<?php
/**
 * Contact form handler for Marina STUDIO
 * Receives the contact form POST, validates it, and emails it on.
 *
 * SET-UP:
 *  - $to    : the address you want enquiries delivered to.
 *  - $from  : MUST be an address on your own domain (e.g. website@marina.studio),
 *             created as a mailbox in cPanel. Sending "From" a domain you don't
 *             own (like the visitor's address) gets flagged as spam.
 *  For best deliverability, consider sending via SMTP with PHPMailer instead of
 *  the built-in mail() function (see note at the bottom).
 */

$to      = 'hello@marina.studio';          // where enquiries are delivered
$from    = 'hello@marina.studio';          // sender (your existing mailbox)
$subjectPrefix = '[marina.studio] ';

// Only handle POST requests
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: /contact.html');
    exit;
}

// Honeypot: bots fill hidden fields. If it's filled, pretend success and stop.
if (!empty($_POST['company'])) {
    header('Location: /thank-you');
    exit;
}

// Collect + trim input
$name    = trim($_POST['name']    ?? '');
$email   = trim($_POST['email']   ?? '');
$subject = trim($_POST['subject'] ?? '');
$message = trim($_POST['message'] ?? '');
$source  = trim($_POST['source']  ?? '');   // hidden field: which page/form

// Where to send the visitor back to on error (defaults to the contact page).
// Only allow same-site relative paths to prevent open-redirect abuse.
$return = $_POST['return'] ?? '/contact.html';
if ($return === '' || $return[0] !== '/' || strpos($return, '//') !== false) {
    $return = '/contact.html';
}

// Validate
$errors = [];
if ($name === '')                                       $errors[] = 'name';
if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = 'email';
if ($message === '')                                    $errors[] = 'message';

if ($errors) {
    header('Location: ' . $return . '?error=1#contact-form');
    exit;
}

// Strip newlines from header-bound fields to prevent header injection
$cleanName    = str_replace(["\r", "\n"], ' ', $name);
$cleanSource  = str_replace(["\r", "\n"], ' ', $source);
$cleanSubject = str_replace(["\r", "\n"], ' ', $subject);
if ($cleanSubject === '') {
    $cleanSubject = 'New enquiry' . ($cleanSource ? " ($cleanSource)" : '');
}

$body  = "New enquiry from marina.studio\n\n";
$body .= "Name:    $cleanName\n";
$body .= "Email:   $email\n";
if ($cleanSource) $body .= "Source:  $cleanSource\n";
$body .= "Subject: $cleanSubject\n\n";
$body .= "Message:\n$message\n";

$headers  = "From: Marina STUDIO <$from>\r\n";
$headers .= "Reply-To: $cleanName <$email>\r\n";
$headers .= "Content-Type: text/plain; charset=UTF-8\r\n";

$sent = mail($to, $subjectPrefix . $cleanSubject, $body, $headers);

if ($sent) {
    header('Location: /thank-you');
} else {
    header('Location: ' . $return . '?error=1#contact-form');
}
exit;

/*
 * RELIABLE DELIVERY (recommended upgrade):
 * Shared-host mail() often lands in spam. To send via your domain mailbox over
 * SMTP, install PHPMailer and replace the mail() call above. Ask and I can
 * provide the PHPMailer version with your cPanel SMTP settings.
 */
