ViewOrderDetails.php

<?php

include_once('./functions.php');

// did the user provided an OrderID via the URL?
if (isset($_GET['OrderID'])) {
	$UnsafeOrderID = $_GET['OrderID'];

	$dbh = connectToDatabase();

	// select the order details and customer details. (you need to use an INNER JOIN)
	// but only show the row WHERE the OrderID is equal to $UnsafeOrderID.
	$statement = $dbh->prepare('
	SELECT * 
	FROM Orders 
	INNER JOIN Customers ON Customers.CustomerID = Orders.CustomerID 
	WHERE OrderID = ? ; 
');
	$statement->bindValue(1, $UnsafeOrderID);
	$statement->execute();

	// did we get any results?
	if ($row1 = $statement->fetch(PDO::FETCH_ASSOC)) {
		// Output the Order Details.
		$FirstName = makeOutputSafe($row1['FirstName']);
		$LastName = makeOutputSafe($row1['LastName']);
		$OrderID = makeOutputSafe($row1['OrderID']);
		$UserName = makeOutputSafe($row1['UserName']);

		// TODO: select all the products that are in this order (you need to use INNER JOIN)
		// this will involve three tables: OrderProducts, Products and Brands.
		$statement2 = $dbh->prepare('
		
		SELECT * FROM Orders AS O
		INNER JOIN OrderProducts AS OP ON O.OrderID = OP.OrderID
		INNER JOIN Products AS P ON P.ProductID = OP.ProductID
		INNER JOIN Brands AS B ON P.BrandID = B.BrandID
		INNER JOIN Customers AS C ON O.CustomerID = C.CustomerID
		WHERE O.OrderID = ? ;
		');
		$statement2->bindValue(1, $UnsafeOrderID);
		$statement2->execute();

		$rows = $statement2->fetchAll(PDO::FETCH_ASSOC);

		include("./views/partials/navbar.php");
		include("./views/partials/head.php");
		$heading = "Order Details";
		$bannerMessage = "Showing the details of the order.";
		// $marqueeDuration = 9;
		include("./views/partials/banner.php");
		include "./views/ViewOrderDetails.view.php";
	} else {
		include "./views/partials/head.php";
		include "./views/Error.view.php";
	}
} else {
	include "./views/partials/head.php";
	include "./views/Error.view.php";
}