select a valid CSV file.');
window.location.href='../your_page.php';</script>";
exit();
}

$file = $_FILES['csv_file']['tmp_name'];
$handle = fopen($file, "r");

if (!$handle) {
echo "<script>alert('Error opening file.');
window.location.href='../your_page.php';</script>";
exit();
}

date_default_timezone_set('Asia/Manila');

// Skip the header row

fgetcsv($handle);

while (($data = fgetcsv($handle, 1000, ",")) !== FALSE) {

$current_date_time = date('Y-m-d');
$x = date('Y');
$date = "SDOGO-" . $x . "-";

$query = "SELECT MAX(RIGHT(user_id,4)) as maxid FROM tbl_employee_info

WHERE LEFT(user_id,11)='$date' ORDER BY user_id";
$result = mysqli_query($con, $query);
$number_of_rows = mysqli_num_rows($result);

if ($number_of_rows > 0) {
$row = mysqli_fetch_assoc($result);
$newID = (intval($row['maxid']) + 1);
} else {
$newID = 1;
}

$empid1 = str_pad($newID, 4, '0', STR_PAD_LEFT);

$empid2 = $date . $empid1;

// Escape values to prevent SQL injection

$user_id = $empid2;
 $first_name = mysqli_real_escape_string($con, $data[1]);
$middle_name = mysqli_real_escape_string($con, $data[2]);
$last_name = mysqli_real_escape_string($con, $data[3]);
$ext_name = mysqli_real_escape_string($con, $data[4]);
$gender = mysqli_real_escape_string($con, $data[5]);
$birthdate = mysqli_real_escape_string($con, $data[6]);
$place_of_birth = mysqli_real_escape_string($con, $data[7]);
$contact_number = mysqli_real_escape_string($con, $data[8]);
$gov_email = mysqli_real_escape_string($con, $data[9]);
$employee_no = mysqli_real_escape_string($con, $data[10]);
$philhealth = mysqli_real_escape_string($con, $data[11]);
$pagibig = mysqli_real_escape_string($con, $data[13]);
$tin = mysqli_real_escape_string($con, $data[14]);
$street = mysqli_real_escape_string($con, $data[15]);
$street_brgy = mysqli_real_escape_string($con, $data[16]);
$municipality = mysqli_real_escape_string($con, $data[17]);
$province = mysqli_real_escape_string($con, $data[18]);
$region = mysqli_real_escape_string($con, $data[19]);
$disability = mysqli_real_escape_string($con, $data[20]);
$bp_no = mysqli_real_escape_string($con, $data[21]);

// Generate default login credentials

$username = strtolower($first_name . "." . $last_name); // Example:
john.doe
$default_password = password_hash("password123", PASSWORD_DEFAULT); //
Default password

// Insert into tbl_employee_info

$query1 = "INSERT INTO tbl_employee_info (user_id, first_name, middle_name,
last_name, ex_name, gender, birthdate, place_of_birth, contact_num, gov_email,
employee_no, philhealth, pagibig, TIN, street, street_brgy, municipality, province,
region, disability, bp_no, date_encoded)
VALUES ('$user_id', '$first_name', '$middle_name', '$last_name',
'$ext_name', '$gender', '$birthdate', '$place_of_birth', '$contact_number',
'$gov_email', '$employee_no', '$philhealth', '$pagibig', '$tin', '$street',
'$street_brgy', '$municipality', '$province', '$region', '$disability', '$bp_no',
NOW())";

// Insert into tbl_employment_info

$query2 = "INSERT INTO tbl_employment_info (user_id, position,
date_orig_appoint, salary_grade, salary_step, salary_effect_date, vice,
nature_appoint, status_appoint, plantilla_item_no, plantilla_inclu,
school_office_assign, school_detailed_office_assign, designated_from,
designated_to, separation, separation_date)
VALUES ('$user_id', '$data[20]', '$data[21]', '$data[22]',
'$data[23]', '$data[24]', '$data[25]', '$data[26]', '$data[27]', '$data[28]',
'$data[29]', '$data[30]', '$data[31]', '', '', '', '')";

// Insert into tbl_educational_bg

$query3 = "INSERT INTO tbl_educational_bg (user_id, elementary,
elem_duration, secondary, second_duration, college, college_duration, vocational,
voca_duration, masters_degree, master_duration, doc_degree, doc_duration,
voc_school, college_school, master_units, doc_units)
VALUES ('$user_id', '', '', '', '', '', '', '', '', '', '', '',
'', '', '', '', '')";

// Insert into tbl_eligibility

$query4 = "INSERT INTO tbl_eligibility (user_id, type_eligibility,
date_issue, validity)
 VALUES ('$user_id', '', '', '')";

$length = 8;
$characters =
'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$randomPassword = '';
for ($i = 0; $i < $length; $i++) {
$randomPassword .= $characters[rand(0, strlen($characters) - 1)];
}
echo $randomPassword;
// Insert into userdata (Default credentials)
$query5 = "INSERT INTO userdata (userid, username, password, user_pos,
user_stat, pass_change, OTP)
VALUES ('$user_id', '$gov_email', '$randomPassword', '',
'Disabled', 'No', '')";

// Execute all queries

mysqli_query($con, $query1);
mysqli_query($con, $query2);
mysqli_query($con, $query3);
mysqli_query($con, $query4);
mysqli_query($con, $query5);
}

fclose($handle);
echo "<script>alert('CSV file successfully imported!');
window.location.href='../HR/master_list.php';</script>";
}

if(isset($_POST['changepassadmin'])){
$query = "update userdata set password = '".$_POST['password']."' where userid
= '".$_POST['id']."'";
mysqli_query($con,$query);

$date = date("Y-m-d");
$time = date("H:i:s A");
$action = "Change passsword of user: " . $_POST['id'];
$query = "insert into audit_trail values('','".
$_SESSION['userid']."','$action','$date','$time')";
mysqli_query($con,$query);

echo "<script>
alert('Password has been updated successfully!');
window.location.href = '../s_admin/a_list_view_emp.php'; // Replace with
your desired page
</script>";

if (isset($_POST['update_attendance'])) {
// Retrieve values from the form
$id = $_POST['id'];
$t_date = $_POST['t_date'];
$am_time_in = $_POST['am_time_in'];
$am_time_out = $_POST['am_time_out'];
$pm_time_in = $_POST['pm_time_in'];
$pm_time_out = $_POST['pm_time_out'];
 // Calculate AM working hours
$am_in = strtotime($am_time_in);
$am_out = strtotime($am_time_out);
$am_hours = ($am_out - $am_in) / 3600; // Convert seconds to hours

// Calculate PM working hours

$pm_in = strtotime($pm_time_in);
$pm_out = strtotime($pm_time_out);
$pm_hours = ($pm_out - $pm_in) / 3600; // Convert seconds to hours

// Calculate total hours worked (AM + PM) and round to 2 decimals

$total_hours = round($am_hours + $pm_hours, 2); // Round to 2 decimal places

// Format total_hours to always display 2 decimal places

$total_hours_formatted = number_format($total_hours, 2);

// Prepare the update query

$query = "UPDATE tbl_attendance
SET t_date = '$t_date',
am_time_in = '$am_time_in',
am_time_out = '$am_time_out',
pm_time_in = '$pm_time_in',
pm_time_out = '$pm_time_out',
total_hours = '$total_hours_formatted'
WHERE id = '$id'";

// Execute the query

if (mysqli_query($con, $query)) {
// Success message

echo "<script>
alert('Attendance record updated successfully!');
window.location.href = '../HR/timesheet.php'; // Replace with your
desired page
</script>";
} else {
// Error message
echo "<script>
alert('Error updating record: " . mysqli_error($con) . "');
</script>";
}
}

if(isset($_POST['apply_leave_emp'])){
$query = "SELECT * FROM tbl_employee_info WHERE user_id = '" .
$_SESSION['userid'] . "'";
$res = mysqli_query($con, $query);
$row = mysqli_fetch_assoc($res);
$fullname = $row['first_name'] . ' ' . $row['last_name'];

$query = "SELECT * FROM tbl_employment_info WHERE user_id = '" .

