fix delibration and below 60

Fixed the date shift by making date-only strings stay in the user timezone...

See merge request root/alrahma_sunday_school!5

.env

@@ -1,180 +0,0 @@
-#--------------------------------------------------------------------
-# Example Environment Configuration file
-#
-# This file can be used as a starting point for your own
-# custom .env files, and contains most of the possible settings
-# available in a default install.
-#
-# By default, all of the settings are commented out. If you want
-# to override the setting, you must un-comment it by removing the '#'
-# at the beginning of the line.
-#--------------------------------------------------------------------
-
-#--------------------------------------------------------------------
-# ENVIRONMENT
-#--------------------------------------------------------------------
-
-CI_ENVIRONMENT = development
-
-# Which profile to use if none is supplied to sendEmail()
-# Options: default, communication, payment, ...
-MAIL_PROFILE_DEFAULT=default
-
-# ===== DEFAULT (system) =====
-# ---- Legacy fallbacks (kept for compatibility) ----
-SMTP_HOST = smtp.gmail.com
-SMTP_USER = alrahma.sunday.school@gmail.com
-SMTP_PASS = "psnp emdq dykw ypul"
-SMTP_PORT = 587
-SMTP_ENCRYPTION = tls  # was SSL; set to ssl to match 587
-
-# Reply-To for all mail profiles
-MAIL_DEFAULT_REPLY_TO=alrahma.isgl@gmail.com
-MAIL_DEFAULT_REPLY_TO_NAME="Al Rahma Sunday School"
-MAIL_COMMUNICATION_REPLY_TO=alrahma.isgl@gmail.com
-MAIL_COMMUNICATION_REPLY_TO_NAME="School Communications"
-MAIL_PAYMENT_REPLY_TO=alrahma.isgl@gmail.com
-MAIL_PAYMENT_REPLY_TO_NAME="School Payments"
-MAIL_DEFAULT_REPLY_TO="alrahma.isgl@gmail.com"
-
-# Optional sender directory you already use elsewhere
-MAIL_SENDERS="{\"general\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma No-Reply\"},\
-\"registration\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Register Office\"},\
-\"notifications\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Notifications\"},\
-\"finance\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Finance Office\"}}"
-
-# Principal notification recipient for TimeOff requests (comma-separated allowed)
-PRINCIPAL_EMAIL="principal@alrahmaisgl.org"
-
-#--------------------------------------------------------------------
-# APP
-#--------------------------------------------------------------------
-
-# If you have trouble with `.`, you could also use `_`.
- app_baseURL = 'http://localhost:8080/'
-# app.forceGlobalSecureRequests = true
-# app.CSPEnabled = false
-
-#--------------------------------------------------------------------
-# DATABASE
-#--------------------------------------------------------------------
-database.default.hostname = 127.0.0.1
-database.default.database = school
-database.default.username = root
-database.default.password = root
-database.default.DBDriver = MySQLi
-database.default.DBPrefix =
-database.default.port = 3306
-
-
-#--------------------------------------------------------------------
-# CONTENT SECURITY POLICY
-#--------------------------------------------------------------------
-
-# contentsecuritypolicy.reportOnly = false
-# contentsecuritypolicy.defaultSrc = 'none'
-# contentsecuritypolicy.scriptSrc = 'self'
-# contentsecuritypolicy.styleSrc = 'self'
-# contentsecuritypolicy.imageSrc = 'self'
-# contentsecuritypolicy.baseURI = null
-# contentsecuritypolicy.childSrc = null
-# contentsecuritypolicy.connectSrc = 'self'
-# contentsecuritypolicy.fontSrc = null
-# contentsecuritypolicy.formAction = null
-# contentsecuritypolicy.frameAncestors = null
-# contentsecuritypolicy.frameSrc = null
-# contentsecuritypolicy.mediaSrc = null
-# contentsecuritypolicy.objectSrc = null
-# contentsecuritypolicy.pluginTypes = null
-# contentsecuritypolicy.reportURI = null
-# contentsecuritypolicy.sandbox = false
-# contentsecuritypolicy.upgradeInsecureRequests = false
-# contentsecuritypolicy.styleNonceTag = '{csp-style-nonce}'
-# contentsecuritypolicy.scriptNonceTag = '{csp-script-nonce}'
-# contentsecuritypolicy.autoNonce = true
-
-#--------------------------------------------------------------------
-# COOKIE
-#--------------------------------------------------------------------
-
-# cookie.prefix = ''
-# cookie.expires = 0
-# cookie.path = '/'
-# cookie.domain = ''
-# cookie.secure = false
-# cookie.httponly = false
-# cookie.samesite = 'Lax'
-# cookie.raw = false
-
-#--------------------------------------------------------------------
-# ENCRYPTION
-#--------------------------------------------------------------------
-
-# encryption.key =
-# encryption.driver = OpenSSL
-# encryption.blockSize = 16
-# encryption.digest = SHA512
-
-#--------------------------------------------------------------------
-# HONEYPOT
-#--------------------------------------------------------------------
-
-# honeypot.hidden = 'true'
-# honeypot.label = 'Fill This Field'
-# honeypot.name = 'honeypot'
-# honeypot.template = '<label>{label}</label><input type="text" name="{name}" value=""/>'
-# honeypot.container = '<div style="display:none">{template}</div>'
-
-#--------------------------------------------------------------------
-# SECURITY
-#--------------------------------------------------------------------
-
-# security.csrfProtection = 'cookie'
-# security.tokenRandomize = false
-# security.tokenName = 'csrf_token_name'
-# security.headerName = 'X-CSRF-TOKEN'
-# security.cookieName = 'csrf_cookie_name'
-# security.expires = 7200
-# security.regenerate = true
-# security.redirect = false
-# security.samesite = 'Lax'
-
-#--------------------------------------------------------------------
-# SESSION
-#--------------------------------------------------------------------
-
-# session.driver = 'CodeIgniter\Session\Handlers\FileHandler'
-# session.cookieName = 'ci_session'
-# session.expiration = 7200
-# session.savePath = null
-# session.matchIP = false
-# session.timeToUpdate = 300
-# session.regenerateDestroy = false
-
-#--------------------------------------------------------------------
-# LOGGER
-#--------------------------------------------------------------------
-
-# logger.threshold = 4
-
-#--------------------------------------------------------------------
-# CURLRequest
-#--------------------------------------------------------------------
-
-# curlrequest.shareOptions = false
-
-
-
-
-
-mail.protocol  = smtp
-mail.SMTPHost  = ${SMTP_HOST}
-mail.SMTPUser  = ${SMTP_USER}
-mail.SMTPPass  = ${SMTP_PASS}
-mail.SMTPPort  = ${SMTP_PORT}
-mail.SMTPCrypto = tls
-
-mail.fromEmail = ${SMTP_USER}
-mail.fromName  = "Al Rahma Sunday School"
-mail.mailType  = text
-mail.charset   = UTF-8

