<?php
require_once '../config.php';

$id = (int)$_POST['id'];
$field = $_POST['field'];
$value = $_POST['value'];

/* SECURITY */
$allowed = [
'product_name',
'generic_name',
'brand_name',
'country',
'packet_qty',
'units_packet',
'price_packet',
'gst_percent',
'tax_percent'
];

if(!in_array($field,$allowed)){
    exit("Invalid");
}

/* NUMBER FIELDS */
if(in_array($field,['packet_qty','units_packet','price_packet','gst_percent','tax_percent'])){
    if(!is_numeric($value)){
        exit("Invalid number");
    }
}

$stmt = $conn->prepare("UPDATE sample_products SET $field=? WHERE id=?");
$stmt->bind_param("si",$value,$id);

if($stmt->execute()){
    echo "OK";
}else{
    echo "Error";
}