DNHS Hub

A Centralized Student Records and Document Request Management System for Dayap National High School

---

Overview

DNHS Hub is a production-ready web application designed for the Registrar's Office of Dayap National High School (DNHS). It serves as a centralized repository for student information, academic records, and document requests, streamlining record retrieval, request processing, document issuance, reporting, and audit tracking.

This system is strictly for internal use by authorized personnel (Administrators and Registrars).

---

Features

Dashboard

• Summary cards with percentage indicators (month-over-month comparison)
• Quick action links for common tasks
• Monthly Requests chart
• Request Status Breakdown chart with count labels
• Most Requested Documents chart
• Recent Requests list
• Consolidated COUNT queries for faster load times

Student Records

• Complete student profiles (Personal, Guardian, Academic information)
• Add, Edit, View, Archive, Restore students
• Instant AJAX search (no page reload)
• Filter by status and batch with instant results
• Print student profile
• Digital student folder with documents and request history
• Floating action buttons (FAB) for Save/Cancel on add/edit pages

Student Documents

• Upload documents (PDF, JPG, JPEG, PNG - Max 10MB)
• Version tracking for uploaded files
• Download, Preview, Delete documents
• AJAX student autocomplete (typeahead search for 5000+ records)
• Instant filter by document type
• Custom styled delete confirmation modal

Document Requests

• Auto-generated tracking numbers (DNHS-YYYY-NNNNNN)
• Status workflow: Pending → Approved → Processing → Ready for Release → Released
• QR code verification
• Claim stub generation and printing
• Status history tracking
• AJAX student autocomplete (typeahead search)
• Instant filter by status and document type
• Custom styled delete confirmation modal

Reports

• Daily, Weekly, Monthly, Yearly requests
• Request Status Breakdown
• Most Requested Documents
• Registrar Activity Report
• Export to CSV, Excel (.xls), and Word (.doc)

Audit Trail

• Tracks all system activities (Login, CRUD operations, Document uploads, etc.)
• Filterable by action, module, and date range
• Optimized date range queries

User Management (Admin Only)

• Create, Edit, Deactivate/Activate users
• Reset passwords
• Role assignment (Administrator, Registrar)
• Uniform badge alignment for role/status

Backup & Restore (Admin Only)

• Database backup creation
• Database restore from backup file
• Backup history with download capability
• Custom styled confirmation for restore operations

Notifications

• In-app notification system
• Popup modal for viewing notification details
• Mark as read functionality
• Unread count badge
• Direct links to related records

Settings Page

• Unified settings page with tabs (Profile, Audit Logs, Backup & Restore)
• Profile editing and password change
• Styled banner and stat cards

Security

• Rate limiting on login (5 attempts, 15-minute lockout)
• Password hashing (bcrypt)
• CSRF token protection (regenerated after each use)
• XSS prevention (htmlspecialchars on all output)
• SQL injection prevention (PDO prepared statements)
• Session timeout (30 minutes)
• Session fixation protection (regenerate ID after login)
• Path traversal protection (realpath validation on file operations)
• File upload MIME type validation
• PHP execution blocked in uploads directory (.htaccess)
• Backup restore SQL statement validation
• Security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy)
• Session cookie security (HttpOnly, SameSite, Strict Mode, Secure when HTTPS)
• Strong password policy (8+ chars, uppercase, lowercase, number)
• POST-based logout with CSRF protection

Performance

• 18 database indexes for optimized queries at scale (5000+ records)
• Consolidated dashboard COUNT queries (8 queries → 1)
• Smart windowed pagination (ellipsis for large page counts)
• Limited dropdown queries to prevent memory exhaustion
• Batch notification inserts
• Date range predicates replacing MONTH/YEAR() functions

---

Technology Stack

Layer	Technology
Backend	PHP 8+
Database	MySQL 8+
Frontend	HTML5, CSS3, Bootstrap 5, JavaScript ES6
Charts	Chart.js
Tables	DataTables
Server	Apache (XAMPP/LAMP)

