TimeKeeper/tk_stats_page.php

<?php

/**
 * Kiosk-style score page: tk_stats_page.php?user=<name>
 *
 * Changes from the current repo version:
 *  - ?user= must be a plain username; it is escaped for SQL and for HTML
 *  - optional shared secret: if the plugin pref `stats_key` is set, the page
 *    needs ?key=<that value>. Until it is set the page stays open to anyone,
 *    as before (it shows a student's scores and remaining minutes)
 *  - an unknown user no longer crashes (count(false) is fatal on PHP 8)
 *  - one GROUP BY query replaces the hand-built UNION; no subjects no longer
 *    produces invalid SQL or undefined-variable notices
 *  - a student with exactly 1 answer today now also gets the "games enabled"
 *    line (the singular branch skipped it)
 *  - `e107.e107_tkReport` -> MPREFIX; removed the leftover print_r('hi')
 */

if (!defined('e107_INIT')) {
    require_once('../../class2.php');
}
if (!e107::isInstalled('timekeeper')) {
    return '';
}

// Optional shared secret (plugin pref `stats_key`).
$requiredKey = (string) e107::getPlugPref('timekeeper', 'stats_key', '');
if ($requiredKey !== '' && !hash_equals($requiredKey, (string) filter_input(INPUT_GET, 'key'))) {
    http_response_code(403);
    exit;
}

$userName = filter_input(INPUT_GET, 'user');
if (!is_string($userName) || !preg_match('/^[A-Za-z0-9_.-]{1,50}$/', $userName)) {
    exit;
}

$sql = e107::getDb();
$u = $sql->escape($userName);
$reportTable = '`' . MPREFIX . 'tkReport`';

// Settings row (unknown users show nothing).
$settings = $sql->retrieve('timekeeper', '*', 'username="' . $u . '"');
if (!is_array($settings)) {
    exit;
}

$minQuestions = (int) $settings['minQuestionCount'];

// Score per subject, all time.
$sql->gen("SELECT `subject`, COUNT(id) AS `count`,
        CAST((SUM(correct) / COUNT(id) * 100) AS DECIMAL(5,2)) AS percent
    FROM $reportTable WHERE `username` = '$u' GROUP BY `subject` ORDER BY `subject`");

$subjectRows = [];
while ($row = $sql->fetch()) {
    $subjectRows[] = $row;
}

$safeUser = htmlspecialchars($userName, ENT_QUOTES, 'UTF-8');

$text = '<div><h1>Score for ' . $safeUser . '</h1>';
$text .= "<table style='width:100%;text-align:center;'>"
        . "<thead><tr><td style='text-align:left'>Subject</td><td>Score</td><td>No.Questions</td></tr></thead>"
        . "<tbody>";

foreach ($subjectRows as $row) {
    $text .= "<tr><td style='text-align:left'>" . htmlspecialchars(ucfirst($row['subject']), ENT_QUOTES, 'UTF-8') . '</td><td>' . htmlspecialchars($row['percent']) . '%</td><td>' . (int) $row['count'] . '</td></tr>';
}

$text .= '</tbody></table>';

// Today.
$sql->gen("SELECT COUNT(id) AS cntr, CAST((SUM(correct)/COUNT(id)*100) AS DECIMAL(5,2)) AS percent
    FROM $reportTable WHERE username = '$u'
    AND answereddatestamp >= UNIX_TIMESTAMP(CURRENT_DATE())
    AND answereddatestamp <= UNIX_TIMESTAMP(CURRENT_DATE() + INTERVAL 1 DAY)");

$today = $sql->fetch();
$answeredToday = is_array($today) ? (int) $today['cntr'] : 0;

if ($answeredToday > 0) {
    $percent = htmlspecialchars($today['percent']);

    if ($answeredToday === 1) {
        $text .= '<p>1 question has been answered<br/>today with ' . $percent . '% accuracy.</p><br/>';
    } else {
        $text .= '<p>' . $answeredToday . ' questions have been answered<br/>today with ' . $percent . '% accuracy.</p><br/>';
    }

    if ($minQuestions <= $answeredToday) {
        $text .= '<label style="background: darkgreen;">Games enabled</label><br/>';
        $currentScore = $sql->retrieve('timekeeperScore', 'timekeeper_lifetimecorrect, timekeeper_lifetimequestions, timekeeper_minutes', 'timekeeper_username="' . $u . '"');
        $minutes = is_array($currentScore) ? (int) $currentScore['timekeeper_minutes'] : 0;
        $text .= '<label>You have ' . $minutes . ' minutes remaining.</label>';
    } else {
        $text .= '<label>Games disabled</label>';
    }
}

$text .= '</div>';

echo '<!DOCTYPE html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="60"></head>'
        . '<body style="background-color: #1a0000;color:white;">' . $text . '</body></html>';