✏ EDIT: member_edit.php

<?php
require_once __DIR__ . '/../includes/config.php';
header('Content-Type: application/json');
start_secure_session();

if (!is_logged_in('admin')) {
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit;
}

$id = intval($_POST['id'] ?? 0);
$name = trim($_POST['name'] ?? '');
$email = trim($_POST['email'] ?? '');
$phone = trim($_POST['phone'] ?? '');
$address = trim($_POST['address'] ?? '');
$username = trim($_POST['username'] ?? '');
$password = trim($_POST['password'] ?? '');
$status = $_POST['status'] ?? 'active';

// Basic validation
if ($id <= 0 || $name === '' || $email === '' || $phone === '' || $address === '' || $username === '') {
    echo json_encode(['success' => false, 'message' => 'All fields except password are required.']);
    exit;
}
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo json_encode(['success' => false, 'message' => 'Invalid email format.']);
    exit;
}
if (!preg_match('/^[0-9]{6,15}$/', $phone)) {
    echo json_encode(['success' => false, 'message' => 'Invalid phone number.']);
    exit;
}

$conn = db_connect();

// Check if user exists
$stmt = $conn->prepare('SELECT id FROM members WHERE id = ?');
$stmt->bind_param('i', $id);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows === 0) {
    $stmt->close();
    $conn->close();
    echo json_encode(['success' => false, 'message' => 'Member not found.']);
    exit;
}
$stmt->close();

// Check duplicate username (ignore current)
$stmt = $conn->prepare('SELECT id FROM members WHERE username = ? AND id != ?');
$stmt->bind_param('si', $username, $id);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows > 0) {
    $stmt->close();
    $conn->close();
    echo json_encode(['success' => false, 'message' => 'Username already exists for another member.']);
    exit;
}
$stmt->close();

// Build update query
if ($password !== '') {
    $hashed = password_hash($password, PASSWORD_DEFAULT);
    $stmt = $conn->prepare('UPDATE members SET name = ?, email = ?, phone = ?, address = ?, username = ?, password = ?, status = ? WHERE id = ?');
    $stmt->bind_param('sssssssi', $name, $email, $phone, $address, $username, $hashed, $status, $id);
} else {
    $stmt = $conn->prepare('UPDATE members SET name = ?, email = ?, phone = ?, address = ?, username = ?, status = ? WHERE id = ?');
    $stmt->bind_param('ssssssi', $name, $email, $phone, $address, $username, $status, $id);
}
$success = $stmt->execute();
$stmt->close();
$conn->close();

if ($success) {
    echo json_encode(['success' => true]);
} else {
    echo json_encode(['success' => false, 'message' => 'Database error: unable to update member.']);
}

[✗] CANCEL