.gitignore

@@ -0,0 +1,54 @@
+.env
+.env.*
+!.env.example
+
+/vendor/
+/node_modules/
+
+/writable/cache/*
+/writable/debugbar/*
+/writable/logs/*
+/writable/session/*
+/writable/uploads/*
+/writable/tmp/*
+/writable/*.log
+
+!/writable/.gitkeep
+!/writable/cache/.gitkeep
+!/writable/debugbar/.gitkeep
+!/writable/logs/.gitkeep
+!/writable/session/.gitkeep
+!/writable/uploads/.gitkeep
+!/writable/tmp/.gitkeep
+
+/public/build/
+/public/hot/
+/public/uploads/**
+!/public/uploads/**/index.html
+!/public/uploads/.gitkeep
+
+/uploads/**
+!/uploads/**/index.html
+!/uploads/.gitkeep
+
+docker-compose.override.yml
+docker-compose.local.yml
+
+*.log
+.swp
+.swo
+*~
+.tmp
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+.codex/
+
+/coverage/
+/build/
+/builds
+/phpunit.xml.cache
+/.phpunit.result.cache
+/writable/reports/*
+/writable/test.txt

app/Commands/SyncPaypalPayments.php

@@ -36,13 +36,13 @@ class SyncPaypalPayments extends BaseCommand
         $this->invoiceModel   = new InvoiceModel();
         $this->studentModel = new StudentModel();
         $this->enrollmentModel = new EnrollmentModel();
-
-        $this->semester = $this->configModel->getConfig('semester');
-        $this->schoolYear = $this->configModel->getConfig('school_year');
     }
 
     public function run(array $params)
     {
+        $this->semester = (string) ($this->configModel->getConfig('semester') ?? '');
+        $this->schoolYear = (string) ($this->configModel->getConfig('school_year') ?? '');
+
         $dryRun     = CLI::getOption('dry-run');
         $reportOnly = CLI::getOption('report-only');
         $mode       = $reportOnly ? 'REPORT-ONLY' : ($dryRun ? 'DRY-RUN' : 'LIVE');

app/Config/Events.php

@@ -9,6 +9,7 @@ use App\Listeners\SchoolEventListener;
 use App\Listeners\AttendanceConsequenceListener;
 use App\Listeners\WhatsappInviteListener;
 use App\Listeners\BelowSixtyEmailListener;
+use App\Listeners\DecisionEmailListener;
 
 // Create an instance so we can use $this->emailService like your other handlers
 $waListener = new WhatsappInviteListener(service('emailService'));
@@ -118,6 +119,7 @@ Events::on('attendance.follow_up',   [AttendanceConsequenceListener::class, 'fol
 Events::on('attendance.final_warning', [AttendanceConsequenceListener::class, 'finalWarning']);
 Events::on('attendance.dismissal',   [AttendanceConsequenceListener::class, 'dismissal']);
 Events::on('below60.email', [BelowSixtyEmailListener::class, 'handle']);
+Events::on('below60.decision_email', [DecisionEmailListener::class, 'handle']);
 
 //Whatsapp Event listener
 Events::on('whatsapp_invites.send', [$waListener, 'handle']);

app/Config/Filters.php

@@ -24,6 +24,8 @@ class Filters extends BaseConfig
         'honeypot'          => Honeypot::class,
         'invalidchars'      => InvalidChars::class,
         'secureheaders'     => SecureHeaders::class,
+        'sanitizeinput'     => \App\Filters\SanitizeInputFilter::class,
+        'apiratelimit'      => \App\Filters\ApiRateLimitFilter::class,
         'auth'              => \App\Filters\AuthFilter::class, // Define the alias for your auth filter
         'apiAuth'           => \App\Filters\ApiAuthFilter::class, // JWT-based API authentication
         'cleanupScheduler'  => \App\Filters\CleanupScheduler::class,
@@ -42,6 +44,8 @@ class Filters extends BaseConfig
     public array $globals = [
     'before' => [
         'timezone',
+        'sanitizeinput',
+        'invalidchars',
         'csrf' => ['except' => [
             // Webhooks / integrations
             'api/paypal-webhook',
@@ -80,6 +84,7 @@ class Filters extends BaseConfig
         ]],
     ],
     'after' => [
+        'secureheaders',
         'toolbar',
         'cleanupScheduler' => ['except' => ['cleanup/*']],
     ],
@@ -112,7 +117,7 @@ class Filters extends BaseConfig
      * @var array<string, array<string, list<string>>>
      */
     public array $filters = [
-        
+        'apiratelimit' => ['before' => ['api/*', 'index.php/api/*']],
     ];
 
 }

app/Config/Format.php

@@ -9,6 +9,7 @@ use CodeIgniter\Format\XMLFormatter;
 
 class Format extends BaseConfig
 {
+    public int $jsonEncodeDepth = 512;
     /**
      * --------------------------------------------------------------------------
      * Available Response Formats

app/Config/Routes.php

@@ -174,6 +174,18 @@ $routes->group('administrator/subject-curriculum', ['filter' => 'auth:update_cur
     $routes->post('delete/(:num)', 'View\SubjectCurriculumController::delete/$1');
 });
 
+$routes->get('administrator/trophy',              'View\TrophyController::index',   ['filter' => 'auth:admin']);
+$routes->get('administrator/trophy/winners',      'View\TrophyController::winners', ['filter' => 'auth:admin']);
+$routes->get('administrator/trophy/final',        'View\TrophyController::final',   ['filter' => 'auth:admin']);
+
+// Certificates
+$routes->get('administrator/certificates',           'View\CertificateController::index',    ['filter' => 'auth:admin']);
+$routes->get('administrator/certificates/csrf-token', 'View\CertificateController::csrfToken', ['filter' => 'auth:admin']);
+$routes->post('administrator/certificates/generate', 'View\CertificateController::generate', ['filter' => 'auth:admin']);
+$routes->get('administrator/certificates/log',       'View\CertificateController::auditLog',  ['filter' => 'auth:admin']);
+$routes->get('administrator/certificates/reprint/(:any)', 'View\CertificateController::reprint/$1', ['filter' => 'auth:read']);
+$routes->get('verify/(:segment)',                    'View\CertificateController::verify/$1');
+
 