$_SESSION['userid'] . "'";
$res = mysqli_query($con, $query);
$row = mysqli_fetch_assoc($res);
$position = $row['position'];
$start_date = new DateTime($_POST['start_date']);
 $end_date = new DateTime($_POST['end_date']);
$interval = $start_date->diff($end_date);
$total_days = $interval->days + 1;
$query = "INSERT INTO tbl_leave VALUES ('', '" . $_SESSION['userid'] . "',
'$fullname', '$position', '" . $_POST['leavetype'] . "', NOW(), '" .
$_POST['start_date'] . "', '" . $_POST['end_date'] . "', '$total_days', '',
'Pending Head','', '".$_POST['dept_head']."','','')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/leave.php' </script>";

}
if(isset($_POST['cancel_leave_emp'])){
$query = "update tbl_leave set leave_status = 'Canceled' where id = '".
$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/leave.php' </script>";

}
if(isset($_POST['req_head_approve'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "update tbl_request set req_status = 'Pending', approve_date = '".
$date."', approve_time = '".$time."' where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../head/cert_req.php' </script>";

}
if(isset($_POST['req_head_declined'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "update tbl_request set req_status = 'Declined', approve_date = '".
$date."', approve_time = '".$time."' where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../head/cert_req.php' </script>";

}
if(isset($_POST['req_hr_declined'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "update tbl_request set req_status = 'Declined', approve_date = '".
$date."', approve_time = '".$time."',approve_by='".$_SESSION['userid']."' where id
= '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../hr/cert_req.php' </script>";

}
if(isset($_POST['csr_head'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
 $time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_SESSION['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending Head','".$_POST['head']."')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";

}
if(isset($_POST['cna_head'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_SESSION['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending Head','".$_POST['head']."')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";

}
if(isset($_POST['clb_head'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_SESSION['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending Head','".$_POST['head']."')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";

}
if(isset($_POST['coe_head'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_SESSION['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending Head','".$_POST['head']."')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";

}
if(isset($_POST['coec_head'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_SESSION['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending Head','".$_POST['head']."')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";

}
if (isset($_POST['uploadleave'])) {
// Database connection
// Get form inputs
$id = $_POST['id'];
$uploadDirectory = "upload/"; // Path to the upload folder

// Check if the upload directory exists, if not, create it

 if (!is_dir($uploadDirectory)) {
mkdir($uploadDirectory, 0777, true);
}

// Validate that exactly 2 files are uploaded

if (count($_FILES['leavetoupload']['name']) !== 2) {
echo "<script>alert('Please upload exactly 2 files.');
window.history.back();</script>";
exit;
}

$uploadedFiles = [];
$errorsOccurred = false;

// Process each uploaded file

foreach ($_FILES['leavetoupload']['name'] as $index => $fileName) {
$fileTmpName = $_FILES['leavetoupload']['tmp_name'][$index];
$fileError = $_FILES['leavetoupload']['error'][$index];

// Generate a unique file name to avoid conflicts

$uniqueFileName = time() . "_" . $fileName;

// Ensure no upload errors occurred

if ($fileError === 0) {
// Define the destination path
$fileDestination = $uploadDirectory . $uniqueFileName;

// Move the file to the upload folder

if (move_uploaded_file($fileTmpName, $fileDestination)) {
$uploadedFiles[] = $uniqueFileName; // Collect uploaded file names
} else {
$errorsOccurred = true;
echo "<script>alert('Failed to upload file: $fileName');</script>";
}
} else {
$errorsOccurred = true;
echo "<script>alert('Error occurred during file upload for file:
$fileName. Error Code: $fileError');</script>";
}
}

// If no errors occurred, update the database

if (!$errorsOccurred) {
// Convert uploaded file names into a comma-separated string (optional for
storing multiple files)
$uploadedFilesStr = implode(",", $uploadedFiles);

// Update the database

$query = "UPDATE tbl_leave SET leavefile = '$uploadedFilesStr',
leave_status = 'Pending Employee' WHERE id = '$id'";
if (mysqli_query($con, $query)) {
if ($_SESSION['user_pos'] == "HR") {
echo "<script>alert('Files uploaded successfully!');
window.location.href = '../HR/leave.php';</script>";
} else {
echo "<script>alert('Files uploaded successfully!');
window.location.href = '../head/leavemanage.php';</script>";
}
} else {
 echo "<script>alert('Database update failed!');</script>";
}
}
}

if (isset($_POST['uploadleave2'])) {
// Database connection
// Get form inputs
$id = $_POST['id'];
$uploadDirectory = "upload/"; // Path to the upload folder

// Check if the upload directory exists, if not, create it

if (!is_dir($uploadDirectory)) {
mkdir($uploadDirectory, 0777, true);
}

// Validate that exactly 2 files are uploaded

if (count($_FILES['leavetoupload']['name']) !== 2) {
echo "<script>alert('Please upload exactly 2 files.');
window.history.back();</script>";
exit;
}

$uploadedFiles = [];
$errorsOccurred = false;

// Process each uploaded file

foreach ($_FILES['leavetoupload']['name'] as $index => $fileName) {
$fileTmpName = $_FILES['leavetoupload']['tmp_name'][$index];
$fileError = $_FILES['leavetoupload']['error'][$index];

// Generate a unique file name to avoid conflicts

$uniqueFileName = time() . "_" . $fileName;

// Ensure no upload errors occurred

if ($fileError === 0) {
// Define the destination path
$fileDestination = $uploadDirectory . $uniqueFileName;

// Move the file to the upload folder

if (move_uploaded_file($fileTmpName, $fileDestination)) {
$uploadedFiles[] = $uniqueFileName; // Collect uploaded file names
} else {
$errorsOccurred = true;
echo "<script>alert('Failed to upload file: $fileName');</script>";
}
} else {
$errorsOccurred = true;
echo "<script>alert('Error occurred during file upload for file:
$fileName. Error Code: $fileError');</script>";
}
}

// If no errors occurred, update the database

if (!$errorsOccurred) {
// Convert uploaded file names into a comma-separated string (optional for
storing multiple files)
$uploadedFilesStr = implode(",", $uploadedFiles);
 // Update the database
$query = "UPDATE tbl_leave SET leavefile = '$uploadedFilesStr',
leave_status = 'Pending HR' WHERE id = '$id'";
if (mysqli_query($con, $query)) {
if ($_SESSION['user_pos'] == "HR") {
echo "<script>alert('Files uploaded successfully!');
window.location.href = '../HR/leave.php';</script>";
} else {
echo "<script>alert('Files uploaded successfully!');
window.location.href = '../employee/leave.php';</script>";
}
} else {
echo "<script>alert('Database update failed!');</script>";
}
}
}
// Generate a random password of length 8
$password = generateRandomPassword();
if(isset($_POST['edit_role'])){
$query = "update tbl_role set role_desc = '".$_POST['role']."', role_cat = '".
$_POST['role_cat']."', role_type = '".$_POST['role_type']."' where role_id = '".
$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/role.php' </script>";
}
if(isset($_POST['changepass'])){
$query = "update userdata set password = '".$_POST['password']."' where
username = '".$_SESSION['email']."'";
mysqli_query($con,$query);
echo "<script>alert('Password Changed');</script>";
echo "<script language='javascript' type='text/javascript'>
location.href='../index.php' </script>";
}

if(isset($_POST['hr_approve'])){
$yquery = "select * from tbl_employee_info where user_id = '".
$_SESSION['userid']."'";
$yres = mysqli_query($con,$yquery);
$yrow = mysqli_fetch_assoc($yres);
$yfullname = $yrow['first_name'] . ' ' . $yrow['last_name'];

$query = "Update tbl_leave set leave_status = 'HR Approved', approve_by = '".

$fullname."' where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/leave.php' </script>";
}
if(isset($_POST['hr_decline'])){
$query = "Update tbl_leave set leave_status = 'HR declined' where id = '".
$_POST['id']."'";
mysqli_query($con,$query);

echo "<script language='javascript' type='text/javascript'>

location.href='../HR/leave.php' </script>";

}
if(isset($_POST['head_approve'])){

$query = "Update tbl_leave set leave_status = 'Approved' where id = '".

