prepare("SELECT * FROM tickets WHERE id = ? AND user_id = ?");
$stmt->execute([$ticket_id, $user_id]);
$ticket = $stmt->fetch();
if (!$ticket) { echo "Access Denied
"; include 'includes/footer.php'; exit(); }
// 2. Handle Reply & Upload
if (isset($_POST['reply'])) {
$msg = trim($_POST['message']);
$file_path = NULL;
// Handle File Upload
if (!empty($_FILES['attachment']['name'])) {
$allowed = ['jpg', 'jpeg', 'png', 'webp', 'pdf'];
$ext = strtolower(pathinfo($_FILES['attachment']['name'], PATHINFO_EXTENSION));
if (in_array($ext, $allowed) && $_FILES['attachment']['size'] <= 5242880) { // 5MB
$target = "uploads/tickets/" . time() . "_" . rand(100,999) . "." . $ext;
if (!is_dir("uploads/tickets/")) mkdir("uploads/tickets/", 0777, true);
if (move_uploaded_file($_FILES['attachment']['tmp_name'], $target)) {
$file_path = $target;
}
}
}
if (!empty($msg) || $file_path) {
$pdo->prepare("INSERT INTO ticket_messages (ticket_id, sender, message, attachment) VALUES (?, 'user', ?, ?)")
->execute([$ticket_id, $msg, $file_path]);
$pdo->prepare("UPDATE tickets SET status = 'open' WHERE id = ?")->execute([$ticket_id]);
header("Location: view_ticket.php?id=$ticket_id"); exit();
}
}
// 3. Fetch Messages
$msgs = $pdo->prepare("SELECT * FROM ticket_messages WHERE ticket_id = ? ORDER BY created_at ASC");
$msgs->execute([$ticket_id]);
$messages = $msgs->fetchAll();
?>