<?php

function getSurveyWhereClause(mysqli $conn)
{
    $role = $_SESSION['role'] ?? '';

    // Admin sees everything
    if ($role === 'admin') {
        return '';
    }

    // Zonal Director sees only their zone
    if ($role === 'zonal_director') {

        $zone = mysqli_real_escape_string(
            $conn,
            $_SESSION['zone_name']
        );

        return " WHERE zone_name = '$zone' ";
    }

    // Normal user sees only their own surveys
    $user = mysqli_real_escape_string(
        $conn,
        $_SESSION['fullname']
    );

    return " WHERE entered_by = '$user' ";
}