# Setup Guide — Leads Backend

## What's in this bundle
```
survey.html          → your public survey page
config.php            → database connection settings (edit this)
api/submit.php        → receives survey answers, saves them
admin/setup.php        → one-time page to create your login (delete after use)
admin/login.php        → admin login page
admin/dashboard.php     → view all leads
admin/export_csv.php    → download all leads as CSV
admin/logout.php
sql/schema.sql          → database table structure
```

## 1. Create the database
In your hosting control panel (cPanel/hPanel), go to **MySQL Databases**:
- Create a new database (e.g. `brahmastra_leads`)
- Create a database user with a strong password
- Attach the user to the database with **All Privileges**
- Note down: database name, username, password, host (usually `localhost`)

## 2. Create the table
Open **phpMyAdmin**, select your new database, go to the **SQL** tab, and paste
the contents of `sql/schema.sql`, then click Go.

## 3. Edit config.php
Open `config.php` and fill in your real database details:
```php
define('DB_HOST', 'localhost');
define('DB_NAME', 'brahmastra_leads');
define('DB_USER', 'your_real_username');
define('DB_PASS', 'your_real_password');
```

## 4. Upload everything
Upload the whole folder to your hosting via FTP or the File Manager —
for example into `/public_html/leads/`. Keep the folder structure exactly
as it is (`api/`, `admin/`, `config.php` at the same level).

## 5. Create your admin login
Visit `https://yourdomain.com/leads/admin/setup.php` in your browser,
enter a username and password, and submit.

**Immediately after this works, delete `admin/setup.php` from your server**
(via FTP/File Manager) — leaving it live would let anyone create an admin account.

## 6. Point the survey page at your backend
Open `survey.html`, find this line near the top of the `<script>`:
```js
const WEBHOOK_URL = "https://yourdomain.com/api/submit.php";
```
Change it to the real path, e.g.:
```js
const WEBHOOK_URL = "https://yourdomain.com/leads/api/submit.php";
```

## 7. You're live
- Public survey: `https://yourdomain.com/leads/survey.html`
- Admin login: `https://yourdomain.com/leads/admin/login.php`

Every submission appears instantly in the dashboard, searchable by name/phone,
with a CSV export button.

## Security notes
- The `admin/` folder is protected by login (session-based) — dashboard and
  CSV export will redirect to login.php if you're not signed in.
- Passwords are hashed (bcrypt via PHP's `password_hash`), never stored in plain text.
- All database queries use prepared statements, so it's protected against SQL injection.
- Consider adding an SSL certificate (usually free via your host, e.g. Let's Encrypt)
  so the login page isn't sent over plain HTTP.