 
 /*
@@ -511,6 +523,14 @@ $routes->post('grading/below-60/email', 'View\GradingController::sendBelowSixtyE
 $routes->post('grading/below-60/status', 'View\GradingController::updateBelowSixtyStatus', ['filter' => 'auth:read']);
 $routes->get('grading/below-60/schedule', 'View\GradingController::scheduleBelowSixty', ['filter' => 'auth:read']);
 $routes->post('grading/below-60/schedule', 'View\GradingController::saveBelowSixtyMeeting', ['filter' => 'auth:read']);
+$routes->get('grading/decisions', 'View\GradingController::allDecisions', ['filter' => 'auth:read']);
+$routes->post('grading/decisions/generate', 'View\GradingController::generateAllDecisions', ['filter' => 'auth:read']);
+$routes->get('grading/below-60/decisions', 'View\GradingController::belowSixtyDecisions', ['filter' => 'auth:read']);
+$routes->post('grading/below-60/decisions/save', 'View\GradingController::saveBelowSixtyDecision', ['filter' => 'auth:read']);
+$routes->get('grading/below-60/decisions/student-details', 'View\GradingController::studentDecisionDetails', ['filter' => 'auth:read']);
+$routes->get('grading/below-60/decisions/email/preview', 'View\GradingController::previewDecisionEmail', ['filter' => 'auth:read']);
+$routes->get('grading/below-60/decisions/email/edit', 'View\GradingController::editDecisionEmail', ['filter' => 'auth:read']);
+$routes->post('grading/below-60/decisions/email', 'View\GradingController::sendDecisionEmail', ['filter' => 'auth:read']);
 
 
 // Final part
@@ -518,6 +538,9 @@ $routes->get('grading/(:segment)/(:num)/(:num)', 'View\GradingController::show/$
 $routes->post('grading/update', 'View\GradingController::update');
 $routes->get('grading', 'View\GradingController::grading');
 $routes->post('grading/toggle-score-lock', 'View\GradingController::toggleScoreLock', ['filter' => 'auth:read']);
+$routes->get('grading/toggle-score-lock', static function () {
+    return 'GET route hit. Something is calling this route incorrectly.';
+});
 $routes->post('grading/lock-all-scores', 'View\GradingController::lockAllScores', ['filter' => 'auth:read']);
 $routes->post('grading/release-scores', 'View\GradingController::toggleParentScoresRelease', ['filter' => 'auth:read']);
 $routes->post('grading/refresh-semester-scores', 'View\GradingController::refreshSemesterScores', ['filter' => 'auth:read']);
@@ -535,6 +558,7 @@ $routes->post('payment/event_charges', 'View\EventController::eventUpdate');
 
 // Parent event participation
 $routes->get('administrator/event-charges', 'View\EventController::eventShow');
+$routes->get('administrator/event-charges/pdf', 'View\EventController::eventChargesPdf');
 $routes->post('administrator/event-charges/remove/(:num)', 'View\EventController::removeCharge/$1');
 $routes->post('administrator/event-charges/payment/(:num)', 'View\EventController::toggleEventPayment/$1');
 $routes->post('administrator/event-charges/waiver/(:num)', 'View\EventController::toggleWaiverStatus/$1');

app/Config/Services.php

@@ -36,7 +36,7 @@ class Services extends BaseService
     /**
      * Override CI Email service to enforce a global Reply-To.
      */
-    public static function email(array $config = null, bool $getShared = true)
+    public static function email(?array $config = null, bool $getShared = true)
     {
         if ($getShared) {
             return static::getSharedInstance('email', $config);

app/Controllers/AuthController.php

@@ -5,7 +5,6 @@ namespace App\Controllers;
 use App\Models\LoginActivityModel;
 use App\Models\UserModel;
 use App\Models\UserRoleModel;
-use CodeIgniter\Controller;
 use CodeIgniter\Events\Events;
 use App\Models\IpAttemptModel;
 use App\Models\PasswordResetModel;
@@ -19,7 +18,7 @@ require_once APPPATH . 'Helpers/pbkdf2_helper.php';
 require_once APPPATH . 'Helpers/jwt_helper.php';
 
 
-class AuthController extends Controller
+class AuthController extends BaseController
 {
     protected $configModel;
     protected $userModel;
@@ -83,9 +82,23 @@ class AuthController extends Controller
         log_message('info', 'Processing login form submission.');
         $redirectTo = $this->sanitizeRedirectTarget((string) ($this->request->getPost('redirect_to') ?? $this->request->getGet('redirect_to') ?? ''));
 
+        $validator = \Config\Services::validation();
+        $requestData = sanitize_request_value($this->request->getPost(['email', 'password']));
+        $validator->setRules([
+            'email' => 'required|valid_email|max_length[254]',
+            'password' => 'required|max_length[255]',
+        ]);
+
+        if (! $validator->run($requestData)) {
+            return redirect()
+                ->back()
+                ->with('error', 'Please enter a valid email and password.')
+                ->withInput();
+        }
+
         // Step 1: Get email, password, and IP from the request
-        $email = $this->request->getPost('email');
+        $email = strtolower((string) $requestData['email']);
-        $password = $this->request->getPost('password');
+        $password = (string) $requestData['password'];
         $ip = $this->request->getIPAddress();
 
         log_message('info', 'Login attempt from IP: ' . $ip . ' for email: ' . $email);
@@ -139,26 +152,29 @@ class AuthController extends Controller
     // JSON API: POST /api/login
     public function apiLogin()
     {
-        $requestData = $this->request->getJSON(true);
+        $requestData = sanitize_request_value($this->request->getJSON(true) ?: [
-        if (!$requestData) {
+            'email' => $this->request->getPost('email'),
-            // fallback to form vars
+            'password' => $this->request->getPost('password'),
-            $requestData = [
+        ]);
-                'email' => $this->request->getPost('email'),
-                'password' => $this->request->getPost('password'),
-            ];
-        }
 
-        $email = $requestData['email'] ?? '';
+        $validation = \Config\Services::validation();
-        $password = $requestData['password'] ?? '';
+        $validation->setRules([
-        $ip = $this->request->getIPAddress();
+            'email' => 'required|valid_email|max_length[254]',
+            'password' => 'required|max_length[255]',
+        ]);
 