$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../head/leavemanage.php' </script>";
}
if(isset($_POST['head_decline'])){
$query = "Update tbl_leave set leave_status = 'Approved' where id = '".
$_POST['id']."'";
mysqli_query($con,$query);

echo "<script language='javascript' type='text/javascript'>

location.href='../head/leavemanage.php' </script>";

}
if(isset($_POST['otp'])){
$query = "select * from userdata where username = '".$_SESSION['email']."' and
OTP = '".$_POST['OTP']."'";
$res = mysqli_query($con,$query);

if(mysqli_num_rows($res)<>0){
echo "<script language='javascript' type='text/javascript'>
location.href='../changepassword.php' </script>";
}
else{
// Define the characters to choose from
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$randomString = '';

// Generate 5 random characters

for ($i = 0; $i < 5; $i++) {
$randomString .= $characters[rand(0, strlen($characters) - 1)];
}

// Echo the random string

$randomString;

$query = "update userdata set OTP = '$randomString' where username = '".

$_SESSION['email']."'";
mysqli_query($con,$query);
require 'PHPMailer/src/Exception.php';
require 'PHPMailer/src/PHPMailer.php';
require 'PHPMailer/src/SMTP.php';
// create object of PHPMailer class with boolean parameter which sets/unsets
exception.
$mail = new PHPMailer(true);
try {

$mail->isSMTP(); // using SMTP protocol

$mail->Host = 'smtp.gmail.com'; // SMTP host as gmail
$mail->SMTPAuth = true; // enable smtp authentication

$mail->Username = 'sdogo.tayabas@gmail.com'; // sender gmail host

$mail->Password = 'bxpv qvdf tldp bpqy'; // sender gmail host password

$mail->SMTPSecure = 'tls'; // for encrypted connection

 $mail->Port = 587; // port for SMTP

$mail->setFrom('sdogo.tayabas@gmail.com', "SDO-GO Tayabas"); // sender's email

and name
$mail->addAddress($_SESSION['email'], "SDO GO"); // receiver's email and name
$mail->isHTML(true);
$mail->Subject = 'SDO-GO Forget Password';
$mail->Body = '
<html>
<head>
<title>Forget Password</title>
</head>
<body>
<p>Hello ,</p>
<p>We received a request to reset the password for your account associated
with this email address. If you did not request a password reset, please ignore
this message.</p>

<p>To reset your password, here is your OTP:</p>

<h3>'. $randomString .'</h3>
OTP

<div class="footer">
<p>&copy; SDO-GO | Administrator</p>
</div>
</body>
</html>
';

$mail->send();
echo 'Message has been sent';
} catch (Exception $e) { // handle error.
echo 'Message could not be sent. Mailer Error: ', $mail->ErrorInfo;
}
echo "<script>alert('Invalid OTP. Please try again');</script>";
echo "<script language='javascript' type='text/javascript'>
location.href='../OTP.php' </script>";

}
}

if(isset($_POST['forget_password'])){

$query = "select * from userdata where username = '".$_POST['email']."'";

$res = mysqli_query($con,$query);
if(mysqli_num_rows($res)==0){
echo "<script>alert('You input invalid email address.');</script>";
echo "<script language='javascript' type='text/javascript'>
location.href='../forget.php' </script>";

}
else{
// Define the characters to choose from
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$randomString = '';

// Generate 5 random characters

for ($i = 0; $i < 5; $i++) {
$randomString .= $characters[rand(0, strlen($characters) - 1)];
}

// Echo the random string

$randomString;

$query = "update userdata set OTP = '$randomString' where username = '".

$_POST['email']."'";
mysqli_query($con,$query);
require 'PHPMailer/src/Exception.php';
require 'PHPMailer/src/PHPMailer.php';
require 'PHPMailer/src/SMTP.php';
// create object of PHPMailer class with boolean parameter which sets/unsets
exception.
$mail = new PHPMailer(true);
try {

$mail->isSMTP(); // using SMTP protocol

$mail->Host = 'smtp.gmail.com'; // SMTP host as gmail
$mail->SMTPAuth = true; // enable smtp authentication

$mail->Username = 'sdogo.tayabas@gmail.com'; // sender gmail host

$mail->Password = 'bxpv qvdf tldp bpqy'; // sender gmail host password

$mail->SMTPSecure = 'tls'; // for encrypted connection

$mail->Port = 587; // port for SMTP

$mail->setFrom('sdogo.tayabas@gmail.com', "SDO-GO Tayabas"); // sender's email

and name
$mail->addAddress($_POST['email'], "SDO GO"); // receiver's email and name
$mail->isHTML(true);
$mail->Subject = 'SDO-GO Forget Password';
$mail->Body = '
<html>
<head>
<title>Forget Password</title>
</head>
<body>
<p>Hello ,</p>
<p>We received a request to reset the password for your account associated
with this email address. If you did not request a password reset, please ignore
this message.</p>

<p>To reset your password, here is your OTP:</p>

<h3>'. $randomString .'</h3>
OTP

<div class="footer">
<p>&copy; SDO-GO | Administrator</p>
</div>
</body>
</html>
';
 $mail->send();
echo 'Message has been sent';
} catch (Exception $e) { // handle error.
echo 'Message could not be sent. Mailer Error: ', $mail->ErrorInfo;
}
$_SESSION['email'] = $_POST['email'];
echo "<script language='javascript' type='text/javascript'>
location.href='../OTP.php' </script>";

}
}
if(isset($_POST["add_emp"])){
date_default_timezone_set('Asia/Manila');
$current_date_time = date('Y-m-d');
$x = date('Y');
$date = "SDOGO-". $x . "-";
$query = "SELECT MAX(RIGHT(user_id,4)) as maxid FROM tbl_employee_info where
Left(user_id,11)='$date' order by user_id";
$result = mysqli_query($con,$query);
$number_of_rows = mysqli_num_rows($result);
if($number_of_rows > 0){
$row = mysqli_fetch_assoc($result);
$newID = (intval($row['maxid']) + 1);
$empid1 = $newID;
}
else{
$empid1 = 1;
}
if($empid1<10){
$empid1 = '000' . $empid1;
$empid2 = $date . $empid1;

}
elseif($empid1<100){
$empid1 = '00' . $empid1;
$empid2 = $date . $empid1;

}
elseif($empid1<1000){
$empid1 = '0' . $empid1;
$empid2 = $date . $empid1;
}
$query = "insert into tbl_employee_info values('$empid2','".
$_POST['last_name']."','".$_POST['first_name']."','".$_POST['middle_name']."','".
$_POST['ex_name']."','".$_POST['gender']."','".$_POST['birthdate']."','".
$_POST['place_of_birth']."','".$_POST['contact_num']."','".
$_POST['gov_email']."','".$_POST['employee_no']."' ,'".$_POST['philhealth']."','".
$_POST['pagibig']."','".$_POST['TIN']."','','".$_POST['street_brgy']."','".
$_POST['municipality']."','".$_POST['province']."','".$_POST['region']."','".
$_POST['disability']."','','','$current_date_time')";

mysqli_query($con,$query);
$query = "insert into tbl_employment_info
values('$empid2','','','','','','','','','','','','','','','','','','','')";
mysqli_query($con,$query);
$query = "insert into tbl_eligibility values('$empid2','','','')";
 mysqli_query($con,$query);

$query = "insert into tbl_educational_bg

values('$empid2','','','','','','','','','','','','','','','','')";
mysqli_query($con,$query);

$query = "insert into userdata values('$empid2','".

