fitme3070.pt/site/inscricao.php

<?php
// POST handler for the membership "Inscrever" modal on the homepage.
// Stores the request in membership_leads (backoffice: Mensalidades → Pedidos de
// inscrição), emails the gym like the trial-class modal does, then redirects
// back to #mensalidades with ?inscricao=ok|erro for the homepage to render.
// The lead is saved before the email is attempted, so a mail failure never
// loses a request.
//
// Reached via .htaccess: ^home/inscricao/?$ → site/inscricao.php
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../config/functions.php';

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') {
    header('Location: ' . base_url('home#mensalidades'));
    exit;
}

csrf_check(); // 403s and exits on a bad/missing token

function inscricao_redirect(string $status): void {
    header('Location: ' . base_url('home?inscricao=' . $status . '#mensalidades'));
    exit;
}

// Honeypot: a filled "website" field means a bot — pretend success, store nothing.
if (trim((string) ($_POST['website'] ?? '')) !== '') inscricao_redirect('ok');

$consent_text = 'Autorizo o contacto e o tratamento dos meus dados para efeitos desta inscrição, nos termos da Política de Privacidade.';
$membership   = db_memberships_get($pdo, (int) ($_POST['membership_id'] ?? 0));
if ($membership && ($membership['deleted_at'] !== null || !$membership['is_active'])) $membership = null;

$lead = [
    'membership_id'   => $membership ? (int) $membership['id'] : null,
    'membership_name' => $membership ? $membership['name'] : '',
    'name'            => trim((string) ($_POST['nome'] ?? '')),
    'phone'           => trim((string) ($_POST['telefone'] ?? '')),
    'email'           => trim((string) ($_POST['email'] ?? '')),
    'message'         => trim((string) ($_POST['mensagem'] ?? '')),
    'consent'         => !empty($_POST['consent']) ? 1 : 0,
    'consent_text'    => $consent_text,
    // IP real atrás do proxy (config/env.php) — o primeiro valor do
    // X-Forwarded-For é escrito pelo cliente.
    'ip'              => client_ip(),
    'user_agent'      => (string) ($_SERVER['HTTP_USER_AGENT'] ?? ''),
];

if ($lead['name'] === '' || $lead['phone'] === '' || !$lead['consent']
    || ($lead['email'] !== '' && !filter_var($lead['email'], FILTER_VALIDATE_EMAIL))) {
    inscricao_redirect('erro');
}

try {
    db_membership_lead_create($pdo, $lead);
} catch (Throwable $e) {
    error_log('[inscricao] ' . $e->getMessage());
    inscricao_redirect('erro');
}

// Notify the gym. Best effort: the request is already stored.
try {
    $info = site_info($pdo);
    $to   = $info['email'] !== '' ? $info['email'] : EMAIL_FROM;
    $e    = static fn($v) => htmlspecialchars((string) $v, ENT_QUOTES, 'UTF-8');
    $rows = [
        'Mensalidade' => $lead['membership_name'],
        'Nome'        => $lead['name'],
        'Telemóvel'   => $lead['phone'],
        'E-mail'      => $lead['email'],
        'Mensagem'    => $lead['message'],
    ];
    $body = '<h2 style="margin:0 0 16px;">Novo pedido de inscrição</h2><table cellpadding="6" style="border-collapse:collapse;font-family:Arial,sans-serif;font-size:14px;">';
    $alt  = "Novo pedido de inscrição\n\n";
    foreach ($rows as $label => $value) {
        if (trim((string) $value) === '') continue;
        $body .= '<tr><td style="font-weight:bold;vertical-align:top;">' . $e($label) . ':</td><td>' . nl2br($e($value)) . '</td></tr>';
        $alt  .= "$label: $value\n";
    }
    $body .= '</table><p style="font-family:Arial,sans-serif;font-size:13px;color:#666;margin-top:18px;">'
           . 'Pedido guardado no backoffice (Mensalidades → Pedidos de inscrição).</p>';

    $id = enqueue_email([
        'to_address'   => $to,
        'to_name'      => $info['name'] !== '' ? $info['name'] : APP_NAME,
        'subject'      => 'Pedido de inscrição' . ($lead['membership_name'] !== '' ? ' (' . $lead['membership_name'] . ')' : '') . ' — ' . $lead['name'],
        'body'         => $body,
        'alt_body'     => $alt,
        'context_type' => 'fitme_inscricao',
    ]);
    flush_message($id);
} catch (Throwable $e) {
    error_log('[inscricao] email: ' . $e->getMessage());
}

inscricao_redirect('ok');