<?php
session_start();
require_once 'db/config.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: index.php');
    exit;
}

// Basic server-side validation
$survey_id = filter_input(INPUT_POST, 'survey_id', FILTER_VALIDATE_INT);
$email = filter_input(INPUT_POST, 'respondent_email', FILTER_VALIDATE_EMAIL);
$satisfaction = filter_input(INPUT_POST, 'satisfaction', FILTER_SANITIZE_STRING);
$features = isset($_POST['features']) ? $_POST['features'] : [];

if (!$survey_id || !$email || !$satisfaction) {
    $_SESSION['error_message'] = 'Please fill out all required fields.';
    header('Location: survey.php');
    exit;
}

// Combine checkbox answers into a single string
$features_str = is_array($features) ? implode(', ', $features) : '';

try {
    $pdo = db();
    $sql = "INSERT INTO survey_responses (survey_id, respondent_email, question_1_answer, question_2_answer) VALUES (?, ?, ?, ?)";
    $stmt = $pdo->prepare($sql);
    
    if ($stmt->execute([$survey_id, $email, $satisfaction, $features_str])) {
        $_SESSION['success_message'] = 'Thank you for your submission!';
        header('Location: thank_you.php');
        exit;
    } else {
        $_SESSION['error_message'] = 'There was an error saving your response. Please try again.';
        header('Location: survey.php');
        exit;
    }
} catch (PDOException $e) {
    // In a real app, you would log this error, not show it to the user.
    error_log('Database Error: ' . $e->getMessage());
    $_SESSION['error_message'] = 'A database error occurred. Please try again later.';
    header('Location: survey.php');
    exit;
}