update-user

<?php
// include '../config/header.php';
include '../../config/koneksi.php';

$response = ['success' => false, 'message' => ''];
$errors = [];

try {
  $data = json_decode(file_get_contents('php://input'), true);
  if (!$data) {
    $data = $_POST;
  }

  //* name validation
  if (empty($data['name'])) {
    $errors[] = 'Name cannot be empty!';
    $response['message'] = 'Name cannot be empty!';
  } elseif (strlen(trim($data['name'])) < 8) {
    $errors[] = 'Name at least 8 characters!';
    $response['message'] = 'Name at least 8 characters!';
  } else if (strlen(trim($data['name'])) > 100) {
    $errors[] = 'Name cannot be more than 100 characters!';
    $response['message'] = 'Name cannot be more than 100 characters!';
  } else {
    $data['name'] = htmlspecialchars($data['name'], ENT_QUOTES, 'UTF-8');
  }

  //* email validation
  if (empty($data['email'])) {
    $errors[] = 'Email cannot be empty!';
    $response['message'] = 'Email cannot be empty!';
  } elseif (!filter_var($data['email'], FILTER_VALIDATE_EMAIL)) {
    $errors[] = 'Invalid email format!';
    $response['message'] = 'Invalid email format';
  } else {
    $data['email'] = filter_var($data['email'], FILTER_VALIDATE_EMAIL);
  }

  //* password validation
  if (empty($data['password'])) {
    $errors[] = 'Password cannot be empty!';
    $response['message'] = 'Password cannot be empty!';
  } elseif (strlen($data['password']) < 8) {
    $errors[] = 'Password at least 8 characters!';
    $response['message'] = 'Password at least 8 characters!';
  } elseif (!preg_match('/[A-Z]/', $data['password'])) {
    $errors[] = 'Password must contain at least 1 uppercase letter!';
    $response['message'] = 'Password must contain at least 1 uppercase letter!';
  } elseif (!preg_match('/[a-z]/', $data['password'])) {
    $errors[] = 'Password must contain at least 1 lowercase letter!';
    $response['message'] = 'Password must contain at least 1 lowercase letter!';
  } elseif (!preg_match('/[0-9]/', $data['password'])) {
    $errors[] = 'Password must contain at least 1 number!';
    $response['message'] = 'Password must contain at least 1 number!';
  } elseif (!preg_match('/[@$!%*#?&]/', $data['password'])) {
    $errors[] = 'Password must contain at least 1 special character!';
    $response['message'] = 'Password must contain at least 1 special character!';
  } else {
    $data['password'] = htmlspecialchars($data['password'], ENT_QUOTES, 'UTF-8');
  }

  //* address validation
  if (empty($data['address'])) {
    $errors[] = 'Address cannot be empty!';
    $response['message'] = 'Address cannot be empty!';
  } else {
    $data['address'] = htmlspecialchars($data['address'], ENT_QUOTES, 'UTF-8');
  }

  //* phone validation
  if (empty($data['phone'])) {
    $errors[] = 'Phone cannot be empty!';
    $response['message'] = 'Phone cannot be empty!';
  } else {
    $data['phone'] = htmlspecialchars($data['phone'], ENT_QUOTES, 'UTF-8');
  }

  //* role validation
  if (empty($data['role'])) {
    $errors[] = 'Role cannot be empty!';
    $response['message'] = 'Role cannot be empty!';
  } else {
    $data['role'] = htmlspecialchars($data['role'], ENT_QUOTES, 'UTF-8');
  }

  if (!isset($_GET['id']) || empty($_GET['id'])) {
    echo "<p>Invalid user id...</p>";
    exit;
  } else {
    $id = $_GET['id'];
    $checkUser = "SELECT * FROM users WHERE id = :id";
    $stmtCheckUser = $conn->prepare($checkUser);
    $stmtCheckUser->bindParam(':id', $id);
    $stmtCheckUser->execute();
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$user) {
      echo "<p>User no found...</p>";
      exit;
    } else {
      //* photo
      $old_photo = $data['photo'];
      $new_photo = $old_photo;

      if (!empty($_FILES['photo']['name'])) {
        $target_dir = "uploads/";
        if (!is_dir($target_dir)) mkdir($target_dir, 0777, true);

        $file_ext = pathinfo($_FILES['photo']['name'], PATHINFO_EXTENSION);
        $filename = uniqid() . '.' . $file_ext;
        $target_file = $target_dir . $filename;

        $allowed = ['jpg', 'jpeg', 'png', 'gif'];
        if (in_array(strtolower($file_ext), $allowed)) {
          if (move_uploaded_file($_FILES['photo']['tmp_name'], $target_file)) {
            if ($old_photo && file_exists($old_photo)) unlink($old_photo);
            $new_photo = $target_file;
          } else {
            $errors = "Failed to upload photo!";
            $response['message'] = 'Failed to upload photo!';
          }
        } else {
          $errors = "Invalid photo format!";
          $response['message'] = 'Invalid photo format!';
        }
      }

      //* if no errors then process to database
      if (empty($errors)) {
        $hashedPassword = password_hash($data['password'], PASSWORD_BCRYPT);

        $sql = "UPDATE users SET name = :name, email = :email, password = :password, address = :address, phone = :phone, role = :role, photo = :photo WHERE id = :id";
        $stmt = $conn->prepare($sql);

        $stmt->bindParam(':name', $data['name']);
        $stmt->bindParam(':email', $data['email']);
        $stmt->bindParam(':password', $hashedPassword);
        $stmt->bindParam(':address', $data['address']);
        $stmt->bindParam(':phone', $data['phone']);
        $stmt->bindParam(':role', $data['role']);
        $stmt->bindParam(':photo', $new_photo);
        $stmt->bindParam(':id', $data['id']);
        $stmt->execute();

        $token = bin2hex(random_bytes(16));

        $rowCount = $stmt->rowCount();
        if ($rowCount > 0) {
          $lastId = $conn->lastInsertId();
          $response = [
            'success' => true,
            'message' => 'Registration successful!',
            'id' => $lastId,
            'name' => $data['name'],
            'email' => $data['email'],
            'address' => $data['address'],
            'phone' => $data['phone'],
            'photo' => $new_photo,
            'role' => $data['role'],
            'token' => $token,
          ];
        } else {
          $response = [
            'success' => false,
            'message' => 'Registration failed!',
            'id' => '',
            'name' => '',
            'email' => '',
            'address' => '',
            'phone' => '',
            'photo' => '',
            'role' => '',
            'token' => '',
          ];
        }
      } else {
        $response = [
          'success' => false,
          'message' => implode(', ', $errors),
        ];
      }
    }
  }
} catch (PDOException $e) {
  $response['message'] = $e->getMessage();
} finally {
  $conn = null;
}
//* only for development purpose
echo json_encode($response);