requireRole(['college']); $db = DB(); $user = Auth()->getUser(); $flash = getFlashMessage(); $search = cleanInput($_GET['search'] ?? ''); $student = null; $subjects = []; if ($search) { $student = $db->fetchOne("SELECT s.*, c.course_name FROM students s JOIN courses c ON s.course_id = c.id WHERE (s.registration_number = ? OR s.roll_number = ?) AND s.institution_id = ?", [$search, $search, $user['id']]); if ($student) { $subjects = $db->fetchAll("SELECT * FROM subjects WHERE course_id = ? ORDER BY type, subject_name", [$student['course_id']]); } else { $flash = ['type' => 'danger', 'message' => 'Student not found or not registered with your college.']; } } // Save Marks if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['save_marks'])) { // CSRF Protection if (!Auth()->verifyCSRFToken($_POST['csrf_token'] ?? '')) { redirectWithMessage("marks-entry.php?search=$search", "Security session expired. Please try again.", "danger"); } $studentId = intval($_POST['student_id']); // IDOR Protection: Verify student belongs to this college $studentCheck = $db->fetchOne("SELECT id FROM students WHERE id = ? AND institution_id = ?", [$studentId, $user['id']]); if (!$studentCheck) { redirectWithMessage("marks-entry.php", "Unauthorized access. You can only enter marks for your own students.", "danger"); } $marks = $_POST['marks']; // Array: [subject_id => obtained_marks] $totalMax = 0; $totalObtained = 0; $isFail = false; foreach ($marks as $subId => $obtained) { $sub = $db->fetchOne("SELECT * FROM subjects WHERE id = ?", [$subId]); $obtained = intval($obtained); if ($obtained > $sub['max_marks']) $obtained = $sub['max_marks']; if ($obtained < $sub['pass_marks']) $isFail = true; $totalMax += $sub['max_marks']; $totalObtained += $obtained; // Upsert marks $db->query("INSERT INTO marks_entry (student_id, subject_id, obtained_marks) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE obtained_marks = ?", [$studentId, $subId, $obtained, $obtained]); } $percentage = ($totalMax > 0) ? ($totalObtained / $totalMax) * 100 : 0; $division = 'Fail'; if (!$isFail) { if ($percentage >= 60) $division = '1st Division'; elseif ($percentage >= 45) $division = '2nd Division'; elseif ($percentage >= 33) $division = '3rd Division'; } else { $division = 'FAIL'; } // Update student summary $db->update('students', [ 'marks_obtained' => $totalObtained, 'total_marks' => $totalMax, 'percentage' => $percentage, 'division' => $division, 'result_declared' => 1, 'status' => ($division == 'FAIL') ? 'failed' : 'passed' ], ['id' => $studentId]); redirectWithMessage("marks-entry.php?search=$search", "Marks updated successfully! Status: $division", "success"); } // Fetch existing marks $existingMarks = []; if ($student) { $marksRows = $db->fetchAll("SELECT * FROM marks_entry WHERE student_id = ?", [$student['id']]); foreach ($marksRows as $mr) { $existingMarks[$mr['subject_id']] = $mr['obtained_marks']; } } ?> Marks Entry – <?= APP_SHORT_NAME ?>

Marks Entry

Reg: | Roll:

Print Marksheet
$s): $obtVal = $existingMarks[$s['id']] ?? ''; $tMax += $s['max_marks']; $tPass += $s['pass_marks']; $tObt += intval($obtVal); ?>
S.No Subject Name Type Max Marks Pass Marks Obtained Marks
No subjects configured for this course. Please contact Admin.
GRAND TOTAL:

For verification - Send documents to info@ibvte.com