<?php
  $ValidAccess = 2010;
  require_once("include/globals.php");

  if (SessionActive() != 1 || ! UserLoggedIn()) {
     logExit("Session is not active\n");
     exit();
  }

  // CSRF token validation
  include "include/ajax.csrfToken.php";


  if (!in_array($_SESSION['UserInfo']['type'],array('SuperUser','System Administrator','Application Administrator','Schedule Team','Financial','Financial Team'))) {
     logExit("Invalid user access\n");
     exit();
  }


  $searchTerm  = db_escape_string(urldecode($_GET['s']));
  $schoolId    = db_escape_string($_GET['sn']);
  $schoolId    = $base_school_num;
  $scheduleNum = db_escape_string($_GET['sch']);
  $results = array();

  // find all matching students
  $words = explode(' ',$searchTerm);
  $conds = "";
  for ($i = 0; $i < count($words); $i++) {
    $word = db_escape_string(trim($words[$i]));
    $searchSql = "{$word}%";
    $conds = "type='Parent' AND school_num='{$schoolId}' AND (last_name LIKE \"{$searchSql}\" OR userid LIKE \"{$searchSql}\" OR email LIKE \"{$searchSql}\")";
  }
  $order = "last_name ASC, first_name ASC";
  $r = db_query("SELECT * FROM users WHERE {$conds} ORDER BY $order");

  while ($d = db_fetch_assoc($r)) {
    extract($d, EXTR_PREFIX_ALL, 'p');

    // Encode the values for transmission
    $p_first_name = preg_replace('/\+/',' ',urlencode($p_first_name));
    $p_last_name = preg_replace('/\+/',' ',urlencode($p_last_name));
    $p_userid = preg_replace('/\+/',' ',urlencode($p_userid));

    // Encode the users array
    $d['first_name'] = preg_replace('/\+/',' ',urlencode($d['first_name']));
    $d['last_name'] = preg_replace('/\+/',' ',urlencode($d['last_name']));
    $d['userid'] = preg_replace('/\+/',' ',urlencode($d['userid']));

    $results[] = array_merge($d, array(
      'id' => $p_record_num,
      'account' => $p_userid,
      'name' => trim("{$p_first_name} {$p_last_name}"),
      'email' => $p_email,
      'phone' => $p_home_phone
    ));
  }

  echo(json_encode($results));
?>