Add PayPal integration and band image upload features

- Implemented complete PayPal payment integration with checkout flow
- Added payments table to database for transaction tracking
- Created image upload functionality for band profiles
- Added gallery management in band profiles
- Updated booking flow to support PayPal payments
- Added payment status display in user profiles
- Included comprehensive documentation for new features

New files:
- upload-handler.php: REST API for image uploads
- paypal-checkout.php: PayPal checkout page
- paypal-process.php: Payment processing backend
- PAYPAL_UPLOAD_FEATURES.md: Complete documentation
- storage/uploads/bands/: Upload directory

Modified files:
- database.sql: Added payments table
- profil.php: Added gallery and payment tracking
- anfrage.php: Integrated PayPal payment option

.vscode/sftp.json

@@ -0,0 +1,12 @@
+{
+    "name": "Mein Webserver",
+    "host": "192.168.178.88",
+    "protocol": "sftp",
+    "port": 22,
+    "username": "root",
+    "password": "934290",
+    "remotePath": "/var/www/html/",
+    "uploadOnSave": true,
+    "useTempFile": false,
+    "openSsh": false
+}

PAYPAL_UPLOAD_FEATURES.md

@@ -0,0 +1,180 @@
+# Neue Features: PayPal-Integration & Bild-Upload
+
+Dieses Dokument beschreibt die neu hinzugefügten Features für die GetYourBand-Plattform.
+
+## 🖼️ Bild-Upload für Bands
+
+### Features
+- **Upload-Funktionalität**: Bands können eigene Bilder hochladen
+- **Galerie-Verwaltung**: Anzeige und Verwaltung aller hochgeladenen Bilder
+- **Löschen**: Bilder können jederzeit gelöscht werden
+- **Validierung**:
+  - Erlaubte Formate: JPG, PNG, GIF, WEBP
+  - Maximale Dateigröße: 5MB
+  - Automatische Dateinamens-Generierung
+
+### Technische Details
+- **Upload-Verzeichnis**: `/storage/uploads/bands/`
+- **Handler**: `upload-handler.php`
+- **Frontend**: AJAX-basierter Upload mit Fetch API
+- **Dateinamensschema**: `band_{band_id}_{unique_id}.{extension}`
+
+### Verwendung
+1. Als Band-User einloggen
+2. Zum Profil navigieren (`profil.php`)
+3. Sektion "Band-Galerie" finden
+4. Auf "+ Bild hochladen" klicken
+5. Bild auswählen (wird automatisch hochgeladen)
+
+### Sicherheit
+- Nur authentifizierte Band-User können uploaden
+- Strenge Dateitypprüfung (MIME-Type + Extension)
+- Größenlimit verhindert DoS
+- Sichere Dateinamen ohne User-Input
+
+---
+
+## 💳 PayPal-Integration
+
+### Features
+- **Zahlungsabwicklung**: Kunden können Buchungen direkt mit PayPal bezahlen
+- **Service Fee**: Konfigurierbare Servicegebühr (in Admin-Settings)
+- **Zahlungs-Tracking**: Alle Zahlungen werden in der Datenbank gespeichert
+- **Status-Updates**: Anfragen werden automatisch auf "bestätigt" gesetzt
+- **Email-Benachrichtigungen**: Kunde und Band erhalten Bestätigungen
+
+### Komponenten
+
+#### 1. Datenbank
+Neue Tabelle `payments`:
+```sql
+CREATE TABLE payments (
+    id INTEGER PRIMARY KEY,
+    request_id INTEGER NOT NULL,
+    amount REAL NOT NULL,
+    service_fee REAL NOT NULL,
+    total_amount REAL NOT NULL,
+    paypal_order_id TEXT,
+    paypal_payer_id TEXT,
+    status TEXT DEFAULT 'pending',
+    created_at TEXT,
+    completed_at TEXT
+);
+```
+
+#### 2. Checkout-Seite
+**Datei**: `paypal-checkout.php`
+- Zeigt Buchungsdetails und Zahlungsübersicht
+- Integriert PayPal JavaScript SDK
+- Berechnet Gesamtbetrag (Band-Gage + Service Fee)
+
+#### 3. Payment Processing
+**Datei**: `paypal-process.php`
+- Speichert erfolgreiche Zahlungen
+- Aktualisiert Request-Status
+- Sendet Bestätigungs-Emails
+
+#### 4. Integration in Buchungsflow
