Fix SPBU status writes

01/database_01.sql

@@ -0,0 +1,19 @@
+-- Database untuk project 01/04: GIS SPBU
+CREATE DATABASE IF NOT EXISTS gis_spbu
+  CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+USE gis_spbu;
+
+CREATE TABLE IF NOT EXISTS spbu (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    nama_spbu VARCHAR(150) NOT NULL,
+    no_wa VARCHAR(30) NOT NULL,
+    status ENUM('yes','no') NOT NULL DEFAULT 'no',
+    latitude DECIMAL(10,8) NOT NULL,
+    longitude DECIMAL(11,8) NOT NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+ALTER TABLE spbu
+    MODIFY status ENUM('yes','no') NOT NULL DEFAULT 'no';

01/edit.php

@@ -1,14 +1,24 @@
 <?php
 include 'koneksi.php';
 
-$id = $_POST['id'];
-$nama = $_POST['nama'];
-$wa = $_POST['wa'];
-$status = $_POST['status'];
+$id = (int)($_POST['id'] ?? 0);
+$nama = trim($_POST['nama'] ?? '');
+$wa = trim($_POST['wa'] ?? '');
+$status = $_POST['status'] ?? 'no';
 
-$conn->query("UPDATE spbu SET 
-nama_spbu='$nama',
-no_wa='$wa',
-status='$status'
-WHERE id=$id");
-?>
+if (!in_array($status, ['yes', 'no'], true)) {
+    http_response_code(400);
+    echo "Status tidak valid";
+    exit;
+}
+
+try {
+    $stmt = $conn->prepare("UPDATE spbu SET nama_spbu=?, no_wa=?, status=? WHERE id=?");
+    $stmt->bind_param('sssi', $nama, $wa, $status, $id);
+    $stmt->execute();
+    echo "success";
+} catch (mysqli_sql_exception $e) {
+    http_response_code(500);
+    echo "error: " . $e->getMessage();
+}
+?>

01/simpan.php

@@ -1,18 +1,25 @@
 <?php
 include 'koneksi.php';
 
-$nama = $_POST['nama_spbu'];
-$wa = $_POST['no_wa'];
-$status = $_POST['status'];
-$lat = $_POST['latitude'];
-$lng = $_POST['longitude'];
+$nama = trim($_POST['nama_spbu'] ?? '');
+$wa = trim($_POST['no_wa'] ?? '');
+$status = $_POST['status'] ?? 'no';
+$lat = (float)($_POST['latitude'] ?? 0);
+$lng = (float)($_POST['longitude'] ?? 0);
 
-$sql = "INSERT INTO spbu (nama_spbu, no_wa, status, latitude, longitude)
-        VALUES ('$nama', '$wa', '$status', '$lat', '$lng')";
-
-if ($conn->query($sql)) {
-    echo "success";
-} else {
-    echo "error";
+if (!in_array($status, ['yes', 'no'], true)) {
+    http_response_code(400);
+    echo "Status tidak valid";
+    exit;
 }
-?>
+
+try {
+    $stmt = $conn->prepare("INSERT INTO spbu (nama_spbu, no_wa, status, latitude, longitude) VALUES (?, ?, ?, ?, ?)");
+    $stmt->bind_param('sssdd', $nama, $wa, $status, $lat, $lng);
+    $stmt->execute();
+    echo "success";
+} catch (mysqli_sql_exception $e) {
+    http_response_code(500);
+    echo "error: " . $e->getMessage();
+}
+?>