<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['id'], $_POST['status'])) {
    include 'db.php';
    $id = (int) $_POST['id'];
    $status = $conn->real_escape_string($_POST['status']);
    $conn->query("UPDATE purchases SET status = '$status' WHERE id = $id");
    echo "Status updated";
    exit;
}
?>