-        if (!$email || !$password) {
+        if (! $validation->run($requestData)) {
-            return $this->response->setStatusCode(400)->setJSON([
+            return $this->response->setStatusCode(422)->setJSON([
                 'status' => false,
-                'message' => 'Email and password are required.'
+                'message' => 'Validation failed.',
+                'errors' => $validation->getErrors(),
             ]);
         }
 
+        $email = strtolower((string) ($requestData['email'] ?? ''));
+        $password = (string) ($requestData['password'] ?? '');
+        $ip = $this->request->getIPAddress();
+
         if ($this->isIpBlocked($ip)) {
             return $this->response->setStatusCode(429)->setJSON([
                 'status' => false,
@@ -220,7 +236,15 @@ class AuthController extends Controller
             'exp' => $exp,
         ];
 
-        $secret = env('JWT_SECRET', 'change-me-in-env');
+        try {
+            $secret = require_env('JWT_SECRET');
+        } catch (\RuntimeException $e) {
+            return $this->response->setStatusCode(500)->setJSON([
+                'status' => false,
+                'message' => 'JWT configuration is missing.',
+            ]);
+        }
+
         $token = jwt_encode($payload, $secret, 'HS256');
 
         return $this->response->setJSON([
@@ -240,18 +264,14 @@ class AuthController extends Controller
      */
     public function apiRegister()
     {
-        $requestData = $this->request->getJSON(true);
+        $requestData = sanitize_request_value($this->request->getJSON(true) ?: $this->request->getPost());
-        if (!$requestData) {
-            // fallback to form vars
-            $requestData = $this->request->getPost();
-        }
 
         // Basic validation
         $rules = [
-            'firstname' => 'required|min_length[2]|max_length[30]',
+            'firstname' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[2]|max_length[30]",
-            'lastname' => 'required|min_length[2]|max_length[30]',
+            'lastname' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[2]|max_length[30]",
-            'email' => 'required|valid_email|is_unique[users.email]',
+            'email' => 'required|valid_email|max_length[254]|is_unique[users.email]',
-            'password' => 'required|min_length[8]',
+            'password' => 'required|min_length[8]|max_length[255]',
             'cellphone' => 'required|min_length[10]|max_length[20]',
         ];
 
@@ -332,7 +352,7 @@ class AuthController extends Controller
                 'exp' => $exp,
             ];
 
-            $secret = env('JWT_SECRET', 'change-me-in-env');
+            $secret = require_env('JWT_SECRET');
             $token = jwt_encode($payload, $secret, 'HS256');
 
             return $this->response->setStatusCode(201)->setJSON([

app/Controllers/BaseController.php

@@ -36,7 +36,7 @@ abstract class BaseController extends Controller
      *
      * @var list<string>
      */
-    protected $helpers = [];
+    protected $helpers = ['security'];
 
     /** @var ApiClient */
     protected ApiClient $api;
@@ -73,6 +73,21 @@ abstract class BaseController extends Controller
         // Assuming the user role is stored in the session
         return session()->get('role');
     }
+
+    protected function validated(array $rules, ?array $data = null): array
+    {
+        $validation = service('validation');
+        $payload = $data ?? ($this->request->getJSON(true) ?: $this->request->getPost());
+        $payload = sanitize_request_value($payload);
+
+        $validation->setRules($rules);
+
+        if (! $validation->run($payload)) {
+            throw new \InvalidArgumentException(json_encode($validation->getErrors(), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) ?: 'Validation failed');
+        }
+
+        return $payload;
+    }
 }
 
-?>
+?>

app/Controllers/ProofreadController.php

@@ -10,8 +10,13 @@ class ProofreadController extends ResourceController
     {
         // Basic per-IP throttling: 10 requests per minute
         $throttler = service('throttler');
-        $key = 'proofread-' . $this->request->getIPAddress();
+
-        if (!$throttler->check($key, 10, MINUTE)) {
+        // Cache/throttler keys cannot contain reserved characters.
+        // Raw IPv6 addresses contain ":", so hash the IP first.
+        $ip = $this->request->getIPAddress();
+        $key = 'proofread-' . hash('sha256', $ip);
+
+        if (! $throttler->check($key, 10, MINUTE)) {
             return $this->respond([
                 'ok' => false,
                 'error' => 'Too many requests. Try again in a minute.',
@@ -20,29 +25,51 @@ class ProofreadController extends ResourceController
         }
 
         // Accept form-urlencoded payload to play nicely with CSRF protection
-        $text = (string) ($this->request->getPost('text') ?? '');
+        $payload = sanitize_request_value($this->request->getPost(['text']));
-        if ($text === '' || mb_strlen($text) > 20000) {
+
+        $validation = service('validation');
+        $validation->setRules([
+            'text' => 'required|min_length[1]|max_length[20000]',
+        ]);
+
+        if (! $validation->run($payload)) {
             return $this->respond([
                 'ok' => false,
-                'error' => 'Invalid text (empty or too long).',
+                'error' => 'Invalid text payload.',
                 'csrfHash' => csrf_hash(),
             ], 422);
         }
 
-        $client = \Config\Services::curlrequest(['timeout' => 10]);
+        $text = (string) $payload['text'];
+
+        $client = \Config\Services::curlrequest([
+            'timeout' => 10,
+        ]);
 
         try {
             $resp = $client->post('https://api.languagetool.org/v2/check', [
-                'headers' => ['Content-Type' => 'application/x-www-form-urlencoded'],
+                'headers' => [
+                    'Content-Type' => 'application/x-www-form-urlencoded',
+                ],
                 'form_params' => [
                     'text'     => $text,
                     'language' => 'en-US',
                 ],
             ]);
 