$_POST['gov_email']."','$password','', 'Disabled','No','')";
mysqli_query($con,$query);
//sending email
// Base files
// Base files
require 'PHPMailer/src/Exception.php';
require 'PHPMailer/src/PHPMailer.php';
require 'PHPMailer/src/SMTP.php';
// create object of PHPMailer class with boolean parameter which sets/unsets
exception.
$mail = new PHPMailer(true);
try {

$mail->isSMTP(); // using SMTP protocol

$mail->Host = 'smtp.gmail.com'; // SMTP host as gmail
$mail->SMTPAuth = true; // enable smtp authentication

$mail->Username = 'sdogo.tayabas@gmail.com'; // sender gmail host

$mail->Password = 'bxpv qvdf tldp bpqy'; // sender gmail host password

$mail->SMTPSecure = 'tls'; // for encrypted connection

$mail->Port = 587; // port for SMTP

$mail->setFrom('sdogo.tayabas@gmail.com', "SDO-GO Tayabas"); // sender's email

and name
$mail->addAddress($_POST['gov_email'], "SDO GO"); // receiver's email and name
$mail->isHTML(true);
$mail->Subject = 'SDO-GO Account Creation';
$mail->Body = '
<html>
<head>
<title>Account Creation</title>
</head>
<body>
<p>Dear Ms/Mr '.$_POST['last_name'].',</p>
<p>Good day&#61441;</p>
<p>Please be informed that your account has been pre-created by the SDO-GO
ICT.</p>
<p>Wait for the HR Department to fully enable your account</p>

<p>Thank you very much.</p>

<p>Sincerely,</p>
<p>Mark Bryan F. Valencia<br>SDO Administrator</p>
</body>
</html>
';

$mail->send();
} catch (Exception $e) { // handle error.
echo 'Message could not be sent. Mailer Error: ', $mail->ErrorInfo;
}
//end email
$fullname = $_POST['first_name'] . ' ' . $_POST['last_name'];
$action = "Added New Employee | Name: $fullname";
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/a_list_view_emp.php' </script>";

if(isset($_POST['edit_employee'])){

$query = "select * from tbl_service_rec where user_id = '".$_GET['id']."'";

echo $query;
$res = mysqli_query($con,$query);
//if(mysqli_num_rows($res)==0){
// $query = "insert into tbl_service_rec values('','".$_GET['id']."','".
$_POST['date_orig_appoint']."','Up to date','".
$_POST['designated_from']."','Permanent','".$_POST['salary_step']."','".
$_POST['salary_grade']."','','Tayabas','','".$_POST['position']."')";
// mysqli_query($con,$query);
// echo $query;
// }
$query = "update tbl_employee_info set last_name = '".$_POST['last_name']."',
first_name='".$_POST['first_name']."', middle_name='".$_POST['middle_name']."',
ex_name='".$_POST['ex_name']."', gender='".$_POST['gender']."', birthdate='".
$_POST['birthdate']."', place_of_birth='".$_POST['place_of_birth']."',
contact_num='".$_POST['contact_num']."', gov_email='".$_POST['gov_email']."',
employee_no='".$_POST['employee_no']."', philhealth='".$_POST['philhealth']."',
pagibig='".$_POST['pagibig']."', TIN='".$_POST['TIN']."',street = '".
$_POST['street']."', street_brgy='".$_POST['street_brgy']."', municipality='".
$_POST['municipality']."',province='".$_POST['province']."',region='".
$_POST['region']."', disability = '".$_POST['disability']."', bp_no = '".
$_POST['bp_no']."' where user_id = '".$_GET['id']."'";
mysqli_query($con,$query);

if($_SESSION['user_pos']=='HR'){
$query = "select * from tbl_employment_info where user_id = '".
$_GET['id']."'";
$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
if($row['position']==""){
$query = "insert into tbl_service_rec values('','".$_GET['id']."','".
$_POST['date_orig_appoint']."','Up to date','".
$_POST['designated_to']."','Permanent','".$_POST['salary_step']."','".
$_POST['salary_grade']."','','Tayabas','','".$_POST['position']."')";
mysqli_query($con,$query);

}
$query = "update tbl_employment_info set position = '".
$_POST['position']."',sub_position = '".$_POST['subpos']."', date_orig_appoint='".
$_POST['date_orig_appoint']."', salary_grade='".$_POST['salary_grade']."',
salary_step='".$_POST['salary_step']."', vice='".$_POST['vice']."',vice_reason='".
$_POST['vice_reason']."', nature_appoint='".$_POST['nature_appoint']."',
status_appoint='".$_POST['status_appoint']."', plantilla_item_no='".
$_POST['plantilla_item_no']."', plantilla_inclu='".$_POST['plantilla_inclu']."',
school_office_assign='".$_POST['school_office_assign']."',
school_detailed_office_assign='".$_POST['school_detailed_office_assign']."',
designated_from='".$_POST['designated_from']."', designated_to='".
$_POST['designated_to']."', separation='".$_POST['separation']."',
separation_date='".$_POST['separation_date']."' where user_id='".$_GET['id']."'";
mysqli_query($con,$query);
$query = "update tbl_eligibility set type_eligibility='".
$_POST['type_eligibility']."', date_issue='".$_POST['date_issue']."', validity='".
$_POST['validity']."' where user_id = '".$_GET['id']."'";
mysqli_query($con,$query);

$elem = $_POST['elem_from'] . ' - ' . $_POST['elem_to'];

$second = $_POST['secondary_from'] . ' - ' . $_POST['secondary_to'];
$college = $_POST['college_from'] . ' - ' . $_POST['college_to'];
$master = $_POST['masters_from'] . ' - ' . $_POST['masters_to'];
$doctoral = $_POST['doc_from'] . ' - ' . $_POST['doc_to'];
$vocational = $_POST['voca_from'] . ' - ' . $_POST['voca_to'];
$query = "update tbl_educational_bg set elementary='".
$_POST['elementary']."', secondary='".$_POST['secondary']."', college='".
$_POST['college']."', masters_degree='".$_POST['masters_degree']."', doc_degree='".
$_POST['doc_degree']."', elem_duration = '$elem', second_duration = '$second',
college_duration = '$college', master_duration = '$master', doc_duration =
'$doctoral', vocational = '".$_POST['vocational']."', voca_duration =
'$vocational', voc_school = '".$_POST['voc_school']."', college_school = '".
$_POST['college_school']."',master_units = '".$_POST['master_units']."',doc_units =
'".$_POST['doc_units']."' where user_id='".$_GET['id']."'";
mysqli_query($con,query: $query);
$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))-
>format("Y-m-d h:i:s A");
$query = "update userdata set user_pos = '".$_POST['position']."' where
userid = '".$_GET['id']."'";
mysqli_query($con,$query);
$id = $_GET['id'];

$query = "update userdata set username = '".$_POST['gov_email']."' where

userid = '".$_GET['id']."'";
mysqli_query($con,$query);

if (isset($_POST['login_stat'])) {
$status = 'Enabled';
}
else{
$status = 'Disabled';
}
$query = "update userdata set user_stat = 'Enabled' where userid = '".
$_GET['id']."'";
mysqli_query($con,$query);
}

$query = "select * from tbl_employee_info where user_id = '".$_GET['id']."'";

$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
$fullname = $row['first_name'] . ' ' . $row['last_name'];
$action = "Updated Employee Information | Name: $fullname";
$id=$_GET['id'];
if($_SESSION['user_pos']=='HR'){

echo "<script language='javascript' type='text/javascript'>

location.href='../HR/d_emp_profile_edit.php?id=$id' </script>";
 }
elseif($_SESSION['user_pos']=='Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/d_emp_profile_edit.php?id=$id' </script>";
}

}
if(isset($_POST["delete_emp"])){
$query = "select * from tbl_employee_info where user_id = '".$_POST['id']."'";

$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);

$fullname = $row['first_name'] . ' ' . $row['last_name'];

$query ="delete from tbl_employee_info where user_id = '".$_POST['id']."'";
mysqli_query($con,$query);

$query = "delete from tbl_employment_info where user_id = '".$_POST['id']."'";

mysqli_query($con,$query);

$query = "delete from tbl_educational_bg where user_id = '".$_POST['id']."'";

mysqli_query($con,$query);

$query = "delete from tbl_eligibility where user_id = '".$_POST['id']."'";

mysqli_query($con,$query);

$query = "delete from userdata where userid = '".$_POST['id']."'";

mysqli_query($con,$query);

$id=$_POST['id'];

$action = "Removed Employee | Name: $fullname";

echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/a_list_view_emp.php?id=$id' </script>";
}
if(isset($_POST["add_role"])){
$role_head = "";
if(isset($_POST["role_head"])){
$role_head = $_POST['role_head'];
}
$query = "insert into tbl_role values('','".$_POST['role']."','".
$_POST['role_cat']."','".$_POST['role_type']."','$role_head')";
mysqli_query($con,$query);

echo "<script language='javascript' type='text/javascript'>

location.href='../HR/role.php' </script>";
}
if(isset($_POST["delete_role"])){
$query = "delete from tbl_role where role_id = '".$_POST['id']."'";
mysqli_query($con,$query);
$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-
m-d h:i:s A");
$query = "insert into audit_trail values('','".$_SESSION['userid']."','Remove
Role','$dateTime')";
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/role.php' </script>";
}
if(isset($_POST["add_salary"])){
$query = "insert into tbl_salary values('','".$_POST['salary_grade']."','".
$_POST['step_1']."','".$_POST['step_2']."','".$_POST['step_3']."','".
$_POST['step_4']."','".$_POST['step_5']."','".$_POST['step_6']."','".
$_POST['step_7']."','".$_POST['step_8']."')";
mysqli_query($con,$query);

$salary = "Information: '".$_POST['salary_grade']."','".$_POST['step_1']."','".

