<?php
session_start();

if (!isset($_SESSION['clinic_logged_in']) || $_SESSION['clinic_logged_in'] !== true) {
    header('Location: index.php');
    exit;
}

// Optional: access admin ID like this
$admin_id = $_SESSION['clinic_id'];
include 'dbconn.php'; // make sure this connects to your DB

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Sanitize inputs
    $ip_name = trim($_POST['ip_name']);
    $ip_manufacturer = trim($_POST['ip_manufacturer']);
    $ip_formulation = trim($_POST['ip_formulation']);
    $mode_of_administration = trim($_POST['mode_of_administration']);
    $storage_requirements = trim($_POST['storage_requirements']);
    $ip_responsibility = trim($_POST['ip_responsibility']);

    // Insert query using prepared statements
    $stmt = $mysqli->prepare("INSERT INTO investigational_products 
        (ip_name, ip_manufacturer, ip_formulation, mode_of_administration, storage_requirements, ip_responsibility, clinic_id) 
        VALUES (?, ?, ?, ?, ?, ? ,?)");
    
    $stmt->bind_param("ssssssi", 
        $ip_name, 
        $ip_manufacturer, 
        $ip_formulation, 
        $mode_of_administration, 
        $storage_requirements, 
        $ip_responsibility,
        $admin_id 
    );

    if ($stmt->execute()) {
        echo "<script>
            alert('IP Details saved successfully.');
            window.location.href = 'investigational_products.php'; // change as needed
        </script>";
    } else {
        echo "<script>
            alert('Error saving IP details.');
            window.history.back();
        </script>";
    }

    $stmt->close();
    $mysqli->close();
} else {
    echo "Invalid request method.";
}
?>
