📄 lead_submit.php

<?php
require_once __DIR__ . '/includes/functions.php';

$referer = $_SERVER['HTTP_REFERER'] ?? 'index.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    redirect('index.php');
}

// Honeypot: bots fill every field, real users never see/fill this hidden input.
if (!empty($_POST['hp_field'])) {
    redirect($referer . (str_contains($referer, '?') ? '&' : '?') . 'lead=1');
}

if (!csrf_verify()) {
    redirect($referer . (str_contains($referer, '?') ? '&' : '?') . 'lead=error');
}

$name = trim($_POST['name'] ?? '');
$phone = trim($_POST['phone'] ?? '');
$email = trim($_POST['email'] ?? '');

if ($name === '' || $phone === '') {
    redirect($referer . (str_contains($referer, '?') ? '&' : '?') . 'lead=error');
}

$stmt = db()->prepare('INSERT INTO leads (name, phone, email, interested_country, interested_course, message, source_page) VALUES (?, ?, ?, ?, ?, ?, ?)');
$stmt->execute([
    $name,
    $phone,
    $email,
    trim($_POST['interested_country'] ?? ''),
    trim($_POST['interested_course'] ?? ''),
    trim($_POST['message'] ?? ''),
    trim($_POST['source_page'] ?? basename($referer)),
]);

redirect($referer . (str_contains($referer, '?') ? '&' : '?') . 'lead=1');