| การยืนยันตัวตนล้มเหลว (CSRF) กรุณาโหลดหน้าเว็บใหม่ | ";
exit();
}
$type = $_POST['type'] ?? 'hn';
$query = $_POST['query'] ?? '';
$rows = [];
$current_user = $_SESSION['account'] ?? '';
if ($query !== "") {
if ($type === 'name') {
if (can_search_name($current_user)) {
// Split query by spaces to handle first and last name separately
$parts = preg_split('/\s+/', trim($query));
if (count($parts) >= 2) {
// First part is fname, second part is lname
$fname = "%" . $parts[0] . "%";
$lname = "%" . $parts[1] . "%";
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE fname LIKE ? AND lname LIKE ? LIMIT 50";
$stmt = $conn1->prepare($sql);
if ($stmt) {
$stmt->bind_param("ss", $fname, $lname);
$stmt->execute();
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
$rows[] = $row;
}
$stmt->close();
}
} else {
// Just one word, search either fname or lname
$data = "%" . trim($query) . "%";
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE fname LIKE ? OR lname LIKE ? LIMIT 50";
$stmt = $conn1->prepare($sql);
if ($stmt) {
$stmt->bind_param("ss", $data, $data);
$stmt->execute();
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
$rows[] = $row;
}
$stmt->close();
}
}
} else {
echo "| คุณไม่มีสิทธิ์ในการค้นหาด้วยชื่อ-สกุล |
";
exit();
}
} else {
require_once("../core/settings.php");
$app_settings = get_app_settings();
$is_strict = ($app_settings['strict_search_enable'] == '1');
$data = $is_strict ? $query : "%" . $query . "%";
$operator = $is_strict ? "=" : "LIKE";
if ($type === 'hn') {
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE hn $operator ? LIMIT 20";
} else if ($type === 'cid') {
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE cid $operator ? LIMIT 20";
} else if ($type === 'passport') {
$sql = "SELECT hn, pname, fname, lname, cid, passport_no FROM patient WHERE passport_no $operator ? LIMIT 20";
} else {
$sql = "SELECT hn, pname, fname, lname, cid FROM patient WHERE hn $operator ? LIMIT 20"; // default
}
$stmt = $conn1->prepare($sql);
if ($stmt) {
$stmt->bind_param("s", $data);
$stmt->execute();
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
$rows[] = $row;
}
$stmt->close();
}
}
}
if (empty($rows)) {
echo "| ไม่พบข้อมูลที่ตรงกับคำค้นหา |
";
} else {
$num = 1;
foreach ($rows as $row) {
$encoded_hn = encrypt_param($row['hn']); // No urlencode needed for hidden input
echo "";
echo "| " . $num . " | ";
echo "" . htmlspecialchars($row['hn']) . " | ";
$sort_name = htmlspecialchars($row['fname'] . " " . $row['lname']);
$display_name = htmlspecialchars($row['pname'] . $row['fname'] . " " . $row['lname']);
echo "" . $display_name . " | ";
echo "" . htmlspecialchars($row['cid'] ?? '-') . " | ";
echo "
| ";
echo "
";
$num++;
}
}
?>