$_POST['step_2']."','".$_POST['step_3']."','".$_POST['step_4']."','".
$_POST['step_5']."','".$_POST['step_6']."','".$_POST['step_7']."','".
$_POST['step_8']."'";

$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-

m-d h:i:s A");
$query = "insert into audit_trail values('','Add new salary: $salary ','".
$_SESSION['userid']."','$dateTime')";
if($_SESSION['user_pos']=="HR"){
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/salary.php' </script>";

}
else{
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/salary.php' </script>";
}
}
if(isset($_POST["edit_salary"])){
$query = "update tbl_salary set step_1 = '".$_POST['step_1']."' ,step_2 = '".
$_POST['step_2']."' ,step_4 = '".$_POST['step_4']."',step_5 = '".
$_POST['step_5']."',step_6 = '".$_POST['step_6']."',step_7 = '".
$_POST['step_7']."',step_8 = '".$_POST['step_8']."' where id = '".$_POST['id']."'";
mysqli_query($con,$query);
$id = $_POST['id'];

$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-

m-d h:i:s A");
$query = "insert into audit_trail values('','".$_SESSION['userid']."','Update
Salary: $id','$dateTime')";
mysqli_query($con,$query);
if($_SESSION['user_pos']=="HR"){
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/salary.php' </script>";

}
else{
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/salary.php' </script>";
}}
if(isset($_POST["delete_salary"])){
$query = "delete from tbl_salary where id = '".$_POST['id']."'";
mysqli_query($con,$query);
$id = $_POST['id'];
$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-
m-d h:i:s A");
$query = "insert into audit_trail values('','".$_SESSION['userid']."','Remove
Salary: $id','$dateTime')";
 mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/c_salary.php' </script>";
}
if(isset($_POST["add_train"])){

if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["add_train"])) {

// Validate other form inputs (title, dates, etc.)

$title = $_POST["title"];
$date_from = $_POST["date_from"];
$date_to = $_POST["date_to"];
$conduct_by = $_POST["conduct_by"];

// Handle file upload

$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["filetoupload"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Check if file already exists

if (file_exists($target_file)) {
echo "Sorry, file already exists.";
$uploadOk = 0;
}

// Check file size (optional)

if ($_FILES["filetoupload"]["size"] > 5000000) { // Adjust size limit as
needed
echo "Sorry, your file is too large.";
$uploadOk = 0;
}

// Allow certain file formats (optional)

if ($imageFileType != "pdf" && $imageFileType != "jpg" && $imageFileType !=
"png" && $imageFileType != "jpeg") {
echo "Sorry, only PDF, JPG, JPEG, PNG files are allowed.";
$uploadOk = 0;
}

// Check if $uploadOk is set to 0 by an error

if ($uploadOk == 0) {
echo "Sorry, your file was not uploaded.";
} else {
// If everything is ok, try to upload file
if (move_uploaded_file($_FILES["filetoupload"]["tmp_name"],
$target_file)) {
echo "The file ". htmlspecialchars(basename($_FILES["filetoupload"]
["name"])). " has been uploaded.";
// Now you can save other form data (title, dates, etc.) to a
database or perform other actions
} else {
echo "Sorry, there was an error uploading your file.";
}
}
}
$query = "insert into tbl_attachments values('','".$_POST['id']."','".
$_POST['title']."','".$_POST['conduct_by']."','".$_POST['date_from']."', '".
$_POST['date_to']."','$target_file')";
 mysqli_query($con,$query);
$id = $_POST['id'];
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/programs.php?id=$id' </script>";
}
if(isset($_POST["delete_atta"])){
$query = "delete from tbl_attachments where id = '".$_POST['id']."'";
mysqli_query($con,$query);
$id = $_POST["user_id"];
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/programs.php?id=$id' </script>";
}
if(isset($_POST["delete_atta_emp"])){
$query = "delete from tbl_attachments where id = '".$_POST['id']."'";
mysqli_query($con,$query);
$id = $_POST["user_id"];
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/programs.php?id=$id' </script>";
}
if(isset($_POST["edit_attach"])){

if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["edit_attach"])) {

// Validate other form inputs (title, dates, etc.)

$title = $_POST["title"];
$date_from = $_POST["date_from"];
$date_to = $_POST["date_to"];
$conduct_by = $_POST["conduct_by"];

// Handle file upload

$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["filetoupload"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Check if file already exists

if (file_exists($target_file)) {
echo "Sorry, file already exists.";
$uploadOk = 0;
}

// Check file size (optional)

if ($_FILES["filetoupload"]["size"] > 5000000) { // Adjust size limit as
needed
echo "Sorry, your file is too large.";
$uploadOk = 0;
}

// Allow certain file formats (optional)

if ($imageFileType != "pdf" && $imageFileType != "jpg" && $imageFileType !=
"png" && $imageFileType != "jpeg") {
echo "Sorry, only PDF, JPG, JPEG, PNG files are allowed.";
$uploadOk = 0;
}

// Check if $uploadOk is set to 0 by an error

if ($uploadOk == 0) {
echo "Sorry, your file was not uploaded.";
} else {
 // If everything is ok, try to upload file
if (move_uploaded_file($_FILES["filetoupload"]["tmp_name"],
$target_file)) {
echo "The file ". htmlspecialchars(basename($_FILES["filetoupload"]
["name"])). " has been uploaded.";
// Now you can save other form data (title, dates, etc.) to a
database or perform other actions
} else {
echo "Sorry, there was an error uploading your file.";
}
}
}

$query = "update tbl_attachments set title = '".$_POST['title']."', conduct_by

= '".$_POST['conduct_by']."', date_from = '".$_POST['date_from']."', date_to = '".
$_POST['date_to']."', file_path = '$target_file' where id = '".$_POST['id']."'";
mysqli_query($con,$query);
$id = $_POST['user_id'];
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/programs.php?id=$id' </script>";
}
if(isset($_POST['log_dis'])){
$query = "update userdata set user_sat='Disabled' where userid = '".
$_POST['id']."'";
$id = $_POST['id'];
$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-
m-d h:i:s A");
$query = "insert into audit_trail values('','".$_SESSION['userid']."','Disable
Login: $id','$dateTime')";
mysqli_query($con,$query);
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../a_magae_users.php?id=$id' </script>";

}
if (isset($_POST['promote'])) {
$query = "update userdata set user_pos = '".$_POST['position']."' where userid
= '".$_GET['id']."'";
mysqli_query($con,$query);
$query = "update tbl_employment_info set position = '".$_POST['position']."'
where user_id = '".$_GET['id']."'";
mysqli_query($con,$query);

$query = "select * from tbl_salary where salary_grade = '".$_POST['sg']."'";

$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
$step = $_POST['step'];
$salary = $row['step_1'];

$query = "select * from tbl_service_rec where user_id ='".$_GET['id']."' order

by id DESC limit 1";
$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);

$id = $row['id'];

$query = "update tbl_service_rec set inclu_to = '".$_POST['inclu_from']."'

where id = '".$id."'";
mysqli_query($con,$query);
 $query = "insert into tbl_service_rec values('','".$_GET['id']."','".
$_POST['inclu_from']."','Up to date','".$_POST['position']."','".
$_POST['service_status']."','".$_POST['step']."','SG ".$_POST['sg']."','".
$_POST['branch']."','".$_POST['separation']."','".$_POST['position']."','".
$_POST['position']."')";

mysqli_query( $con,$query);
$id = $_GET['id'];
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/emp_service_rec.php?id=$id' </script>";