---

Project Structure

dnhs-hub/
├── assets/
│   ├── css/
│   │   ├── login.css              # Login page styles
│   │   └── style.css              # Main application styles
│   ├── js/
│   │   └── app.js                 # JavaScript functions (toast, confirmDelete, etc.)
│   ├── images/
│   │   ├── school-logo.png        # School logo
│   │   └── school-building.jpg    # School building photo
│   └── uploads/
│       └── documents/             # Uploaded student documents (versioned)
├── config/
│   ├── config.php                 # Application configuration
│   └── database.php               # Database connection
├── database/
│   └── schema.sql                 # MySQL database schema
├── includes/
│   ├── header.php                 # Page header & navigation
│   ├── footer.php                 # Page footer, scripts & modals
│   └── functions.php              # Utility functions
├── modules/
│   ├── auth/
│   │   ├── login.php              # Login page
│   │   ├── logout.php             # Logout handler
│   │   └── profile.php            # User profile
│   ├── dashboard/
│   │   └── index.php              # Main dashboard
│   ├── students/
│   │   ├── index.php              # Students list (AJAX search)
│   │   ├── ajax_search.php        # AJAX search endpoint
│   │   ├── add.php                # Add new student
│   │   ├── edit.php               # Edit student
│   │   ├── view.php               # View student profile
│   │   ├── archive.php            # Archive student
│   │   ├── restore.php            # Restore archived student
│   │   └── archived.php           # Archived students list
│   ├── documents/
│   │   ├── index.php              # Documents list (AJAX search)
│   │   ├── ajax_search.php        # AJAX search endpoint
│   │   ├── search_students.php    # AJAX student autocomplete
│   │   ├── upload.php             # Upload document form
│   │   ├── download.php           # Download document
│   │   ├── preview.php            # Preview document
│   │   └── delete.php             # Delete document (AJAX + form)
│   ├── requests/
│   │   ├── index.php              # Requests list (AJAX search)
│   │   ├── ajax_search.php        # AJAX search endpoint
│   │   ├── search_students.php    # AJAX student autocomplete
│   │   ├── add.php                # Create new request
│   │   ├── view.php               # View request details
│   │   ├── update_status.php      # Update request status
│   │   └── verify.php             # QR code verification
│   ├── reports/
│   │   ├── index.php              # Reports page
│   │   └── export.php             # Export reports (CSV, Excel, Word)
│   ├── users/
│   │   ├── index.php              # Users list
│   │   ├── add.php                # Add new user
│   │   ├── edit.php               # Edit user
│   │   ├── reset_password.php     # Reset user password
│   │   └── toggle_status.php      # Activate/Deactivate user
│   ├── audit/
│   │   └── index.php              # Audit logs viewer
│   ├── backup/
│   │   ├── index.php              # Backup & restore page
│   │   └── download.php           # Download backup file
│   ├── notifications/
│   │   ├── index.php              # Notifications list
│   │   └── mark_read.php          # Mark notification read (AJAX)
│   ├── settings/
│   │   └── index.php              # Unified settings page
│   └── claims/
│       └── stub.php               # Claim stub generator
├── storage/
│   └── backups/                   # Database backup files
├── .gitignore                     # Git ignore rules
├── index.php                      # Root redirect
├── README.md                      # Project documentation
└── USER_MANUAL.md                 # User manual

---

Installation

Prerequisites

• XAMPP, WAMP, or LAMP stack
• PHP 8.0 or higher
• MySQL 8.0 or higher
• Apache web server

Steps

1. Clone or copy the project

   Copy the dnhs-hub folder to your web server root:
   - XAMPP: C:\xampp\htdocs\
   - WAMP: C:\wamp\www\
   - LAMP: /var/www/html/
   

2. Create the database

   • Open phpMyAdmin (http://localhost/phpmyadmin)
   • Go to the Import tab
   • Select database/schema.sql
   • Click Go to import

