<?php
require_once 'db_connect.php';

header('Content-Type: application/json');

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Basic sanitization
    $name = htmlspecialchars(strip_tags($_POST['name'] ?? ''));
    $email = filter_var($_POST['email'] ?? '', FILTER_SANITIZE_EMAIL);
    $phone = htmlspecialchars(strip_tags($_POST['phone'] ?? ''));
    $course = htmlspecialchars(strip_tags($_POST['course'] ?? 'General Inquiry'));

    // Validation
    if(empty($name) || empty($email) || empty($phone)) {
        echo json_encode(["status" => "error", "message" => "Name, Email, and Phone are required."]);
        exit;
    }

    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        echo json_encode(["status" => "error", "message" => "Invalid email format."]);
        exit;
    }

    if($conn) {
        try {
            $stmt = $conn->prepare("INSERT INTO leads (name, email, phone, course) VALUES (:name, :email, :phone, :course)");
            $stmt->bindParam(':name', $name);
            $stmt->bindParam(':email', $email);
            $stmt->bindParam(':phone', $phone);
            $stmt->bindParam(':course', $course);
            
            $stmt->execute();

            $to = "Admin@mytechcertificate.com";
            $subject = "New Lead: " . $course;
            $message = "You have received a new lead.\n\nName: $name\nEmail: $email\nPhone: $phone\nCourse: $course\n";
            $headers = "From: no-reply@mytechcertificate.com\r\n";
            $headers .= "Reply-To: Admin@mytechcertificate.com\r\n";
            @mail($to, $subject, $message, $headers);

            echo json_encode(["status" => "success", "message" => "Thank you for your interest! We will contact you soon."]);
        } catch(PDOException $e) {
            echo json_encode(["status" => "error", "message" => "Database error occurred. Please try again later."]);
        }
    } else {
        // Fallback if no database is connected
        echo json_encode(["status" => "error", "message" => "Database connection error!"]);
    }
} else {
    echo json_encode(["status" => "error", "message" => "Invalid Request Method."]);
}
?>