<?php
session_start();

/* ================= METHOD CHECK ================= */
if ($_SERVER["REQUEST_METHOD"] !== "POST") {
    header("Location: index.html");
    exit;
}

/* ================= ANTI-SPAM 1: HONEYPOT ================= */
if (!empty($_POST["website"])) {
    exit;
}

/* ================= ANTI-SPAM 2: TIME CHECK ================= */
if (!isset($_POST['form_time']) || (time() - (int)$_POST['form_time']) < 3) {
    exit;
}

/* ================= ANTI-SPAM 3: RATE LIMIT ================= */
if (isset($_SESSION['last_submit']) && time() - $_SESSION['last_submit'] < 30) {
    echo "<script>alert('Please wait 30 seconds before submitting again');history.back();</script>";
    exit;
}
$_SESSION['last_submit'] = time();

/* ================= RECAPTCHA ================= */
$secretKey = "6LdRyEcsAAAAALovwq5w8s_aCvEZDpT8EterBk67";
$captcha   = $_POST['g-recaptcha-response'] ?? '';

if (!$captcha) {
    echo "<script>alert('Please verify reCAPTCHA');history.back();</script>";
    exit;
}

$verify = file_get_contents(
    "https://www.google.com/recaptcha/api/siteverify?secret={$secretKey}&response={$captcha}"
);
$response = json_decode($verify, true);

if (empty($response['success'])) {
    echo "<script>alert('Captcha verification failed');history.back();</script>";
    exit;
}

/* ================= SANITIZE INPUTS ================= */
$name    = trim($_POST['name'] ?? '');
$email   = trim($_POST['email'] ?? '');
$phone   = trim($_POST['number'] ?? '');
$city    = trim($_POST['city'] ?? '');
$message = trim($_POST['message'] ?? '');

/* ================= ANTI-SPAM 4: HEADER INJECTION ================= */
if (preg_match("/\r|\n|%0A|%0D/i", $email)) {
    exit;
}

/* ================= VALIDATION ================= */
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "<script>alert('Invalid email address');history.back();</script>";
    exit;
}

if (!preg_match('/^(?:\+91)?[6-9][0-9]{9}$/', $phone)) {
    echo "<script>alert('Invalid Indian mobile number');history.back();</script>";
    exit;
}

/* ================= ANTI-SPAM 5: CONTENT FILTER ================= */
$spamWords = ['viagra','casino','loan','crypto','bitcoin','sex','porn','http','https'];
foreach ($spamWords as $word) {
    if (stripos($message, $word) !== false) {
        exit;
    }
}

/* ================= SAFE OUTPUT ================= */
$name    = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
$email   = htmlspecialchars($email, ENT_QUOTES, 'UTF-8');
$phone   = htmlspecialchars($phone, ENT_QUOTES, 'UTF-8');
$city    = htmlspecialchars($city, ENT_QUOTES, 'UTF-8');
$message = nl2br(htmlspecialchars($message, ENT_QUOTES, 'UTF-8'));

/* ================= EMAIL ================= */
$to = "projects@vleadtechnocrats.com, digi@tradebizz.in";
$subject = "VLead Technocrafts - Tradebizz.in";

$logo = "https://tradebizz.in/assets/images/logo.png";

$body = "
<html>
<body style='font-family:Arial;background:#f4f4f4;padding:20px'>
  <div style='max-width:600px;margin:auto;background:#fff;padding:20px;border-radius:8px'>
    <img src='{$logo}' style='max-width:180px'><br><br>
    <p><strong>Name:</strong> {$name}</p>
    <p><strong>Email:</strong> {$email}</p>
    <p><strong>Phone:</strong> {$phone}</p>
    <p><strong>City:</strong> {$city}</p>
    <p><strong>Message:</strong>{$message}</p>
   <hr>
    <p style='text-align:center;'>This email was sent from <a href='https://vleadtechnocrats.com/'>VLead Technocrafts</a> contact form</p>
  </div>
</body>
</html>";

$headers  = "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=UTF-8\r\n";
$headers .= "From: VLead Technocrafts <no-reply@tradebizz.in>\r\n";
$headers .= "Reply-To: {$email}\r\n";

/* ================= SEND ================= */
if (mail($to, $subject, $body, $headers)) {
    header("Location: thank-you.html");
    exit;
} else {
    echo "<script>alert('Mail failed. Try again later');history.back();</script>";
}
