<?php
  
  $ValidAccess = 2010;
  require_once("include/globals.php");

  if (SessionActive() != 1 || ! UserLoggedIn()) {
     logExit("Session is not active\n");
     exit();
  }

  // CSRF token validation
  include "include/ajax.csrfToken.php";


  if (!in_array($_SESSION['UserInfo']['type'],array('SuperUser','System Administrator','Application Administrator','Schedule Team','Financial','Financial Team'))) {
     logExit("Invalid user access\n");
     exit();
  }


  $moduleName = "ajaxSearchStudents.php";
  // startLog($moduleName);


  if (array_key_exists('s', $_GET)) $searchTerm = db_escape_string(urldecode($_GET['s']));
  if (array_key_exists('sn', $_GET)) $schoolId = db_escape_string($_GET['sn']);
  if (array_key_exists('bn', $_GET)) $baseSchool = db_escape_string(urldecode($_GET['bn']));
  if (array_key_exists('sch', $_GET)) $scheduleNum = db_escape_string($_GET['sch']);

  $results = array();

  // find all matching students
  $rconds = "p.school_num='{$baseSchool}' AND p.user_num = u.record_num ";
  $rconds = "p.school_num='{$baseSchool}' ";
  if (strlen($searchTerm) == 1) {
    $sText = "'" . db_escape_string($searchTerm) . "%'";
    $sTextB = "'" . db_escape_string($searchTerm) . "%'";
    $nconds = "";
    if (is_numeric($searchTerm)) $nconds = " OR p.record_num = $searchTerm";
    // $conds = "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR u.last_name LIKE $sText OR u.home_phone LIKE $sTextB OR student_number LIKE $sText $nconds) ";
    $conds = "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR student_number LIKE $sText $nconds) ";
  } else {
    $words = explode(' ',$searchTerm);
    $conds = "";
    for ($i = 0; $i < count($words); $i++) {
      $word = trim($words[$i]);
      $sText = "'" . db_escape_string($word) . "%'";
      $sTextB = "'%" . db_escape_string($word) . "%'";
      $nconds = "";
      if (is_numeric($word)) $nconds = " OR p.record_num = $word";
      // $conds .= "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR u.last_name LIKE $sText OR u.home_phone LIKE $sTextB OR student_number LIKE $sText $nconds) ";
      $conds .= "AND (p.first_name LIKE $sText OR p.last_name LIKE $sText OR student_number LIKE $sText $nconds) ";
    }
  }

  $conds = "$rconds $conds";
  $order = "p.last_name ASC, p.first_name ASC";
  $q = "SELECT p.* FROM people AS p LEFT JOIN users AS u ON p.user_num = u.record_num WHERE p.status != 'Inactive' AND {$conds} ORDER BY $order";
  // writeLog("query: $q\n");
  $r = db_query($q);

  while ($d = db_fetch_assoc($r)) {
    extract($d, EXTR_PREFIX_ALL, 's');

    $ur = array();
    $u_userid = '';
    $u_home_phone = '';
    if ($s_people_type == 'Student') {
      $s_user_num = intval($s_user_num);
      $u = db_query("SELECT * FROM users WHERE record_num = $s_user_num");
      if (db_num_rows($u)) {
        $ur = db_fetch_assoc($u);
        extract($ur, EXTR_PREFIX_ALL, 'u');
      }
    }

    // Check if this person has an order
    if (isset($scheduleNum) && $scheduleNum > 0) {
      $query = "SELECT count(*) FROM hotlunch_order_header " .
               "WHERE school_num = $schoolId " .
               "AND ordered_by_num = $s_record_num " .
               "AND schedule_num = $scheduleNum";
      writeLog($query);
      $num_orders = db_getVal($query);
      writeLog("num_orders: $num_orders");
      $has_order = false;
      if ($num_orders > 0) $has_order = true;
    }

    // Encode the name and user id for transmission
    $s_first_name = preg_replace('/\+/',' ',urlencode($s_first_name));
    $s_last_name = preg_replace('/\+/',' ',urlencode($s_last_name));
    $u_userid = preg_replace('/\+/',' ',urlencode($u_userid));

    // Encode the user array values
    $parent = '';
    if (array_key_exists('first_name', $ur)) {
      $parent = preg_replace('/\+/',' ',urlencode($ur['first_name'] . ' ' . $ur['last_name']));
      $ur['first_name'] = preg_replace('/\+/',' ',urlencode($ur['first_name']));
      $ur['last_name'] = preg_replace('/\+/',' ',urlencode($ur['last_name']));
    }

    if ($s_people_type == 'Staff') $parent = "Staff";

    // Encode the people array values
    $d['first_name'] = preg_replace('/\+/',' ',urlencode($d['first_name']));
    $d['last_name'] = preg_replace('/\+/',' ',urlencode($d['last_name']));

    // Ensure that a price category is returned
    if (strlen($s_menu_price_category) == 0) $s_menu_price_category = 'Regular';

    $results[] = array_merge($d, array(
      'user' => $ur,
      'id' => $s_record_num,
      'name' => "{$s_first_name} {$s_last_name}",
      'parent' => $parent,
      'phone' => $u_home_phone,
      'hasOrder' => $has_order,
      'birthdate' => $s_birthdate,
      'age' => $s_age,
      'sex' => $s_sex,
      'grade' => $s_school_grade,
      'student_number' => $s_student_number,
      'price_category' => $s_menu_price_category,
      'people_type' => $s_people_type
    ));
  }

  echo(json_encode($results));
?>