<?php include('_mod_security.php'); ?>
<?php
	session_start();
	switch ($_GET['func']):
		case 'favor' :
			if ($_GET['enable'] == '1') :
				$sql = "SELECT * FROM guests WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND user_id = ".$_SESSION['user_id']." AND event_id = ".$_SESSION['active_event'];
				$result_guest = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
				if (mysqli_num_rows($result_guest) > 0) :
					$row_guest = mysqli_fetch_object($result_guest);
					$sql = "SELECT * FROM favors WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['fid']))." AND user_id = ".$_SESSION['user_id']." AND event_id = ".$_SESSION['active_event'];
					$result_favor = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
					if (mysqli_num_rows($result_favor) > 0) :
						$row_favor = mysqli_fetch_object($result_favor);
						$preferred_gender = '';
						if (!empty($row_guest->favor_gender)) :
							if ($row_favor->{'gender_'.strtolower($row_guest->favor_gender)} == 1) :
								$preferred_gender = $row_guest->favor_gender;
							endif;
						endif;
						$preferred_size = '';
						if (!empty($row_guest->favor_size)) :
							if ($row_favor->{'size_'.strtolower($row_guest->favor_size)} == 1) :
								$preferred_size = $row_guest->favor_size;
							endif;
						endif;
						$sql = "INSERT INTO guests_favors SET ".
								"user_id = ".$_SESSION['user_id'].", ".
								"event_id = ".$_SESSION['active_event'].", ".
								"guest_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid'])).", ".
								"favor_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['fid'])).", ".
								"venue = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['venue']))."', ".
								"gender = '".$preferred_gender."', ".
								"size = '".$preferred_size."' ";
						mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
						if (!empty($preferred_gender)) :
							echo "<script>";
							echo "$('#favor_gender_".strtolower($preferred_gender)."_".$_GET['gid']."_".$_GET['fid']."').attr('checked', 'checked').change();";
							echo "</script>";
						endif;
						if (!empty($preferred_size)) :
							echo "<script>";
							echo "$('#favor_size_".strtolower($preferred_size)."_".$_GET['gid']."_".$_GET['fid']."').attr('checked', 'checked').change();";
							echo "</script>";
						endif;
					endif;
				endif;
			else :
				$sql = "DELETE FROM guests_favors WHERE ".
						"user_id = ".$_SESSION['user_id']." AND ".
						"event_id = ".$_SESSION['active_event']." AND ".
						"guest_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND ".
						"favor_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['fid']))." AND ".
						"venue = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['venue']))."' ";
				mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
				echo "<script>";
				echo "$('.favor_".$_GET['gid']."_".$_GET['fid']."').attr('checked', null).change();";
				echo "</script>";
			endif;
			break;
		case 'size' :
			$sql = "UPDATE guests_favors SET ".
					"size = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['size']))."'  WHERE ".
					"user_id = ".$_SESSION['user_id']." AND ".
					"event_id = ".$_SESSION['active_event']." AND ".
					"guest_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND ".
					"favor_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['fid']))." AND ".
					"venue = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['venue']))."' ";
				mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
			break;
		case 'gender' :
			$sql = "UPDATE guests_favors SET ".
					"gender = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gender']))."'  WHERE ".
					"user_id = ".$_SESSION['user_id']." AND ".
					"event_id = ".$_SESSION['active_event']." AND ".
					"guest_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND ".
					"favor_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['fid']))." AND ".
					"venue = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['venue']))."' ";
				mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
			break;
	endswitch
?>