<?php
  
  $ValidAccess = 2010;
  include "include/globals.php";

  // session_start();

  // startLog("ajaxSearchUsers.php");

  if (SessionActive() != 1 || ! UserLoggedIn()) {
    logExit("Session is not active\n");
    exit();
  }

  // CSRF token validation
  include "include/ajax.csrfToken.php";
  writeLog("passed csrf token check");


  if (!in_array($_SESSION['UserInfo']['type'],array('SuperUser','System Administrator','Application Administrator','Schedule Team','Financial','Financial Team'))) {
     logExit("Invalid user access\n");
     exit();
  }


  $searchTerm  = db_escape_string(urldecode($_GET['s']));
  $schoolId    = db_escape_string($_GET['sn']);
  $baseSchool  = db_escape_string(urldecode($_GET['bn']));
  $results = array();

  writeLog("searchTerm: $searchTerm");
  writeLog("schoolId: $schoolId");

  // find all matching students
  $rconds = "u.school_num='{$baseSchool}' AND";
  if (strlen($searchTerm) == 1) {
    $sText = "'" . db_escape_string($searchTerm) . "%'";
    $sTextB = $sText;
    $sTextB = "'%" . db_escape_string($searchTerm) . "%'";
  } else {
    $sTextB = "'%" . db_escape_string($searchTerm) . "%'";
    $sText = "'" . db_escape_string($searchTerm) . "%'";
  }
  $nConds = "";
  if (is_numeric($searchTerm)) $nConds = "OR u.record_num = $searchTerm";
  $conds = "$rconds (u.first_name LIKE $sText OR u.last_name LIKE $sText OR u.userid LIKE $sTextB OR u.email LIKE $sTextB OR u.email2 LIKE $sTextB OR u.email3 LIKE $sTextB OR u.home_phone LIKE $sTextB $nConds)";
  $order = "u.last_name ASC, u.first_name ASC";
  $r = db_query("SELECT u.* FROM users AS u WHERE {$conds} ORDER BY $order");

  while ($d = db_fetch_assoc($r)) {
    extract($d, EXTR_PREFIX_ALL, 'u');

    $num_students = db_getVal("SELECT count(*) FROM people WHERE school_num = $baseSchool AND user_num = $u_record_num");

    // Encode the name and user id for transmission
    $u_name = preg_replace('/\+/',' ',urlencode($u_first_name.' '.$u_last_name));
    $u_userid = preg_replace('/\+/',' ',urlencode($u_userid));

    // Encode the user array values
    $parent = preg_replace('/\+/',' ',urlencode($d['first_name'] . ' ' . $d['last_name']));
    $d['first_name'] = preg_replace('/\+/',' ',urlencode($d['first_name']));
    $d['last_name'] = preg_replace('/\+/',' ',urlencode($d['last_name']));

    if (isset($u_people_type) && $u_people_type == 'Staff') $parent = "Staff";

    // Encode the people array values
    $d['first_name'] = preg_replace('/\+/',' ',urlencode($d['first_name']));
    $d['last_name'] = preg_replace('/\+/',' ',urlencode($d['last_name']));

    $results[] = array(
      'record_num' => $u_record_num,
      'name' => $u_name,
      'userid' => $u_userid,
      'phone' => $u_home_phone,
      'type' => $u_type,
      'students' => $num_students
    );
  }

  echo(json_encode($results));
?>