<?php
require_once __DIR__ . '/../pixel/config.php';

// No-cache headers
header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');
header('Pragma: no-cache');

// Parameters with defaults
$fromlink     = $_GET['fromlink'] ?? '0';
$utm_source   = $_GET['utm_source'] ?? 'BWW2022';
$utm_medium   = $_GET['utm_medium'] ?? 'referral';
$utm_campaign = $_GET['utm_campaign'] ?? 'article';
$utm_content  = $_GET['utm_content'] ?? '';
$articlelink  = isset($_GET['articlelink']) ? trim(str_replace(["\r", "\n"], '', $_GET['articlelink'])) : '';
$regid        = $_GET['regid'] ?? '0';

if ($fromlink === '') {
    $fromlink = '0';
}

// Determine typerme
if ($fromlink == 0) {
    $typerme = 'TicketsShow';
} else {
    $typerme = 'Tickets';
}

if (isset($_GET['newsletter']) || stripos($utm_source, 'newsletter') !== false) {
    $typerme = 'TicketsNews';
}

if (isset($_GET['logo']) || stripos($utm_source, 'logo') !== false) {
    $typerme = 'TicketsLogo';
}

if (isset($_GET['uktc']) || stripos($utm_source, 'uktc') !== false) {
    $typerme = 'UKTC';
}

if (isset($_GET['special']) || stripos($utm_source, 'special') !== false) {
    $typerme = 'Special';
}

if ($fromlink == 55) {
    $typerme = 'TicketCentral';
}

if ($fromlink == 56) {
    $typerme = 'TicketCentralBottom';
}

$userAgent    = $_SERVER['HTTP_USER_AGENT'] ?? '';
$cfIp         = getClientIp();
$cookieExpiry = time() + (10 * 365 * 24 * 60 * 60); // ~10 years ("never" expire)

// Filter bots and validate articlelink
if (
    stripos($userAgent, 'bot') === false
    && stripos($userAgent, 'spider') === false
    && substr($cfIp, 0, 3) !== '47.'
    && isset($_GET['articlelink'])
    && strpos($articlelink, ' ') === false
    && strpos($articlelink, ';') === false
) {
    if (!is_numeric($regid)) {
        $regid = 0;
    }

    $db = getWriteDB();

    if (isset($_GET['clickedshow']) && is_numeric($_GET['clickedshow'])) {
        $cleanFromlink   = preg_replace('/[^0-9]/', '', (string)$fromlink);
        $cleanClickedshow = preg_replace('/[^0-9]/', '', (string)$_GET['clickedshow']);

        $stmt = $db->prepare(
            "INSERT INTO regionalstoryclick
             (datetime, regionid, articlelink, ipaddress, browser, fromlink, typer, clickedshow)
             VALUES (NOW(), :regid, :articlelink, :ip, :browser, :fromlink, :typer, :clickedshow)"
        );
        $stmt->execute([
            ':regid'       => (int)$regid,
            ':articlelink' => mb_substr($articlelink, 0, 600),
            ':ip'          => getClientIp(),
            ':browser'     => substr($userAgent, 0, 250),
            ':fromlink'    => (int)$cleanFromlink,
            ':typer'       => $typerme,
            ':clickedshow' => (int)$cleanClickedshow,
        ]);

        // ticketbuy cookie
        if (!isset($_COOKIE['ticketbuy'])) {
            setcookie('ticketbuy', $cleanClickedshow, $cookieExpiry, '/', COOKIE_DOMAIN);
        } elseif (strpos($_COOKIE['ticketbuy'], $cleanClickedshow) === false) {
            $newVal = $_COOKIE['ticketbuy'] . ',"' . $cleanClickedshow . '"';
            setcookie('TICKETBUY', $newVal, $cookieExpiry, '/', COOKIE_DOMAIN);
        }

    } else {
        // No clickedshow — validate regid and fromlink are numeric
        if (is_numeric($regid) && is_numeric($fromlink)) {
            $stmt = $db->prepare(
                "INSERT INTO regionalstoryclick
                 (datetime, regionid, articlelink, ipaddress, browser, fromlink, typer)
                 VALUES (NOW(), :regid, :articlelink, :ip, :browser, :fromlink, :typer)"
            );
            $stmt->execute([
                ':regid'       => (int)$regid,
                ':articlelink' => mb_substr($articlelink, 0, 600),
                ':ip'          => getClientIp(),
                ':browser'     => substr($userAgent, 0, 250),
                ':fromlink'    => (int)$fromlink,
                ':typer'       => $typerme,
            ]);
        } else {
            exit;
        }

        // ticketbuyregion cookie
        if (!isset($_COOKIE['ticketbuyregion'])) {
            setcookie('ticketbuyregion', (string)$regid, $cookieExpiry, '/', COOKIE_DOMAIN);
        } elseif (strpos($_COOKIE['ticketbuyregion'], (string)$regid) === false) {
            $newVal = $_COOKIE['ticketbuyregion'] . ',' . $regid;
            setcookie('ticketbuyregion', $newVal, $cookieExpiry, '/', COOKIE_DOMAIN);
        }
    }

    // Build redirect URL
    $linkme = $articlelink;

    // Prepend https:// if missing protocol
    if (strncasecmp($linkme, 'http', 4) !== 0) {
        $linkme = 'https://' . $linkme;
    }

    // Amazon affiliate tag
    if (stripos($linkme, 'amazon') !== false) {
        $linkme .= '&tag=broadwaywor01-20';
    }

    // Special overrides
    if (stripos($linkme, 'newyorktheatreguide') !== false) {
        $linkme = 'https://ticketmaster.evyy.net/c/2299526/264167/4272?u=https%3A%2F%2Fwww.ticketmaster.com%2Fbroadway';
    }
    if (stripos($linkme, 'londontheatre') !== false) {
        $linkme = 'https://ticketmaster-uk.tm7562.net/c/2299526/431525/7562?u=https://guides.ticketmaster.co.uk/west-end-theatre/';
    }

    // Strip CR/LF to prevent header injection
    $linkme = trim(str_replace(["\r", "\n"], '', $linkme));

    // Block non-secure URLs
    if (strncasecmp($linkme, 'http://', 7) === 0) {
        exit;
    }

    // Validate and redirect
    if (filter_var($linkme, FILTER_VALIDATE_URL)) {
        header('Location: ' . $linkme);
        exit;
    }
}