3. Configure database connection

   • Open config/database.php
   • Update the database credentials if needed:

     define('DB_HOST', 'localhost');
     define('DB_NAME', 'dnhs_hub');
     define('DB_USER', 'root');
     define('DB_PASS', '');

4. Configure application URL

   • Open config/config.php
   • Update APP_URL to match your setup:

     define('APP_URL', 'http://localhost/dnhs-hub');

5. Ensure upload directories are writable

   Set permissions for:
   - assets/uploads/documents/
   - assets/uploads/profiles/
   

6. Access the application

   • Open your browser
   • Navigate to: http://localhost/dnhs-hub/

---

Default Login Credentials

Role	Username	Password
Administrator	admin	admin123
Registrar	registrar	registrar123

Important: Change these passwords after first login!

---

User Roles & Permissions

Administrator

• Full system access
• Dashboard
• User Management
• Student Records (CRUD)
• Student Documents (CRUD)
• Document Requests
• Reports
• Audit Logs
• Backup & Restore
• System Settings

Registrar

• Dashboard
• Student Records (CRUD)
• Student Documents (CRUD)
• Document Requests
• Reports
• Cannot: Manage users, access audit logs, backup database

---

Document Request Workflow

Create Request
      ↓
    Pending
      ↓
   Approved
      ↓
  Processing
      ↓
Ready for Release
      ↓
   Released

Status can also be: Rejected or Cancelled at any stage before release.

---

Tracking Number Format

DNHS-2026-000001
│     │    │
│     │    └── Sequential number (6 digits)
│     └── Year
└── School prefix

---

Security Features

• Rate limiting on login (5 attempts, 15-minute lockout)
• Password hashing (bcrypt)
• PDO prepared statements (SQL injection prevention)
• CSRF token protection (regenerated after successful validation)
• XSS protection (htmlspecialchars via sanitize() on all output)
• Session validation and timeout (30 minutes)
• Session fixation protection (session_regenerate_id after login)
• Role-based access control
• Path traversal protection (realpath() validation on file operations)
• Secure file upload validation (extension + MIME type via finfo_file())
• File type and size restrictions (PDF, JPG, JPEG, PNG - 10MB max)
• PHP execution blocked in uploads directory (.htaccess)
• Backup restore SQL validation (blocks DROP DATABASE, GRANT, INTO OUTFILE, etc.)
• Backup file size limit (50MB max)
• Security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy)
• Session cookie security (HttpOnly, SameSite=Lax, Strict Mode, Secure when HTTPS)
• Activity logging (audit trail)

---

Supported Document Types

• SF10 (Secondary Form 10)
• Form 137 (Permanent Academic Record)
• Birth Certificate
• Good Moral Certificate
• Report Card
• Certificate of Enrollment
• Diploma Copy
• Transcript of Records
• Authentication Documents
• Other Registrar Documents

---

Browser Support

• Google Chrome (latest)
• Mozilla Firefox (latest)
• Microsoft Edge (latest)
• Safari (latest)

---

User Manual

See USER_MANUAL.md for detailed instructions on using the system.

---

Troubleshooting

Database connection failed

• Ensure MySQL is running
• Verify credentials in config/database.php
• Check if dnhs_hub database exists

Upload failed

• Check folder permissions for assets/uploads/
• Verify PHP upload settings in php.ini:
  • file_uploads = On
  • upload_max_filesize = 10M
  • post_max_size = 12M

Blank page

• Enable error reporting in config/config.php:

  ini_set('display_errors', 1);
  error_reporting(E_ALL);

Login locked out

• Wait 15 minutes for the lockout to expire
• Or contact an administrator to clear the lockout

---

License

This project is proprietary software developed for Dayap National High School. Unauthorized distribution or modification is prohibited.

---

Developer

Developed by the Alumni for the Registrar's Office of Dayap National High School.

