<?php
/**
 * banned.php - BUG FIXED VERSION
 * Fixes:
 * 1. $datetime was used but never defined - now defined at top
 * 2. Added mysqli_real_escape_string for SQL safety
 */
include 'anti.php';
include 'konak.php';
date_default_timezone_set("Asia/Jakarta");

// FIX: $datetime was undefined - define it here
$datetime = date('Y-m-d H:i:s');

if (isset($_POST['email'])) {
    $usermail = anti_injection($_POST['email']);
    $text     = anti_injection($_POST['text']);

    $esEmail = mysqli_real_escape_string($koneksi, $usermail);
    $esText  = mysqli_real_escape_string($koneksi, $text);

    if ($usermail != "" && $text != "") {
        $sql = "UPDATE user_id SET info='$esText', status='Bloked' WHERE email='$esEmail'";
        if (mysqli_query($koneksi, $sql)) {
            $log_entry = "[$datetime] Email: $usermail | Status: Bloked | Info: $text\n";
            file_put_contents("block_history.log", $log_entry, FILE_APPEND | LOCK_EX);
            echo "done";
        } else {
            echo "filed";
        }
    } else {
        echo "filed";
    }
} else {
    echo "filed";
}