+            $result = json_decode($resp->getBody(), true);
+
+            if (json_last_error() !== JSON_ERROR_NONE) {
+                return $this->respond([
+                    'ok' => false,
+                    'error' => 'Invalid response from proofread service.',
+                    'csrfHash' => csrf_hash(),
+                ], 502);
+            }
+
             return $this->respond([
                 'ok' => true,
-                'result' => json_decode($resp->getBody(), true),
+                'result' => $result,
                 'csrfHash' => csrf_hash(),
             ]);
         } catch (\Throwable $e) {
@@ -53,4 +80,4 @@ class ProofreadController extends ResourceController
             ], 502);
         }
     }
-}
+}

app/Controllers/View/CertificateController.php

@@ -0,0 +1,664 @@
+<?php
+
+namespace App\Controllers\View;
+
+use App\Controllers\BaseController;
+use App\Models\ClassSectionModel;
+use App\Models\ConfigurationModel;
+use App\Models\CertificateRecordModel;
+
+class CertificateController extends BaseController
+{
+    protected $classSectionModel;
+    protected $configModel;
+    protected $certRecordModel;
+    protected $schoolYear;
+
+    public function __construct()
+    {
+        $this->classSectionModel = new ClassSectionModel();
+        $this->configModel       = new ConfigurationModel();
+        $this->certRecordModel   = new CertificateRecordModel();
+        $this->schoolYear        = $this->configModel->getConfig('school_year');
+    }
+
+    // ─── Admin UI ──────────────────────────────────────────────────────────────
+
+    public function index()
+    {
+        $db           = \Config\Database::connect();
+        $selectedCsid = $this->request->getGet('class_section_id');
+        $schoolYear   = $this->request->getGet('school_year') ?? $this->schoolYear;
+
+        // ── All enrolled students across every class section ───────────────────
+        $allEnrolled = $db->table('student_class sc')
+            ->select('s.id AS student_id, s.firstname, s.lastname, sc.class_section_id, cs.class_section_name')
+            ->join('students s', 's.id = sc.student_id')
+            ->join('classSection cs', 'cs.class_section_id = sc.class_section_id')
+            ->where('s.is_active', 1)
+            ->where('sc.school_year', $schoolYear)
+            ->orderBy('s.firstname', 'ASC')
+            ->orderBy('s.lastname', 'ASC')
+            ->get()
+            ->getResultArray();
+
+        $allIds = array_values(array_unique(array_map('intval', array_column($allEnrolled, 'student_id'))));
+
+        // ── Saved generated YEAR decisions from student_decisions ──────────────
+        //
+        // Source of truth:
+        // student_decisions.year_score
+        // student_decisions.decision
+        //
+        // Do NOT recalculate certificate decisions here from semester_scores.
+        $decisionsByStudent = [];
+
+        if (!empty($allIds)) {
+            $decisionRows = $db->table('student_decisions')
+                ->whereIn('student_id', $allIds)
+                ->where('school_year', $schoolYear)
+                ->get()
+                ->getResultArray();
+
+            foreach ($decisionRows as $d) {
+                $sid = (int)($d['student_id'] ?? 0);
+
+                if ($sid <= 0) {
+                    continue;
+                }
+
+                $decision = trim((string)($d['decision'] ?? ''));
+                $source   = trim((string)($d['source'] ?? ''));
+
+                if ($source === '') {
+                    $source = $decision === '' ? 'pending' : 'manual';
+                }
+
+                $decisionsByStudent[$sid]['Year'] = [
+                    'decision'   => $decision,
+                    'source'     => $source,
+                    'notes'      => (string)($d['notes'] ?? ''),
+                    'year_score' => $d['year_score'] ?? null,
+                ];
+            }
+        }
+
+        // ── Certificate records: most recent per student ───────────────────────
+        $certsByStudent = [];
+
+        if (!empty($allIds)) {
+            foreach ($db->table('certificate_records')
+                ->select('student_id, certificate_number, issued_at')
+                ->whereIn('student_id', $allIds)
+                ->where('school_year', $schoolYear)
+                ->orderBy('issued_at', 'DESC')
+                ->get()
+                ->getResultArray() as $c) {
+                $sid = (int)$c['student_id'];
+
+                if (!isset($certsByStudent[$sid])) {
+                    $certsByStudent[$sid] = $c['certificate_number'];
+                }
+            }
+        }
+
+        // ── Build per-class buckets and stats ──────────────────────────────────
+        $studentsByClass = [];
+        $statsPerClass   = [];
+
+        foreach ($allEnrolled as $row) {
+            $sid  = (int)$row['student_id'];
+            $csid = (int)$row['class_section_id'];
+
+            if (!isset($statsPerClass[$csid])) {
+                $statsPerClass[$csid] = [
+                    'name'  => $row['class_section_name'],
+                    'total' => 0,
+                    'pass'  => 0,
+                    'cert'  => 0,
+                ];
+            }
+
+            $statsPerClass[$csid]['total']++;
+
+            // If no generated decision exists yet, explicitly mark pending.
+            if (!isset($decisionsByStudent[$sid])) {
+                $decisionsByStudent[$sid]['Decision'] = [
+                    'decision'   => '',
+                    'source'     => 'pending',
+                    'notes'      => '',
+                    'year_score' => null,
+                ];
+            }
+
+            // Certificate eligibility:
+            // A student is eligible only if the saved final generated decision is Pass.
+            $studentDecisions = $decisionsByStudent[$sid] ?? [];
+            $isPass           = !empty($studentDecisions);
+
+            foreach ($studentDecisions as $decisionRow) {
+                $decision = trim((string)($decisionRow['decision'] ?? ''));
+
+                if (strcasecmp($decision, 'Pass') !== 0) {
+                    $isPass = false;
+                    break;
+                }
+            }
+
+            if ($isPass) {
+                $statsPerClass[$csid]['pass']++;
+            }
+
+            if (isset($certsByStudent[$sid])) {
+                $statsPerClass[$csid]['cert']++;
+            }
+
+            $studentsByClass[$csid][] = $row;
+        }
+
+        // ── Determine default active tab ───────────────────────────────────────
+        $firstCsid = !empty($allEnrolled) ? (int)$allEnrolled[0]['class_section_id'] : null;
+
+        if ($selectedCsid === null && $firstCsid !== null) {
+            $selectedCsid = (string)$firstCsid;
+        }
+
+        return view('admin/certificates/index', [
+            'studentsByClass'    => $studentsByClass,
+            'selectedClassId'    => $selectedCsid,
+            'schoolYear'         => $schoolYear,
+            'certDate'           => date('m/d/Y'),
+            'decisionsByStudent' => $decisionsByStudent,
+            'certsByStudent'     => $certsByStudent,
+            'statsPerClass'      => $statsPerClass,
+        ]);
+    }
+
+    public function auditLog()
+    {
+        $schoolYear  = $this->request->getGet('school_year') ?? $this->schoolYear;
+        $records     = $this->certRecordModel->getAuditLog($schoolYear);
+        $yearSummary = $this->certRecordModel->yearSummary();
+
+        return view('admin/certificates/audit_log', [
+            'records'     => $records,
+            'schoolYear'  => $schoolYear,
+            'yearSummary' => $yearSummary,
+        ]);
+    }
+
+    public function csrfToken()
+    {
+        return $this->response
+            ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
+            ->setHeader('Pragma', 'no-cache')
+            ->setJSON([
+                'csrf_token' => csrf_token(),
+                'csrf_hash'  => csrf_hash(),
+            ]);
+    }
+
+    // ─── Public verification page ──────────────────────────────────────────────
+
+    public function verify(string $certNumber)
+    {
+        $record = \Config\Database::connect()
