✏ EDIT: payment_update.php

<?php
require_once __DIR__ . '/../includes/config.php';
header('Content-Type: application/json');
start_secure_session();
if (!is_logged_in('admin')) {
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit;
}

$id = intval($_POST['id'] ?? 0);
$status = $_POST['status'] ?? '';
if ($id <= 0 || !in_array($status, ['paid','pending'])) {
    echo json_encode(['success' => false, 'message' => 'Invalid parameters.']);
    exit;
}

$conn = db_connect();
// Check payment exists
$stmt = $conn->prepare('SELECT id FROM payments WHERE id = ?');
$stmt->bind_param('i', $id);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows === 0) {
    $stmt->close();
    $conn->close();
    echo json_encode(['success' => false, 'message' => 'Payment not found.']);
    exit;
}
$stmt->close();
// Update status and date
if ($status === 'paid') {
    $stmt = $conn->prepare('UPDATE payments SET status = "paid", payment_date = CURDATE() WHERE id = ?');
    $stmt->bind_param('i', $id);
} else {
    $stmt = $conn->prepare('UPDATE payments SET status = "pending", payment_date = NULL WHERE id = ?');
    $stmt->bind_param('i', $id);
}
$success = $stmt->execute();
$stmt->close();
$conn->close();

if ($success) {
    echo json_encode(['success' => true]);
} else {
    echo json_encode(['success' => false, 'message' => 'Database error: unable to update payment.']);
}

[✗] CANCEL