<?php
chdir('../');
session_start();
require_once('public/connection.php');

if (!isset($_SESSION['staff_id'])) {
    $_SESSION['msg'] = "Unauthorized access.";
    $_SESSION['type'] = "error";
    header("Location: ../index.php");
    exit;
}

if (isset($_POST['student_id'])) {
    $student_id = (int) $_POST['student_id'];

    $stmt = $conn->prepare("UPDATE students SET flagged = 0 WHERE id = ?");
    $stmt->bind_param("i", $student_id);

    if ($stmt->execute()) {
        $_SESSION['msg'] = "Student successfully unflagged.";
        $_SESSION['type'] = "success";
    } else {
        $_SESSION['msg'] = "Failed to unflag student.";
        $_SESSION['type'] = "error";
    }
}

header("Location: flagged_students.php");
exit;
?>