<?php
require_once 'config.php';
// Simple security: only allow from logged-in doctor or admin
if (!isset($_SESSION['doctor']) && !isset($_SESSION['admin'])) {
    die("Access denied");
}

if (isset($_POST['add_prescription'])) {
    $appt_id = (int)$_POST['appointment_id'];
    $patient_id = (int)$_POST['patient_id'];
    $doctor_id = (int)$_POST['doctor_id'];
    $text = $conn->real_escape_string($_POST['prescription_text']);
    $advice = $conn->real_escape_string($_POST['advice']);
    $next = $_POST['next_visit'];
    $conn->query("INSERT INTO opd_prescriptions (appointment_id, patient_id, doctor_id, prescription_text, advice, next_visit) VALUES ($appt_id, $patient_id, $doctor_id, '$text', '$advice', '$next')");
    echo "✅ Prescription added.";
}

if (isset($_POST['add_bill'])) {
    $appt_id = (int)$_POST['appointment_id'];
    $patient_id = (int)$_POST['patient_id'];
    $amount = (float)$_POST['amount'];
    $desc = $conn->real_escape_string($_POST['description']);
    $conn->query("INSERT INTO opd_bills (appointment_id, patient_id, amount, description) VALUES ($appt_id, $patient_id, $amount, '$desc')");
    echo "✅ Bill added.";
}
?>
<form method="post">
    <h4>Add Prescription</h4>
    <input name="appointment_id" placeholder="Appt ID" required>
    <input name="patient_id" placeholder="Patient ID" required>
    <input name="doctor_id" placeholder="Doctor ID" required>
    <textarea name="prescription_text" placeholder="Prescription"></textarea>
    <input name="advice" placeholder="Advice">
    <input name="next_visit" type="date">
    <button name="add_prescription">Save Prescription</button>
</form>
<hr>
<form method="post">
    <h4>Add Bill</h4>
    <input name="appointment_id" placeholder="Appt ID" required>
    <input name="patient_id" placeholder="Patient ID" required>
    <input name="amount" type="number" step="0.01" required>
    <input name="description" placeholder="Description">
    <button name="add_bill">Save Bill</button>
</form>