<?php
include 'auth.php';
require_permission('settings_edit');
include '../includes/db.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

    $stmt = $conn->prepare("INSERT INTO settings (setting_key, setting_value) VALUES (?, ?) ON DUPLICATE KEY UPDATE setting_value = ?");

    foreach ($_POST as $key => $value) {
        if ($key === 'current_logo') continue;
        $sanitized_value = htmlspecialchars($value);
        $stmt->bind_param("sss", $key, $sanitized_value, $sanitized_value);
        $stmt->execute();
    }

    $stmt->close();
    $conn->close();

    header("Location: settings.php?success=1");
    exit();

} else {
    header("Location: settings.php");
    exit();
}
?>