<?php
include 'includes/config.php';

if(isset($_POST['add_tracking'])){

    if(isset($_GET['id']) && isset($_POST['scn']) && isset($_POST['tid'])){
        $id = $_GET['id'];
        $scn = $_POST['scn'];
        $tid = $_POST['tid'];

        // Use prepared statements to prevent SQL injection
        $stmt = $conn->prepare("UPDATE tbl_orders SET scn = ?, tid = ? WHERE id = ?");
        $stmt->bind_param("ssi", $scn, $tid, $id);

        if($stmt->execute()){
            echo "<script>
                alert('Data Added Successfully');
                window.location.href='view-order.php';
                </script>";
        } else {
            echo "<script>alert('Please add proper data');</script>";
        }

        $stmt->close();
    } 
}
?>