---

Version History

Version	Date	Description
1.0.0	2026	Initial release
1.1.0	2026	UI improvements, security enhancements, notification modals
1.2.0	2026	Security hardening: path traversal fixes, upload validation, session protection, security headers, backup validation, password policy enforcement
1.3.0	2026	Performance optimizations, AJAX search, student autocomplete, custom delete modals, report exports, smart pagination, 18 database indexes

---

System Checklist

Authentication & Authorization

• Login with rate limiting (5 attempts / 15 min lockout)
• Password hashing with bcrypt
• Session fixation protection (regenerate ID after login)
• Session timeout (30 minutes inactivity)
• Session strict mode enabled
• Session cookies: HttpOnly, SameSite=Lax, Secure (when HTTPS)
• POST-based logout with CSRF token
• Role-based access control (Admin, Registrar)
• Password policy enforcement (8+ chars, uppercase, lowercase, number)

Dashboard

• Summary cards with month-over-month percentage change
• Monthly Requests chart
• Request Status Breakdown chart
• Most Requested Documents chart
• Recent Requests list
• Quick action links

Student Records

• Add new student
• Edit student information
• View student profile
• Archive student record
• Restore archived student
• List archived students
• Search and filter (name, LRN, status, batch)
• Print student profile

Student Documents

• Upload documents (PDF, JPG, JPEG, PNG - 10MB max)
• MIME type validation (finfo_file)
• PHP execution blocked in uploads directory
• Version tracking for uploaded files
• Download documents
• Preview documents
• Delete documents
• Path traversal protection (realpath validation)
• Filter by student and document type

Document Requests

• Create new request
• Auto-generated tracking numbers (DNHS-YYYY-NNNNNN)
• Status workflow: Pending → Approved → Processing → Ready for Release → Released
• Status can be Rejected or Cancelled
• QR code verification (public page)
• Claim stub generation and printing
• Status history tracking

Reports

• Daily, Weekly, Monthly, Yearly requests
• Request Status Breakdown
• Most Requested Documents
• Registrar Activity Report

Audit Trail

• Tracks all system activities
• Filterable by action, module, and date range
• IP address logging

User Management (Admin Only)

• Create new user
• Edit user information
• Activate/Deactivate users
• Reset passwords
• Role assignment (Administrator, Registrar)
• Strong password policy enforcement

Backup & Restore (Admin Only)

• Database backup creation
• Database restore from backup file
• SQL statement validation (blocks destructive operations)
• Backup file size limit (50MB)
• Backup history with download capability

Notifications

• In-app notification system
• Popup modal for viewing notification details
• Mark as read functionality
• Unread count badge

Security

• SQL injection prevention (PDO prepared statements)
• XSS prevention (htmlspecialchars on all output)
• CSRF token protection (regenerated after use)
• Path traversal protection (realpath validation)
• File upload validation (extension + MIME type)
• PHP execution blocked in uploads (.htaccess)
• Backup restore SQL validation
• Security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy)
• Session cookie security (HttpOnly, SameSite, Strict Mode)
• Content-Disposition header escaping
• $pageTitle escaping in HTML output
• Notification URL escaping
• Login error message anonymization (anti-enumeration)

UI/UX

• Responsive design (Bootstrap 5)
• Sidebar navigation with role-based visibility
• Top navigation bar with search, notifications, user menu
• Toast notifications for flash messages
• Custom styled delete confirmation modals
• Smart windowed pagination with ellipsis
• Floating action buttons (FAB) for Save/Cancel
• Uniform badge alignment across tables

Performance

• 18 database indexes for optimized queries
• Consolidated dashboard COUNT queries
• AJAX instant search (no page reload)
• AJAX student autocomplete for 5000+ records
• Auto-filtering dropdowns
• Limited dropdown queries to prevent memory exhaustion
• Batch notification inserts
• Date range predicates replacing MONTH/YEAR()

Reports & Export

• CSV export
• Excel (.xls) export
• Word (.doc) export