<?php
	$search = "";
	if ($_POST) {
		if (isset($_POST["schClients"])) {
			$search = trim($_POST["schClients"]);
		}
	}

//! On récupère la liste des clients
	if ($search != "") {
		// SÉCURITÉ : Utilisation de requêtes préparées pour éviter l'injection SQL
		try {
			$db = Database::getInstance();
			$sql = 'SELECT c.* FROM clients c 
					WHERE c.libelle LIKE :search 
					   OR c.adresse1 LIKE :search 
					   OR c.cp LIKE :search 
					   OR c.ville LIKE :search 
					   OR c.contact_nom LIKE :search 
					   OR c.contact_prenom LIKE :search 
					   OR c.contact_fonction LIKE :search 
					ORDER BY c.libelle';
			
			$stmt = $db->prepare($sql);
			$searchParam = '%' . $search . '%';
			$stmt->bindParam(':search', $searchParam, PDO::PARAM_STR);
			$stmt->execute();
			$aModel["clients"] = $stmt->fetchAll(PDO::FETCH_ASSOC);
		} catch (Exception $e) {
			error_log("Erreur recherche clients : " . $e->getMessage());
			$aModel["clients"] = [];
		}
	} else {
		$sql = 'SELECT c.* FROM clients c ORDER BY c.libelle';
		$aModel["clients"] = getinfos($sql, "gen");
	}