✏ EDIT: enquiries.php

<?php
declare(strict_types=1);

require_once __DIR__ . '/includes/auth.php';
require_login();

$admin_title = 'Enquiries';
$db = db();
if (!$db) {
    admin_flash('Database connection is not configured.', 'error');
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && $db) {
    verify_csrf();
    $action = (string) ($_POST['action'] ?? '');
    if ($action === 'delete') {
        $id = (int) ($_POST['id'] ?? 0);
        $stmt = $db->prepare("DELETE FROM enquiries WHERE id = ?");
        $stmt->bind_param('i', $id);
        $stmt->execute();
        admin_flash('Enquiry deleted.');
    }
    if ($action === 'status') {
        $id = (int) ($_POST['id'] ?? 0);
        $status = in_array(($_POST['status'] ?? ''), ['new', 'reviewed', 'closed'], true) ? (string) $_POST['status'] : 'new';
        $stmt = $db->prepare("UPDATE enquiries SET status = ?, updated_at = NOW() WHERE id = ?");
        $stmt->bind_param('si', $status, $id);
        $stmt->execute();
        admin_flash('Enquiry status updated.');
    }
    admin_redirect('enquiries.php');
}

$rows = [];
if ($db) {
    $result = $db->query("SELECT * FROM enquiries ORDER BY created_at DESC, id DESC");
    if ($result) {
        $rows = $result->fetch_all(MYSQLI_ASSOC);
    }
}
include __DIR__ . '/includes/header.php';
?>
<section class="panel">
    <h2>Saved contact enquiries</h2>
    <div class="table-wrap">
        <table>
            <thead><tr><th>Contact</th><th>Company</th><th>Message</th><th>Status</th><th>Date</th><th>Actions</th></tr></thead>
            <tbody>
            <?php foreach ($rows as $row): ?>
                <tr>
                    <td>
                        <strong><?= h($row['name']) ?></strong><br>
                        <span class="muted"><?= h($row['email']) ?></span><br>
                        <span class="muted"><?= h($row['phone']) ?></span>
                    </td>
                    <td><?= h($row['company']) ?></td>
                    <td><?= nl2br(h($row['message'])) ?></td>
                    <td>
                        <form method="post">
                            <?= csrf_field() ?>
                            <input type="hidden" name="action" value="status">
                            <input type="hidden" name="id" value="<?= (int) $row['id'] ?>">
                            <select name="status" onchange="this.form.submit()">
                                <?php foreach (['new', 'reviewed', 'closed'] as $status): ?>
                                    <option value="<?= h($status) ?>" <?= $row['status'] === $status ? 'selected' : '' ?>><?= h($status) ?></option>
                                <?php endforeach; ?>
                            </select>
                        </form>
                    </td>
                    <td><?= h(format_date($row['created_at'])) ?></td>
                    <td>
                        <form method="post" data-confirm-delete>
                            <?= csrf_field() ?>
                            <input type="hidden" name="action" value="delete">
                            <input type="hidden" name="id" value="<?= (int) $row['id'] ?>">
                            <button class="danger" type="submit">Delete</button>
                        </form>
                    </td>
                </tr>
            <?php endforeach; ?>
            <?php if (!$rows): ?><tr><td colspan="6" class="muted">No enquiries found.</td></tr><?php endif; ?>
            </tbody>
        </table>
    </div>
</section>
<?php include __DIR__ . '/includes/footer.php'; ?>

[✗] CANCEL