+            ->table('certificate_records cr')
+            ->select('cr.*, u.firstname AS admin_firstname, u.lastname AS admin_lastname')
+            ->join('users u', 'u.id = cr.issued_by', 'left')
+            ->groupStart()
+                ->where('cr.verification_token', $certNumber)
+                ->orWhere('cr.certificate_number', strtoupper($certNumber))
+            ->groupEnd()
+            ->get()
+            ->getRowArray();
+
+        return view('certificates/verify', [
+            'record' => $record ?: null,
+        ]);
+    }
+
+    // ─── Reprint an existing certificate ──────────────────────────────────────
+
+    public function reprint(string $certNumber)
+    {
+        $record = \Config\Database::connect()
+            ->table('certificate_records')
+            ->where('certificate_number', strtoupper($certNumber))
+            ->get()
+            ->getRowArray();
+
+        if (!$record) {
+            return redirect()->to('administrator/certificates/log')
+                ->with('error', 'Certificate not found: ' . $certNumber);
+        }
+
+        $certDateFormatted = '';
+
+        if (!empty($record['cert_date'])) {
+            $ts = strtotime((string)$record['cert_date']);
+
+            if ($ts) {
+                $certDateFormatted = date('m/d/Y', $ts);
+            }
+        }
+
+        $student = [
+            'firstname'    => (string)($record['student_name'] ?? ''),
+            'lastname'     => '',
+            'grade'        => (string)($record['grade'] ?? ''),
+            'cert_number'  => (string)($record['certificate_number'] ?? ''),
+            'verify_token' => $this->ensureVerificationTokenForRecord($record),
+        ];
+
+        // student_name is stored as "Firstname Lastname" — split for the PDF builder.
+        $parts = explode(' ', trim($student['firstname']), 2);
+
+        if (count($parts) === 2) {
+            $student['firstname'] = $parts[0];
+            $student['lastname']  = $parts[1];
+        }
+
+        $pdfData  = $this->buildPdf([$student], $certDateFormatted ?: date('m/d/Y'));
+        $filename = 'Certificate_' . strtoupper($certNumber) . '.pdf';
+
+        return $this->response
+            ->setHeader('Content-Type', 'application/pdf')
+            ->setHeader('Content-Disposition', 'inline; filename="' . $filename . '"')
+            ->setBody($pdfData);
+    }
+
+    // ─── PDF generation ────────────────────────────────────────────────────────
+
+    public function generate()
+    {
+        $studentIds     = $this->request->getPost('student_ids') ?? [];
+        $certDate       = trim($this->request->getPost('cert_date') ?? date('m/d/Y'));
+        $classSectionId = $this->request->getPost('class_section_id');
+        $schoolYear     = $this->request->getPost('school_year') ?? $this->schoolYear;
+
+        if (empty($studentIds)) {
+            if ($this->request->isAJAX()) {
+                return $this->response
+                    ->setStatusCode(422)
+                    ->setJSON([
+                        'ok'         => false,
+                        'error'      => 'Please select at least one student.',
+                        'csrf_token' => csrf_token(),
+                        'csrf_hash'  => csrf_hash(),
+                    ]);
+            }
+
+            return redirect()->to('administrator/certificates')
+                ->with('error', 'Please select at least one student.');
+        }
+
+        $studentIds = array_filter(array_map('intval', $studentIds));
+        $certDate   = preg_replace('/[^0-9\/\-]/', '', $certDate);
+
+        if (empty($studentIds)) {
+            if ($this->request->isAJAX()) {
+                return $this->response
+                    ->setStatusCode(422)
+                    ->setJSON([
+                        'ok'         => false,
+                        'error'      => 'Invalid student selection.',
+                        'csrf_token' => csrf_token(),
+                        'csrf_hash'  => csrf_hash(),
+                    ]);
+            }
+
+            return redirect()->to('administrator/certificates')
+                ->with('error', 'Invalid student selection.');
+        }
+
+        $db       = \Config\Database::connect();
+        $students = [];
+
+        foreach ($studentIds as $id) {
+            $row = null;
+
+            if ($classSectionId) {
+                $row = $db->table('student_class sc')
+                    ->select('s.id, s.firstname, s.lastname, cs.class_section_name AS grade')
+                    ->join('students s', 's.id = sc.student_id')
+                    ->join('classSection cs', 'cs.class_section_id = sc.class_section_id')
+                    ->where('sc.class_section_id', (int)$classSectionId)
+                    ->where('sc.school_year', $schoolYear)
+                    ->where('s.id', $id)
+                    ->get()
+                    ->getRowArray();
+            }
+
+            if (!$row) {
+                $s = $db->table('students')
+                    ->select('id, firstname, lastname, registration_grade AS grade')
+                    ->where('id', $id)
+                    ->get()
+                    ->getRowArray();
+
+                $row = $s ?: null;
+            }
+
+            if ($row) {
+                $students[] = $row;
+            }
+        }
+
+        if (empty($students)) {
+            if ($this->request->isAJAX()) {
+                return $this->response
+                    ->setStatusCode(422)
+                    ->setJSON([
+                        'ok'         => false,
+                        'error'      => 'No valid students found.',
+                        'csrf_token' => csrf_token(),
+                        'csrf_hash'  => csrf_hash(),
+                    ]);
+            }
+
+            return redirect()->to('administrator/certificates')
+                ->with('error', 'No valid students found.');
+        }
+
+        $issuedAt = date('Y-m-d H:i:s');
+
+        // Load existing certificates for these students this school year.
+        $existingCerts = $db->table('certificate_records')
+            ->select('id, student_id, certificate_number, verification_token')
+            ->whereIn('student_id', array_column($students, 'id'))
+            ->where('school_year', $schoolYear)
+            ->get()
+            ->getResultArray();
+
+        $existingCertMap = [];
+
+        foreach ($existingCerts as $ec) {
+            $existingCertMap[(int)$ec['student_id']] = $ec;
+        }
+
+        foreach ($students as &$student) {
+            $sid = (int)$student['id'];
+
+            if (isset($existingCertMap[$sid])) {
+                // Reuse existing certificate number — do not create a new record.
+                $existing = $existingCertMap[$sid];
+
+                $student['cert_number']  = (string)($existing['certificate_number'] ?? '');
+                $student['verify_token'] = $this->ensureVerificationTokenForRecord($existing);
+            } else {
+                $certNumber  = $this->certRecordModel->nextNumber($schoolYear);
+                $verifyToken = $this->certRecordModel->generateVerificationToken();
+
+                $this->certRecordModel->insert([
+                    'certificate_number' => $certNumber,
+                    'verification_token' => $verifyToken,
+                    'student_id'         => $sid,
+                    'student_name'       => $student['firstname'] . ' ' . $student['lastname'],
+                    'grade'              => $this->formatGrade($student['grade'] ?? ''),
+                    'school_year'        => $schoolYear,
+                    'class_section_id'   => $classSectionId ?: null,
+                    'issued_at'          => $issuedAt,
+                ]);
+
+                $student['cert_number']  = $certNumber;
+                $student['verify_token'] = $verifyToken;
+            }
+        }
+
+        unset($student);
+
+        $pdfData  = $this->buildPdf($students, $certDate);
+        $filename = 'Certificates_' . date('Ymd_His') . '.pdf';
+
+        return $this->response
+            ->setHeader('Content-Type', 'application/pdf')
