<?php
session_start();
if (!isset($_SESSION['admin_logged_in']) || $_SESSION['admin_logged_in'] !== true) {
    header('Location: index.php');
    exit;
}
// DB connection
require 'dbconn.php'; // This should define $mysqli

// Sanitize and get input
$news_title = $_POST['news_title'] ?? '';
$news_date  = $_POST['news_date'] ?? '';
$short_desc = $_POST['short_desc'] ?? '';
$long_desc  = $_POST['long_desc'] ?? '';

if (empty($news_title) || empty($news_date) || empty($short_desc) || empty($long_desc)) {
    die('All fields are required.');
}

try {
    // Prepared statement to avoid SQL injection
    $stmt = $mysqli->prepare("INSERT INTO news_tb (news_title, news_date, short_desc, long_desc) VALUES (?, ?, ?, ?)");
    $stmt->bind_param("ssss", $news_title, $news_date, $short_desc, $long_desc);

    if ($stmt->execute()) {
        header("Location: manage_news.php?success=1");
        exit;
    } else {
        echo "Error inserting record: " . $stmt->error;
    }
    $stmt->close();
} catch (Exception $e) {
    echo "Exception: " . $e->getMessage();
}

$mysqli->close();
?>
