<?php
session_start();
$usr = $_SESSION['usr'] ?? ''; // fallback if not set
$key = md5(date("Y-m-d").":".$_SERVER['REMOTE_ADDR']);
if (isset($_SESSION['aW1iZXN0cmEuY29tLm15']) <> $key) {
    header("location:".$_SERVER['REQUEST_SCHEME']."://".$_SERVER['SERVER_NAME']); // cara baru !
} else {
    include "_header.php";
    include "_navtop.php";
    include "_navside.php";
    include "_functions.php";
    require "conn.php";    
?>
        <div id="page-wrapper" >
            <div id="page-inner">
                <div class="row">
                    <div class="col-md-12">
                     <h2>PIN Transfer</h2>                          
                    </div>
                </div>
            <hr />

			<div class="row">
                <div class="col-md-12">
                    <!-- Form Elements -->
                    <div class="panel panel-default">
                        <div class="panel-heading">
                            PIN Transfer <?= $usr ?>
                        </div>
                        <div class="panel-body">
                            <div class="row">
                                <div class="col-md-6">
<?
	if (isset($_POST['z'])) {
		$usr        = mysqli_real_escape_string($con, $_POST['x']);
		$pin        = mysqli_real_escape_string($con, $_POST['y']);
		$rid        = mysqli_real_escape_string($con, $_POST['w']);

		if (chkUsr($usr) == 0) {

			noTis("danger", "Error", "Username not found.");
			goto kaki;

			} else {

        			if (chkPin($pin) <> 1) {
        
        			noTis("danger", "Error", "Wrong PIN.");
        			goto kaki;
        
        			} elseif (chkRid($rid) <> 1) {
        
        			    noTis("danger", "Error", "Wrong Record ID.");
        			    goto kaki;
        
        			    } else {
 
                            date_default_timezone_set("Asia/Kuala_Lumpur");
                            $tarikh = date("Y-m-d H:i:s");

        				
        				    // update rekod PIN ID (PIN LOG)
        				    $sql    = "SELECT * FROM bestpin WHERE id='$rid'";
                            $result = mysqli_query($con, $sql);
                            $row    = mysqli_fetch_array($result); 
                            $uid    = $row['userid'];
                            $udate  = $row['datesold'];
                            $udatet = $tarikh;
                            mysqli_query($con, "INSERT INTO bestpinlog (no, userid, datesold, dateactive, status) VALUES ('$pin','$uid','$udate','$udatet','2') " );
        				    
        				    // pindahkan pin
        				    $idbaru = reKod("id", "ahli", "username", $usr);
        				    mysqli_query($con, "UPDATE bestpin SET userid=".$idbaru." WHERE no='".$pin."'");
        				    noTis("success", "Success", "PIN moved to ".$usr." account.");
        				
        			    }
		}
	}
?>

                                </div>
                            </div>
                        </div>
                    </div>
                     <!-- End Form Elements -->
                </div>

			</div>


             <!-- /. PAGE INNER  -->
<? kaki: ?>			 
            </div>
         <!-- /. PAGE WRAPPER  -->
        </div>
<?
    include "_footer.php";
}
?>