+            ->setHeader('Content-Disposition', 'inline; filename="' . $filename . '"')
+            ->setHeader('X-CSRF-TOKEN-NAME', csrf_token())
+            ->setHeader('X-CSRF-TOKEN', csrf_hash())
+            ->setBody($pdfData);
+    }
+
+    // ─── Helpers ───────────────────────────────────────────────────────────────
+
+    private function parseCertDate(string $certDate): ?string
+    {
+        if (preg_match('#^(\d{2})/(\d{2})/(\d{4})$#', $certDate, $m)) {
+            return $m[3] . '-' . $m[1] . '-' . $m[2];
+        }
+
+        if (preg_match('#^\d{4}-\d{2}-\d{2}$#', $certDate)) {
+            return $certDate;
+        }
+
+        return null;
+    }
+
+    private function formatGrade(string $raw): string
+    {
+        $clean = trim($raw);
+        $lower = strtolower($clean);
+
+        // Strip section suffix: "Grade 1-A" → "Grade 1", "Grade 2-B" → "Grade 2".
+        if (preg_match('/^grade\s*(\d+)/i', $clean, $m)) {
+            return 'Grade ' . (int)$m[1];
+        }
+
+        if ($lower === 'youth') {
+            return 'Youth';
+        }
+
+        if ($lower === 'kg' || $lower === 'kindergarten') {
+            return 'Kindergarten';
+        }
+
+        // Raw number or number-section: "1", "1-A", "2-B" → keep number only.
+        if (preg_match('/^(\d+)([- ][A-Za-z0-9]+)?$/', $clean, $m)) {
+            return 'Grade ' . (int)$m[1];
+        }
+
+        return $clean;
+    }
+
+    private function ensureVerificationTokenForRecord(array $record): string
+    {
+        $token = trim((string)($record['verification_token'] ?? ''));
+
+        if ($token !== '') {
+            return $token;
+        }
+
+        $recordId = (int)($record['id'] ?? 0);
+
+        if ($recordId <= 0) {
+            return '';
+        }
+
+        $token = $this->certRecordModel->generateVerificationToken();
+
+        $this->certRecordModel->update($recordId, [
+            'verification_token' => $token,
+        ]);
+
+        return $token;
+    }
+
+    // ─── PDF rendering ─────────────────────────────────────────────────────────
+
+    private function buildPdf(array $students, string $certDate): string
+    {
+        $fontDir = FCPATH . 'assets' . DIRECTORY_SEPARATOR . 'certificates' . DIRECTORY_SEPARATOR . 'fonts' . DIRECTORY_SEPARATOR;
+        $imgDir  = FCPATH . 'assets' . DIRECTORY_SEPARATOR . 'certificates' . DIRECTORY_SEPARATOR . 'images' . DIRECTORY_SEPARATOR;
+
+        $edwardianFont = \TCPDF_FONTS::addTTFfont($fontDir . 'Edwardian Script ITC Regular.ttf', 'TrueTypeUnicode', '', 32);
+        $garamondBold  = \TCPDF_FONTS::addTTFfont($fontDir . 'Garamond Bold.ttf', 'TrueTypeUnicode', '', 32);
+        $ebGaramond    = \TCPDF_FONTS::addTTFfont($fontDir . 'EBGaramond-Regular.ttf', 'TrueTypeUnicode', '', 32);
+
+        $pdf = new \TCPDF('L', 'pt', 'A4', true, 'UTF-8', false);
+
+        $pdf->SetCreator('Al Rahma Sunday School');
+        $pdf->SetTitle('Student Certificates');
+        $pdf->SetMargins(0, 0, 0, true);
+        $pdf->SetAutoPageBreak(false, 0);
+        $pdf->setPrintHeader(false);
+        $pdf->setPrintFooter(false);
+        $pdf->SetHeaderMargin(0);
+        $pdf->SetFooterMargin(0);
+
+        $W = $pdf->getPageWidth();
+        $H = $pdf->getPageHeight();
+
+        foreach ($students as $student) {
+            $pdf->AddPage();
+
+            $name        = trim((string)($student['firstname'] ?? '') . ' ' . (string)($student['lastname'] ?? ''));
+            $grade       = $this->formatGrade($student['grade'] ?? '');
+            $certNumber  = $student['cert_number'] ?? '';
+            $verifyToken = $student['verify_token'] ?? '';
+
+            $verifyUrl = $verifyToken !== ''
+                ? site_url('verify/' . rawurlencode($verifyToken))
+                : null;
+
+            $this->drawCertificate(
+                $pdf,
+                $W,
+                $H,
+                $name,
+                $grade,
+                $certDate,
+                $certNumber,
+                $verifyUrl,
+                $imgDir,
+                $edwardianFont,
+                $garamondBold,
+                $ebGaramond
+            );
+        }
+
+        return $pdf->Output('', 'S');
+    }
+
+    /**
+     * Coordinate mapping: iTextSharp origin bottom-left → TCPDF origin top-left.
+     * y_tcpdf ≈ H − y_iTextSharp
+     */
+    private function drawCertificate(
+        \TCPDF $pdf,
+        float $W,
+        float $H,
+        string $name,
+        string $grade,
+        string $certDate,
+        string $certNumber,
+        ?string $verifyUrl,
+        string $imgDir,
+        string $edwardianFont,
+        string $garamondBold,
+        string $ebGaramond
+    ): void {
+        // ── Images
+        $pdf->Image($imgDir . 'title.png', 126, 0, 600);
+        $pdf->Image($imgDir . 'background.png', 280, 176, 291, 340);
+        $pdf->Image($imgDir . 'signature.png', 140, 410, 90, 80);
+
+        // ── "Presented to:"
+        $pdf->SetFont('times', 'B', 24);
+        $pdf->SetTextColor(0, 0, 0);
+        $pdf->SetXY(0, 151);
+        $pdf->Cell($W, 24, 'Presented to:', 0, 0, 'C');
+
+        // ── QR code — left-aligned with "Presented to:", vertically centred on that line.
+        $qrSize = 42;
+
+        if (!empty($verifyUrl)) {
+            $qrX = 120;
+            $qrY = 171 + (24 - $qrSize) / 2;
+
+            $style = [
+                'border'  => false,
+                'padding' => 0,
+                'fgcolor' => [0, 0, 0],
+                'bgcolor' => false,
+            ];
+
+            $pdf->write2DBarcode($verifyUrl, 'QRCODE,L', $qrX, $qrY, $qrSize, $qrSize, $style, 'N');
+        }
+
+        // ── Student name — center based on actual string width.
+        $pdf->SetFont($edwardianFont, '', 38);
+        $nameX = ($W - $pdf->GetStringWidth($name)) / 2;
+        $this->drawGradientText($pdf, $edwardianFont, 38, $name, $nameX, 221.5);
+
+        // ── Line under name
+        $pdf->SetFont('times', '', 20);
+        $pdf->SetXY(0, 236);
+        $pdf->Cell(600, 20, '___________________________________', 0, 0, 'R');
+
+        // ── Description
+        $pdf->SetFont($ebGaramond, '', 20);
+        $pdf->SetXY(0, 273);
+        $pdf->Cell($W, 20, 'for successfully completing the requirements of', 0, 0, 'C');
+
+        // ── Grade
+        $pdf->SetFont($garamondBold, '', 20);
+        $pdf->SetXY(0, 310);
+        $pdf->Cell($W, 20, $grade, 0, 0, 'C');
+
+        // ── "at"
+        $pdf->SetFont('times', '', 20);
+        $pdf->SetXY(0, 343);
+        $pdf->Cell($W, 20, 'at', 0, 0, 'C');
+
+        // ── School name
+        $pdf->SetFont($garamondBold, '', 20);
+        $pdf->SetXY(0, 375);
+        $pdf->Cell($W, 20, 'Al Rahma Sunday School', 0, 0, 'C');
+
+        // ── Date
+        $this->drawGradientText($pdf, $edwardianFont, 26, $certDate, 586, 456);
+
+        // ── Date underline + label
+        $pdf->SetFont('times', '', 20);
+        $pdf->SetXY(0, 463);
+        $pdf->Cell(742, 20, '_________________', 0, 0, 'R');
+        $pdf->SetXY(650, 492);
+        $pdf->Cell(80, 20, 'Date', 0, 0, 'C');
+
+        // ── Signature underline + label
+        $pdf->SetXY(106, 463);
+        $pdf->Cell(200, 20, '_________________', 0, 0, 'L');
+        $pdf->SetXY(106, 492);
+        $pdf->Cell(168, 20, 'Signature', 0, 0, 'C');
+
+        // ── Certificate number — 1.4 cm from bottom, 2.5 cm from left.
+        if ($certNumber !== '') {
+            $pdf->SetFont('helvetica', '', 8);
+            $pdf->SetTextColor(150, 150, 150);
+            $pdf->SetXY(70.86, $H - 39.68);
+            $pdf->Cell(200, 12, 'Certificate No. ' . $certNumber, 0, 0, 'L');
+            $pdf->SetTextColor(0, 0, 0);
+        }
+    }
+
+    private function drawGradientText(
+        \TCPDF $pdf,
+        string $fontName,
+        float $fontSize,
+        string $text,
+        float $x,
+        float $y
+    ): void {
+        $pdf->SetFont($fontName, '', $fontSize);
+
+        for ($i = 0; $i < 6; $i++) {
+            $pdf->setAlpha(($i + 1) * 25 / 255);
+            $pdf->SetTextColor(0, 0, 0);
+            $pdf->Text($x + $i / 4, $y + $i / 4, $text);
+        }
+
+        $pdf->setAlpha(1);
+        $pdf->SetTextColor(0, 0, 0);
+        $pdf->Text($x, $y, $text);
+    }
+}

