<?php
require 'koneksi.php';

// Ambil data dari form dengan sanitasi
$nama  = mysqli_real_escape_string($conn, $_POST['nama_petugas']);
$user  = mysqli_real_escape_string($conn, $_POST['username']);
$pass  = password_hash($_POST['password'], PASSWORD_DEFAULT); // Enkripsi password
$telp  = mysqli_real_escape_string($conn, $_POST['telp']);
$level = mysqli_real_escape_string($conn, $_POST['level']);

// Query insert dengan prepared statement
$stmt = $conn->prepare("INSERT INTO petugas (nama_petugas, username, password, telp, level) VALUES (?, ?, ?, ?, ?)");
$stmt->bind_param("sssss", $nama, $user, $pass, $telp, $level);

if ($stmt->execute()) {
    echo "<script>
        alert('Data Berhasil Disimpan');
        window.location='admin.php?url=lihat_petugas';
    </script>";
} else {
    echo "<script>
        alert('Gagal menyimpan data: " . $stmt->error . "');
        window.history.back();
    </script>";
}

$stmt->close();
$conn->close();
?>