}
if(isset($_POST['post_admin'])){
$query = "select * from userdata where userid = '".$_SESSION['userid']."'";
$res = mysqli_query($con, $query);
$row = mysqli_fetch_array($res);
date_default_timezone_set('Asia/Manila');
$date = date('m-d-Y h:i:s A');
$query = "insert into tbl_board values('','".$_SESSION['userid']."','".
$row['user_pos']."','".$_POST['title']."','".$_POST['description']."','$date')";

mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/i_notice_board.php' </script>";

}
if(isset($_POST['post_hr'])){
$query = "select * from userdata where userid = '".$_SESSION['userid']."'";
$res = mysqli_query($con, $query);
$row = mysqli_fetch_array($res);
date_default_timezone_set('Asia/Manila');
$date = date('m-d-Y h:i:s A');
$query = "insert into tbl_board values('','".$_SESSION['userid']."','".
$row['user_pos']."','".$_POST['title']."','".$_POST['description']."','$date')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/i_notice_board.php' </script>";

}
if (isset($_POST["apply_leave"])) {
// Fetch user details
$query = "SELECT * FROM tbl_employee_info WHERE user_id = '" .
$_SESSION['userid'] . "'";
$res = mysqli_query($con, $query);
$row = mysqli_fetch_assoc($res);
$fullname = $row['first_name'] . ' ' . $row['last_name'];

$query = "SELECT * FROM tbl_employment_info WHERE user_id = '" .

$_SESSION['userid'] . "'";
$res = mysqli_query($con, $query);
$row = mysqli_fetch_assoc($res);
$position = $row['position'];

// Calculate total leave days

$start_date = new DateTime($_POST['start_date']);
 $end_date = new DateTime($_POST['end_date']);
$interval = $start_date->diff($end_date);
$total_days = $interval->days + 1;

if($_SESSION['role_cat']=='Teaching'){
$query = "INSERT INTO tbl_leave VALUES ('', '" . $_SESSION['userid'] . "',
'$fullname', '$position', '" . $_POST['leavetype'] . "', NOW(), '" .
$_POST['start_date'] . "', '" . $_POST['end_date'] . "', '$total_days', '',
'Pending HR','', 'HR','','')";

}
elseif($_POST['role_cat']=='Non-Teaching'){

if($_SESSION['user_pos']=="HR"){
$query = "INSERT INTO tbl_leave VALUES ('', '" . $_SESSION['userid'] .
"', '$fullname', '$position', '" . $_POST['leavetype'] . "', NOW(), '" .
$_POST['start_date'] . "', '" . $_POST['end_date'] . "', '$total_days', '',
'Pending SDS','', '".$_POST['dept_head']."','','')";

}
else{
$query = "INSERT INTO tbl_leave VALUES ('', '" . $_SESSION['userid'] .
"', '$fullname', '$position', '" . $_POST['leavetype'] . "', NOW(), '" .
$_POST['start_date'] . "', '" . $_POST['end_date'] . "', '$total_days', '',
'Pending Head','', '".$_POST['dept_head']."','','')";

}
mysqli_query($con, $query);
$action = '';
if($_SESSION['user_pos']=='HR'){
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/myleave.php' </script>";

}
elseif($_SESSION['user_pos']=='Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/leave.php' </script>";

}
else{
$query = "select * from tbl_role where role_desc ='".
$_SESSION['user_pos']."'";
$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
if($row['role_type']=='Department Head'){
echo "<script language='javascript' type='text/javascript'>
location.href='../head/myleave.php' </script>";

}
else{
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/leave.php' </script>";

}
 }
}

// Check for form submission (approve, decline, or archive)

if (isset($_POST['approve'])) {
$id = $_POST['id'];
$query = "UPDATE tbl_leave SET leave_status = 'Approved' WHERE id = $id";
$result = mysqli_query($con, $query);
if ($result) {
echo json_encode(['status' => 'success', 'message' => 'Leave Approved']);
} else {
echo json_encode(['status' => 'error', 'message' => 'Failed to update
status']);
}
} elseif (isset($_POST['decline'])) {
$id = $_POST['id'];
$query = "UPDATE tbl_leave SET leave_status = 'Declined' WHERE id = $id";
$result = mysqli_query($con, $query);
if ($result) {
echo json_encode(['status' => 'success', 'message' => 'Leave Declined']);
} else {
echo json_encode(['status' => 'error', 'message' => 'Failed to update
status']);
}
} elseif (isset($_POST['archive'])) {
$id = $_POST['id'];
$query = "UPDATE tbl_leave SET leave_status = 'Archived' WHERE id = $id";
$result = mysqli_query($con, $query);
if ($result) {
echo json_encode(['status' => 'success', 'message' => 'Leave Archived']);
} else {
echo json_encode(['status' => 'error', 'message' => 'Failed to update
status']);
}
}
if(isset($_POST["approve"])){
$query = "update tbl_leave set leave_status = 'Accepted' where id = '".
$_POST['id']."'";
mysqli_query($con,$query);

$empid = $_POST['id'];
$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-
m-d h:i:s A");
$query = "insert into audit_trail values('','".$_SESSION['userid']."','Approve
Leave| Employee ID: $empid','$dateTime')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/leave.php' </script>";

}
if(isset($_POST["decline"])){
$query = "update tbl_leave set leave_status = 'Declined' where id = '".
$_POST['id']."'";
mysqli_query($con,$query);

$empid = $_POST['id'];
 $dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-
m-d h:i:s A");
$query = "insert into audit_trail values('','".$_SESSION['userid']."','Approve
Leave| Employee ID: $empid','$dateTime')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/leave.php' </script>";

}
if(isset($_POST["boradel_hr"])){
$query = "delete from tbl_board where id = '".$_POST['id']."'";
mysqli_query( $con,$query);

$empid = $_POST['id'];
$dateTime = (new DateTime("now", new DateTimeZone("Asia/Manila")))->format("Y-
m-d h:i:s A");
$query = "insert into audit_trail values('','".$_SESSION['userid']."','Deleted
post','$dateTime')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/i_notice_board.php' </script>";

}
if(isset($_POST["boradel_admin"])){
$query = "delete from tbl_board where id = '".$_POST['id']."'";
mysqli_query( $con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/i_notice_board.php' </script>";

}
if(isset($_POST['csr'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending','')";
mysqli_query($con,$query);
$type = $_POST['type'];

$dateTime = (new DateTime("now", timezone: new DateTimeZone("Asia/Manila")))-

>format("Y-m-d h:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','Request Certificate| Certficate Type: $type','$dateTime')";
//mysqli_query($con,$query);
if($_SESSION['user_pos']=='Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/emp_service_rec.php' </script>";
}
elseif($_SESSION['user_pos']<>'Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";
}

}
if(isset($_POST['head_csr'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending','')";
mysqli_query($con,$query);
$type = $_POST['type'];

$dateTime = (new DateTime("now", timezone: new DateTimeZone("Asia/Manila")))-

>format("Y-m-d h:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','Request Certificate| Certficate Type: $type','$dateTime')";
//mysqli_query($con,$query);

echo "<script language='javascript' type='text/javascript'>

location.href='../head/emp_service_rec.php' </script>";

}
if(isset($_POST['coe'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending','')";
mysqli_query($con,$query);

if($_SESSION['user_pos']=='Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/emp_service_rec.php' </script>";
}
elseif($_SESSION['user_pos']<>'Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";
}

}
if(isset($_POST['head_coe'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending','')";
mysqli_query($con,$query);

echo "<script language='javascript' type='text/javascript'>

location.href='../head/emp_service_rec.php' </script>";
}

if(isset($_POST['coec'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending','')";
mysqli_query($con,$query);

$dateTime = (new DateTime("now", timezone: new DateTimeZone("Asia/Manila")))-

>format("Y-m-d h:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','Request Certificate| Certficate Type: $type','$dateTime')";
//mysqli_query($con,$query);
 if($_SESSION['user_pos']=='Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/emp_service_rec.php' </script>";
}
elseif($_SESSION['user_pos']<>'Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";
}
}
if(isset($_POST['head_coec'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending','')";
mysqli_query($con,$query);

$dateTime = (new DateTime("now", timezone: new DateTimeZone("Asia/Manila")))-

>format("Y-m-d h:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','Request Certificate| Certficate Type: $type','$dateTime')";

echo "<script language='javascript' type='text/javascript'>

location.href='../head/emp_service_rec.php' </script>";

if(isset($_POST['head_cna'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');

$query = "insert into tbl_request values('','".$_POST['userid']."','".