app/Controllers/View/ContactController.php

@@ -24,10 +24,10 @@ class ContactController extends BaseController
 
         // Define validation rules
         $validation->setRules([
-            'name' => 'required|min_length[3]',
+            'name' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[3]|max_length[100]",
-            'email' => 'required|valid_email',
+            'email' => 'required|valid_email|max_length[254]',
-            'subject' => 'required|min_length[3]',
+            'subject' => 'required|min_length[3]|max_length[150]',
-            'message' => 'required|min_length[10]'
+            'message' => 'required|min_length[10]|max_length[5000]'
         ]);
 
         if (!$validation->withRequest($this->request)->run()) {
@@ -37,10 +37,10 @@ class ContactController extends BaseController
         }
 
         // Process form data
-        $name = $this->request->getPost('name');
+        $name = esc((string) $this->request->getPost('name'));
-        $email = strtolower($this->request->getPost('email'));
+        $email = esc(strtolower((string) $this->request->getPost('email')));
-        $subject = $this->request->getPost('subject');
+        $subject = esc((string) $this->request->getPost('subject'));
-        $message = $this->request->getPost('message');
+        $message = nl2br(esc((string) $this->request->getPost('message')));
 
         // Initialize the EmailController
         $emailController = new \App\Controllers\View\EmailController();
@@ -63,4 +63,4 @@ class ContactController extends BaseController
 
         return redirect()->to('/parent/contact');
     }
-}
+}