📄 messages.php

<?php
require_once __DIR__ . '/../includes/functions.php';
requireAdmin();
require __DIR__ . '/includes/ui.php';
$pageTitle = 'Contact Messages';

if ($_SERVER['REQUEST_METHOD'] === 'POST' && csrfVerify($_POST['csrf_token'] ?? null)) {
    $action = $_POST['action'] ?? '';
    $id = (int) ($_POST['id'] ?? 0);
    if ($action === 'mark_read') {
        db()->prepare('UPDATE contact_messages SET is_read = 1 WHERE id = ?')->execute([$id]);
    } elseif ($action === 'delete') {
        db()->prepare('DELETE FROM contact_messages WHERE id = ?')->execute([$id]);
        flash('success', 'Message deleted.');
    }
    redirect('messages.php');
}

require __DIR__ . '/includes/admin-header.php';
adminFlashBox();
$messages = db()->query('SELECT * FROM contact_messages ORDER BY created_at DESC')->fetchAll();
?>
<div class="bg-white rounded-2xl border border-gray-100 overflow-hidden">
  <table class="w-full text-sm text-left">
    <thead class="bg-gray-50 text-xs uppercase text-gray-500">
      <tr><th class="px-4 py-3">From</th><th class="px-4 py-3">Subject</th><th class="px-4 py-3">Message</th><th class="px-4 py-3">Received</th><th class="px-4 py-3"></th></tr>
    </thead>
    <tbody class="divide-y divide-gray-100">
      <?php foreach ($messages as $m): ?>
        <tr class="<?= $m['is_read'] ? '' : 'bg-blue-50/40 font-medium' ?>">
          <td class="px-4 py-3">
            <?= e($m['name']) ?><br />
            <span class="text-xs text-gray-500"><?= e($m['email']) ?><?= $m['phone'] ? ' · ' . e($m['phone']) : '' ?></span>
          </td>
          <td class="px-4 py-3 text-gray-600"><?= e($m['subject'] ?: '—') ?></td>
          <td class="px-4 py-3 text-gray-600 max-w-sm"><?= nl2br(e($m['message'])) ?></td>
          <td class="px-4 py-3 text-xs text-gray-400 whitespace-nowrap"><?= e($m['created_at']) ?></td>
          <td class="px-4 py-3 text-right space-y-1">
            <?php if (!$m['is_read']): ?>
              <form method="post"><input type="hidden" name="csrf_token" value="<?= e(csrfToken()) ?>" /><input type="hidden" name="action" value="mark_read" /><input type="hidden" name="id" value="<?= (int) $m['id'] ?>" /><button class="text-primary text-xs font-semibold block">Mark read</button></form>
            <?php endif; ?>
            <form method="post" onsubmit="return confirm('Delete this message?');"><input type="hidden" name="csrf_token" value="<?= e(csrfToken()) ?>" /><input type="hidden" name="action" value="delete" /><input type="hidden" name="id" value="<?= (int) $m['id'] ?>" /><button class="text-red-600 text-xs font-semibold block">Delete</button></form>
          </td>
        </tr>
      <?php endforeach; ?>
      <?php if (!$messages): ?><tr><td colspan="5" class="px-4 py-10 text-center text-gray-400">No messages yet.</td></tr><?php endif; ?>
    </tbody>
  </table>
</div>
<?php require __DIR__ . '/includes/admin-footer.php'; ?>