false, 'message' => 'ไม่พบรหัสร้านค้าสำหรับการสั่งซื้อ']);
exit;
}
if (empty($table_number)) {
echo json_encode(['success' => false, 'message' => 'กรุณาระบุหมายเลขโต๊ะเพื่อส่งออเดอร์']);
exit;
}
if (empty($cart_items) || !is_array($cart_items)) {
echo json_encode(['success' => false, 'message' => 'ไม่มีรายการอาหารในตะกร้าสินค้า']);
exit;
}
// Session-Based Rate Limiting & Cooldown Protection (15-Second Anti-Spam Rule)
$cooldown_seconds = 15;
$last_order_ts = (int)($_SESSION['last_order_timestamp'] ?? 0);
$time_diff = time() - $last_order_ts;
if ($last_order_ts > 0 && $time_diff < $cooldown_seconds) {
$remaining = $cooldown_seconds - $time_diff;
http_response_code(429);
echo json_encode([
'success' => false,
'rate_limited' => true,
'remaining_seconds' => $remaining,
'message' => "กรุณารอสักครู่ ({$remaining} วินาที) ก่อนทำการส่งคำสั่งซื้อเพิ่ม (Anti-Spam Cooldown)"
]);
exit;
}
try {
$pdo->beginTransaction();
$payment_method = isset($_POST['payment_method']) ? trim($_POST['payment_method']) : 'cash';
$is_paid = ($payment_method === 'transfer') ? 1 : 0;
$raw_voucher = trim($data['voucher'] ?? ($_POST['voucher'] ?? ''));
$voucher = !empty($raw_voucher) ? substr($raw_voucher, 0, 50) : null;
$stmt = $pdo->prepare("INSERT INTO orders (store_id, table_number, status, payment_method, is_paid, voucher) VALUES (:store_id, :table_number, 'pending', :payment_method, :is_paid, :voucher)");
$stmt->execute([
':store_id' => $store_id,
':table_number' => $table_number,
':payment_method' => $payment_method,
':is_paid' => $is_paid,
':voucher' => $voucher
]);
$order_id = $pdo->lastInsertId();
$stmt_item = $pdo->prepare("INSERT INTO order_items (order_id, menu_id, quantity, price, note, spice_level) VALUES (:order_id, :menu_id, :quantity, :price, :note, :spice_level)");
$stmt_prod = $pdo->prepare("SELECT price FROM menus WHERE menu_id = :id");
foreach ($cart_items as $ci) {
$menu_id = intval($ci['id'] ?? ($ci['menu_id'] ?? 0));
$qty = intval($ci['qty'] ?? ($ci['quantity'] ?? 1));
$price = floatval($ci['price'] ?? 0);
$note = trim($ci['note'] ?? '');
$spice = trim($ci['spice_level'] ?? 'เผ็ดปกติ');
if ($menu_id <= 0 || $qty <= 0) continue;
$stmt_prod->execute([':id' => $menu_id]);
$prod = $stmt_prod->fetch(PDO::FETCH_ASSOC);
if ($prod) {
$price = floatval($prod['price']);
}
$stmt_item->execute([
':order_id' => $order_id,
':menu_id' => $menu_id,
':quantity' => $qty,
':price' => $price,
':note' => $note,
':spice_level' => $spice
]);
}
$pdo->commit();
$_SESSION['last_order_timestamp'] = time();
echo json_encode([
'success' => true,
'message' => 'สั่งอาหารสำเร็จแล้ว! รายการถูกส่งเข้าห้องครัวเรียบร้อย',
'order_id' => $order_id,
'table_number' => $table_number
]);
exit;
} catch (Exception $e) {
if ($pdo->inTransaction()) $pdo->rollBack();
echo json_encode(['success' => false, 'message' => 'เกิดข้อผิดพลาดในการบันทึกออเดอร์: ' . $e->getMessage()]);
exit;
}
}
// 2. Fetch Store & Menu Items for Page Rendering
$store_id = intval($_GET['store_id'] ?? ($_GET['shop_id'] ?? ($_SESSION['scanned_store_id'] ?? 1)));
$table_number = trim($_GET['table'] ?? ($_SESSION['scanned_table'] ?? '1'));
$_SESSION['scanned_store_id'] = $store_id;
$_SESSION['scanned_table'] = $table_number;
$stmt_store = $pdo->prepare("SELECT * FROM tenants WHERE store_id = :id AND status = 'active'");
$stmt_store->execute([':id' => $store_id]);
$store_info = $stmt_store->fetch(PDO::FETCH_ASSOC);
if (!$store_info) {
$store_info = [
'store_id' => $store_id,
'store_name' => 'ร้านอาหาร CMTC Tech Solution',
'address' => 'ศูนย์บริการสั่งอาหารออนไลน์',
'custom_logo_url' => 'logo.png',
'store_banner_url' => 'https://images.unsplash.com/photo-1555396273-367ea4eb4db5?w=1200&auto=format&fit=crop&q=80'
];
}
$stmt_menus = $pdo->prepare("SELECT menu_id as id, name as menu_name, price, category, description, image_url, is_available, sort_order FROM menus WHERE store_id = :store_id AND is_available = 1 ORDER BY sort_order ASC, menu_id DESC");
$stmt_menus->execute([':store_id' => $store_id]);
$menus = $stmt_menus->fetchAll(PDO::FETCH_ASSOC);
if (empty($menus)) {
$stmt_fallback = $pdo->query("SELECT menu_id as id, name as menu_name, price, category, description, image_url, is_available FROM menus WHERE is_available = 1 LIMIT 10");
$menus = $stmt_fallback->fetchAll(PDO::FETCH_ASSOC);
}
?>
<?php echo htmlspecialchars($store_info['store_name'] ?? 'ระบบสั่งอาหาร'); ?> - Order Gateway
🍽️ เมนูอาหารพร้อมเสิร์ฟ
; ?>){kind=logo}