$_POST['type']."','".$date."','$time','','','Pending')";

mysqli_query($con,$query);

$dateTime = (new DateTime("now", timezone: new DateTimeZone("Asia/Manila")))-

>format("Y-m-d h:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','Request Certificate| Certficate Type: $type','$dateTime')";
//mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../head/emp_service_rec.php' </script>";
}

if(isset($_POST['cna'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');

$query = "insert into tbl_request values('','".$_POST['userid']."','".

$_POST['type']."','".$date."','$time','','','Pending','')";

mysqli_query($con,$query);

$dateTime = (new DateTime("now", timezone: new DateTimeZone("Asia/Manila")))-

>format("Y-m-d h:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','Request Certificate| Certficate Type: $type','$dateTime')";
//mysqli_query($con,$query);
if($_SESSION['user_pos']=='Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/emp_service_rec.php' </script>";
}
elseif($_SESSION['user_pos']<>'Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";
}
}
if(isset($_POST['clb'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending','')";
mysqli_query($con,$query);

if($_SESSION['user_pos']=='Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/emp_service_rec.php' </script>";
}
elseif($_SESSION['user_pos']<>'Super Administrator'){
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/emp_service_rec.php' </script>";
}
}
if(isset($_POST['head_clb'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d');
$time = date('h:i:s A');
$query = "insert into tbl_request values('','".$_POST['userid']."','".
$_POST['type']."','".$date."','$time','','','Pending')";
mysqli_query($con,$query);

$dateTime = (new DateTime("now", timezone: new DateTimeZone("Asia/Manila")))-

>format("Y-m-d h:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','Request Certificate| Certficate Type: $type','$dateTime')";
//mysqli_query($con,$query);

echo "<script language='javascript' type='text/javascript'>

location.href='../head/emp_service_rec.php' </script>";
}
if (isset($_POST['req_approve'])) {
date_default_timezone_set('Asia/Manila');
// Ensure $date is correctly formatted
$date = date('Y-m-d');
$time = date('h:i:s A');

// Update the request status and approval information

$query = "UPDATE tbl_request SET req_status = 'Accepted', approve_date =
'$date', approve_time = '$time', approve_by = '".$_POST['approve_by']."' WHERE id =
'".$_POST['id']."'";
$id = $_POST['id'];
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/cert_req.php'; </script>";
}

if(isset($_POST['req_decline'])){
date_default_timezone_set('Asia/Manila');
$date = date('Y-m-d h:i:s A');
$query = "update tbl_request set req_status = 'Declined' , approve_date =
'$date', approve_time = '$time' where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/cert_req.php' </script>";

}
if(isset($_POST["add_train_emp"])){

if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["add_train"])) {

// Validate other form inputs (title, dates, etc.)

$title = $_POST["title"];
$date_from = $_POST["date_from"];
$date_to = $_POST["date_to"];
$conduct_by = $_POST["conduct_by"];

// Handle file upload

$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["filetoupload"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Check if file already exists

if (file_exists($target_file)) {
echo "Sorry, file already exists.";
$uploadOk = 0;
}

// Check file size (optional)

if ($_FILES["filetoupload"]["size"] > 5000000) { // Adjust size limit as
needed
echo "Sorry, your file is too large.";
$uploadOk = 0;
}

// Allow certain file formats (optional)

if ($imageFileType != "pdf" && $imageFileType != "jpg" && $imageFileType !=
"png" && $imageFileType != "jpeg") {
echo "Sorry, only PDF, JPG, JPEG, PNG files are allowed.";
$uploadOk = 0;
}

// Check if $uploadOk is set to 0 by an error

if ($uploadOk == 0) {
echo "Sorry, your file was not uploaded.";
} else {
// If everything is ok, try to upload file
if (move_uploaded_file($_FILES["filetoupload"]["tmp_name"],
$target_file)) {
echo "The file ". htmlspecialchars(basename($_FILES["filetoupload"]
["name"])). " has been uploaded.";
// Now you can save other form data (title, dates, etc.) to a
database or perform other actions
} else {
echo "Sorry, there was an error uploading your file.";
}
}
}
$query = "insert into tbl_attachments values('','".$_POST['id']."','".
$_POST['title']."','".$_POST['conduct_by']."','".$_POST['date_from']."', '".
$_POST['date_to']."','$target_file')";
mysqli_query($con,$query);
$id = $_POST['id'];
echo "<script language='javascript' type='text/javascript'>
location.href='../employee/programs.php?id=$id' </script>";
}

if (isset($_POST['message'])) {
date_default_timezone_set('Asia/Manila');
$currentDateTime = date('Y/m/d h:i A');

$query = "select * from tbl_employee_info where user_id = '".

$_SESSION['userid']."'";
$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
// Use prepared statements
$stmt = $con->prepare("INSERT INTO tbl_messages (userid, receiver, messages,
subject_mes, date_time, mes_status) VALUES (?, ?, ?, ?, ?, 'Unread')");

// Check if statement preparation was successful

if ($stmt === false) {
die('Prepare failed: ' . htmlspecialchars($con->error));
}

// Bind parameters
$stmt->bind_param("sssss", $row['gov_email'], $_POST['receiver'],
$_POST['messages'], $_POST['subject'], $currentDateTime);

// Execute the statement

if ($stmt->execute()) {
// Redirect on success
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/j_messages.php' </script>";
} else {
// Handle execution error
echo "Error executing statement: " . htmlspecialchars($stmt->error);
}

// Close the statement

$stmt->close();
}
if (isset($_POST['message_HR'])) {
date_default_timezone_set('Asia/Manila');
$currentDateTime = date('Y/m/d h:i A');

$query = "select * from tbl_employee_info where user_id = '".

$_SESSION['userid']."'";
$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
 // Use prepared statements
$stmt = $con->prepare("INSERT INTO tbl_messages (userid, receiver, messages,
subject_mes, date_time, mes_status) VALUES (?, ?, ?, ?, ?, 'Unread')");

// Check if statement preparation was successful

if ($stmt === false) {
die('Prepare failed: ' . htmlspecialchars($con->error));
}

// Bind parameters
$stmt->bind_param("sssss", $row['gov_email'], $_POST['receiver'],
$_POST['messages'], $_POST['subject'], $currentDateTime);

// Execute the statement

if ($stmt->execute()) {
// Redirect on success
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/j_messages.php' </script>";
} else {
// Handle execution error
echo "Error executing statement: " . htmlspecialchars($stmt->error);
}

// Close the statement

$stmt->close();
}
if (isset($_POST['message_EMP'])) {
date_default_timezone_set('Asia/Manila');
$currentDateTime = date('Y/m/d h:i A');

$query = "select * from tbl_employee_info where user_id = '".

$_SESSION['userid']."'";
$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
// Use prepared statements
$stmt = $con->prepare("INSERT INTO tbl_messages (userid, receiver, messages,
subject_mes, date_time, mes_status) VALUES (?, ?, ?, ?, ?, 'Unread')");

// Check if statement preparation was successful

if ($stmt === false) {
die('Prepare failed: ' . htmlspecialchars($con->error));
}

// Bind parameters
$stmt->bind_param("sssss", $row['gov_email'], $_POST['receiver'],
$_POST['messages'], $_POST['subject'], $currentDateTime);

// Execute the statement

if ($stmt->execute()) {
// Redirect on success
echo "<script language='javascript' type='text/javascript'>
location.href='../employee /j_messages.php' </script>";
} else {
// Handle execution error
echo "Error executing statement: " . htmlspecialchars($stmt->error);
}

// Close the statement

$stmt->close();
}
if (!isset($_SESSION['userid'])) {
echo '<div class="alert alert-danger">User not logged in.</div>';
exit;
}

if (isset($_POST['change_pass'])) {
// Get the user ID from the session
$userid = $_SESSION['userid'];

// Get old and new passwords from POST request

$old_password = $_POST['old_password'];
$new_password = $_POST['new_password'];

