📄 contact_messages.php

<?php
require_once __DIR__ . '/../includes/auth.php';
require_login();
$pageTitle = 'Contact Messages';

if ($_SERVER['REQUEST_METHOD'] === 'POST' && csrf_verify()) {
    $action = $_POST['action'] ?? '';
    if ($action === 'update_status') {
        $stmt = db()->prepare('UPDATE contact_messages SET status = ? WHERE id = ?');
        $stmt->execute([$_POST['status'] ?? 'new', (int) ($_POST['id'] ?? 0)]);
    } elseif ($action === 'delete') {
        $stmt = db()->prepare('DELETE FROM contact_messages WHERE id = ?');
        $stmt->execute([(int) ($_POST['id'] ?? 0)]);
        flash_set('success', 'Message deleted.');
    }
    redirect('contact_messages.php');
}

$messages = db()->query('SELECT * FROM contact_messages ORDER BY created_at DESC')->fetchAll();

require __DIR__ . '/partials/header.php';
require __DIR__ . '/partials/sidebar.php';
require __DIR__ . '/partials/topbar.php';
?>

<div class="bg-white rounded-2xl shadow-sm overflow-hidden">
  <div class="overflow-x-auto">
    <table class="w-full text-sm">
      <thead class="bg-gray-50"><tr class="text-left text-gray-400">
        <th class="px-5 py-3 font-medium">Name</th>
        <th class="px-5 py-3 font-medium">Contact</th>
        <th class="px-5 py-3 font-medium">Message</th>
        <th class="px-5 py-3 font-medium">Date</th>
        <th class="px-5 py-3 font-medium">Status</th>
        <th class="px-5 py-3 font-medium text-right">Actions</th>
      </tr></thead>
      <tbody>
        <?php if (!$messages): ?>
          <tr><td colspan="6" class="px-5 py-8 text-center text-gray-400">No messages yet.</td></tr>
        <?php endif; ?>
        <?php foreach ($messages as $m): ?>
        <tr class="border-t border-gray-100 hover:bg-gray-50/60 align-top">
          <td class="px-5 py-3 font-medium"><?= e($m['name']) ?></td>
          <td class="px-5 py-3 text-gray-500"><?= e($m['phone']) ?><br><?= e($m['email']) ?></td>
          <td class="px-5 py-3 text-gray-500 max-w-sm"><?= e($m['message']) ?></td>
          <td class="px-5 py-3 text-gray-400 whitespace-nowrap"><?= e(date('d M Y', strtotime($m['created_at']))) ?></td>
          <td class="px-5 py-3">
            <form method="post" class="inline">
              <?= csrf_field() ?>
              <input type="hidden" name="action" value="update_status">
              <input type="hidden" name="id" value="<?= (int) $m['id'] ?>">
              <select name="status" onchange="this.form.submit()" class="text-xs rounded-full border border-gray-300 px-2 py-1">
                <?php foreach (['new','read','replied'] as $st): ?>
                  <option value="<?= $st ?>" <?= $m['status'] === $st ? 'selected' : '' ?>><?= ucfirst($st) ?></option>
                <?php endforeach; ?>
              </select>
            </form>
          </td>
          <td class="px-5 py-3 text-right whitespace-nowrap">
            <form method="post" class="inline" onsubmit="return confirm('Delete this message?');">
              <?= csrf_field() ?>
              <input type="hidden" name="action" value="delete">
              <input type="hidden" name="id" value="<?= (int) $m['id'] ?>">
              <button type="submit" class="text-brand-red hover:text-red-700"><i class="fa-solid fa-trash"></i></button>
            </form>
          </td>
        </tr>
        <?php endforeach; ?>
      </tbody>
    </table>
  </div>
</div>

<?php require __DIR__ . '/partials/footer.php'; ?>