// Step 1: Retrieve the stored password from the database

$stmt = $con->prepare("SELECT password FROM userdata WHERE userid = ?");
$stmt->bind_param("s", $userid);
$stmt->execute();
$stmt->bind_result($db_password);
$stmt->fetch();
$stmt->close();

// If database password is empty, there might be an issue with the data

if (empty($db_password)) {
echo '<div class="alert alert-danger">No password found for this user in
the database.</div>';
exit;
}

// Step 2: Compare the input old password with the password in the database
(plain-text comparison)
if ($old_password === $db_password) {
// Step 3: If passwords match, update the password in the database (new
password)
$update_stmt = $con->prepare("UPDATE userdata SET password = ? WHERE userid
= ?");
$update_stmt->bind_param("ss", $new_password, $userid);
if ($update_stmt->execute()) {
echo '<div class="alert alert-success">Password changed successfully!
</div>';
} else {
echo '<div class="alert alert-danger">Error updating password. Please
try again.</div>';
}
$update_stmt->close();
} else {
// If old password does not match
echo '<div class="alert alert-danger">Old password is incorrect.</div>';
}
}

// Check if a photo is uploaded

if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_FILES['photo'])) {
$userid = $_SESSION['userid']; // Assuming user ID is stored in session

// Handle the uploaded file

$targetDir = "uploads/"; // Set the directory where you want to save the photo
$targetFile = $targetDir . basename($_FILES["photo"]["name"]);
 $imageFileType = strtolower(pathinfo($targetFile, PATHINFO_EXTENSION));

// Check if the file is an image

if (getimagesize($_FILES["photo"]["tmp_name"]) !== false) {
// Move the file to the target directory
if (move_uploaded_file($_FILES["photo"]["tmp_name"], $targetFile)) {
// Update the database with the new photo path
$updateStmt = $con->prepare("UPDATE tbl_employee_info SET photo_path
= ? WHERE user_id = ?");
$updateStmt->bind_param("ss", $targetFile, $userid);

if ($updateStmt->execute()) {
// On success, send a response to show the success message
echo '<br><div class="alert alert-success"
id="successMessage">Photo updated successfully!</div>';
} else {
echo '<div class="alert alert-danger">Error updating photo. Please
try again.</div>';
}

$updateStmt->close();
} else {
echo '<div class="alert alert-danger">Sorry, there was an error
uploading your photo.</div>';
}
} else {
echo '<div class="alert alert-danger">File is not an image.</div>';
}
}
if(isset($_POST['update_prof'])) {
$query = "update tbl_employee_info set last_name = '".$_POST['last_name']."',
first_name='".$_POST['first_name']."', middle_name='".$_POST['middle_name']."',
ex_name='".$_POST['ex_name']."', gender='".$_POST['gender']."', birthdate='".
$_POST['birthdate']."', place_of_birth='".$_POST['place_of_birth']."',
contact_num='".$_POST['contact_num']."', gov_email='".$_POST['gov_email']."',
employee_no='".$_POST['employee_no']."', philhealth='".$_POST['philhealth']."',
pagibig='".$_POST['pagibig']."', TIN='".$_POST['TIN']."', street_brgy='".
$_POST['street_brgy']."', municipality='".$_POST['municipality']."', province='".
$_POST['province']."', region='".$_POST['region']."', disability = '".
$_POST['disability']."' where user_id = '".$_SESSION['userid']."'";
mysqli_query($con,$query);
echo $_SESSION['user_pos'];
if($_SESSION['user_pos'] == 'HR'){
echo "<script>alert('Successfully updated');
location.href='../HR/profile.php';</script>";
}
elseif($_SESSION['user_pos'] == 'Employee'){
echo "<script>alert('Successfully updated');
location.href='../empoyee/profile.php';</script>";
}
elseif($_SESSION['user_pos'] == 'Super Administrator'){

echo "<script>alert('Successfully updated');

location.href='../s_admin/profile.php';</script>";
}

}
if(isset($_POST["leave"])) {
$query = "insert into tbl_leavepoints values('','".$_POST['day']."','".
$_POST['day_leave']."','".$_POST['month']."','".$_POST['month_leave']."','".
$_POST['vacation_leave']."','".$_POST['leave_earn_wop']."')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/leave_points.php' </script>";
}
if(isset($_POST["delete_finger"])) {
$query = "delete from finger_print where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/fingerprint.php' </script>";

}
if(isset($_POST["del_salary"])) {
$query = "delete from tbl_salary where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/salary.php' </script>";
}
if(isset($_POST['edit_leave'])){
$query = "update tbl_leavepoints set leave_day = '".$_POST['leave_day']."',
point_equi = '".$_POST['point_equi']."', month = '".$_POST['month']."', leave_earn
= '".$_POST['leave_earn']."', vacation_leave = '".$_POST['vacation_leave']."',
leave_earn_wop = '".$_POST['leave_earn_wop']."' where id = '".$_POST['id']."'";

mysqli_query($con,$query);

echo "<script language='javascript' type='text/javascript'>

location.href='../s_admin/leave_points.php' </script>";

}
if(isset($_POST["delete_leavepts"])) {
$query = "delete from tbl_leavepoints where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/leave_points.php' </script>";
}
if(isset($_POST['edit_leavetype'])){
$query = "update tbl_leavetype set leavetype = '".$_POST['leavetype']."' where
id = '".$_POST['id']."'";
mysqli_query($con,$query);

$action = "Updated Leave | Leave Type: '".$_POST['leavetype']."'";

echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/leave_type.php' </script>";

}
if(isset($_POST['del_leave'])){
$query = "delete from tbl_leavetype where id = '".$_POST['id']."'";
mysqli_query($con,$query);

$action = "Updated Leave | Leave Type: '".$_POST['leavetype']."'";

echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/leave_type.php' </script>";

}
if(isset($_POST['add_leavetype'])){
$query = "insert into tbl_leavetype value('','".$_POST['leavetype']."')";
 mysqli_query($con,$query);
$action = "Added Leave | Leave Type: '".$_POST['leavetype']."'";
echo "<script language='javascript' type='text/javascript'>
location.href='../s_admin/leave_type.php' </script>";

}
if(isset($_POST['new_pass'])){

$query = "update userdata set password = '".$_POST['password']."', pass_change

= 'Yes' where userid = '".$_SESSION['userid']."'";
mysqli_query($con,$query);
switch ($_SESSION['user_pos']) {
case "Super Administrator":
header("Location: ../s_admin/");
break;
case "HR":
header("Location: ../HR/");
break;
default:
$query = "select * from tbl_role where role_desc = '".
$_SESSION['user_pos']."'";
$res = mysqli_query($con,$query);
$row = mysqli_fetch_array($res);
if($row['role_type']=='Department Head'){
echo "<script language='javascript' type='text/javascript'>
location.href='../head' </script>";
}
else{
echo "<script language='javascript' type='text/javascript'>
location.href='../employee' </script>";
}

}
if(isset($_POST['delete_eli'])){
$query = "delete from eligibility_list where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/eligibility.php' </script>";

}
if(isset($_POST['edit_eli'])){
$query = "update eligibility_list set description = '".$_POST['description']."'
where id = '".$_POST['id']."'";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/eligibility.php' </script>";

}
if(isset($_POST['add_eli'])){
$query = "insert into eligibility_list value('','".$_POST['description']."')";
mysqli_query($con,$query);
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/eligibility.php' </script>";

}
if(isset($_POST['add_subpos'])){
$query = "insert into sub_position values('','".$_POST['mainpos']."','".
$_POST['subpos']."','')";
mysqli_query($con,$query);
$id = $_POST['mainpos'];
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/role_employee_list.php?id=$id' </script>";
}
if(isset($_POST['del_subpos'])){
$query = "delete from sub_position where id = '".$_POST['subpos']."'";
mysqli_query($con,$query);
$id = $_POST['mainpos'];
echo "<script language='javascript' type='text/javascript'>
location.href='../HR/role_employee_list.php?id=$id' </script>";
}
$date = date("Y-m-d");
$time = date("H:i:s A");
//$query = "insert into audit_trail values('','".
$_SESSION['userid']."','$action','$date','$time')";
//echo $query;
//mysqli_query($con,$query);

mysqli_close($con);

?>