+**Änderungen in `anfrage.php`**:
+- Nach erfolgreicher Anfrage wird PayPal-Button angezeigt (wenn aktiviert)
+- Direkter Link zum Checkout
+
+**Änderungen in `profil.php`**:
+- Zahlungsstatus für jede Anfrage angezeigt
+- "Jetzt bezahlen"-Button für ausstehende Zahlungen
+
+### PayPal-Konfiguration
+
+#### Admin-Einstellungen
+Im Admin-Panel (`admin/settings.php`):
+- `paypal_enabled`: 0/1 (aktiviert/deaktiviert)
+- `service_fee`: Prozentsatz (z.B. 8 für 8%)
+
+#### PayPal API Credentials
+In `paypal-checkout.php` Zeile 80:
+```javascript
+<script src="https://www.paypal.com/sdk/js?client-id=YOUR_PAYPAL_CLIENT_ID&currency=CHF"></script>
+```
+
+**Wichtig**: `YOUR_PAYPAL_CLIENT_ID` durch echte Client-ID ersetzen!
+
+#### PayPal Developer Setup
+1. Gehen Sie zu https://developer.paypal.com
+2. Erstellen Sie eine App in "My Apps & Credentials"
+3. Kopieren Sie die Client-ID
+4. Für Produktion: Aktivieren Sie Live-Modus und verwenden Sie Live-Credentials
+
+### Zahlungsablauf
+
+1. **Kunde erstellt Anfrage** → Request wird in DB gespeichert
+2. **PayPal-Link erscheint** → Kunde klickt auf "Mit PayPal bezahlen"
+3. **Checkout-Seite** → Übersicht und PayPal-Button
+4. **PayPal-Zahlung** → Kunde loggt sich in PayPal ein und zahlt
+5. **Payment Processing** → Zahlung wird in DB gespeichert
+6. **Status-Update** → Request → "bestätigt", Emails versandt
+7. **Rückkehr zum Profil** → Erfolgsmeldung
+
+### Testmodus
+
+Die aktuelle Implementation läuft im **Sandbox-Modus**:
+- Verwenden Sie PayPal Sandbox-Accounts zum Testen
+- Keine echten Transaktionen werden durchgeführt
+- Für Produktion: Client-ID auf Live-Credentials umstellen
+
+### Sicherheit
+- Zahlung nur für eigene Requests möglich
+- Doppelzahlungen werden verhindert
+- Transaktions-IDs werden gespeichert
+- Server-seitige Validierung aller Zahlungsdaten
+
+---
+
+## 📂 Neue Dateien
+
+| Datei | Beschreibung |
+|-------|--------------|
+| `upload-handler.php` | REST-API für Bild-Uploads (POST/DELETE) |
+| `paypal-checkout.php` | PayPal Checkout-Seite |
+| `paypal-process.php` | PayPal Payment Processing Backend |
+| `storage/uploads/bands/` | Upload-Verzeichnis für Band-Bilder |
+| `PAYPAL_UPLOAD_FEATURES.md` | Diese Dokumentation |
+
+## 🔄 Geänderte Dateien
+
+| Datei | Änderungen |
+|-------|------------|
+| `database.sql` | + `payments` Tabelle |
+| `profil.php` | + Galerie-Sektion, + Zahlungsstatus in Anfragen |
+| `anfrage.php` | + PayPal-Button nach erfolgreicher Anfrage |
+
+## 🚀 Deployment-Checklist
+
+- [ ] `storage/uploads/` Verzeichnis erstellen mit Schreibrechten
+- [ ] PayPal Developer Account erstellen
+- [ ] Client-ID in `paypal-checkout.php` eintragen
+- [ ] Admin-Panel: PayPal aktivieren und Service Fee setzen
+- [ ] Für Produktion: Auf Live-Credentials umstellen
+- [ ] SSL-Zertifikat für HTTPS (PayPal requirement)
+
+## 🐛 Bekannte Einschränkungen
+
+1. **PayPal Client-ID**: Muss manuell konfiguriert werden
+2. **Keine Rückerstattungen**: Keine Admin-UI für Refunds
+3. **Email-System**: Aktuell nur Logging, kein echtes SMTP
+4. **Sandbox-Modus**: Standardmäßig aktiviert
+
+## 📝 Nächste Schritte (Optional)
+
+- Webhook-Integration für PayPal IPN (Instant Payment Notification)
+- Admin-Dashboard für Zahlungsübersicht
+- Automatische Rechnungserstellung (PDF)
+- Stripe als alternative Zahlungsmethode
+- Bulk-Upload für mehrere Bilder
+- Bildkompression/Optimierung
+- Thumbnail-Generierung
+
+---
+
+**Entwickelt für**: GetYourBand Platform
+**Datum**: 2025-12-02
+**Version**: 1.0

anfrage.php

@@ -15,6 +15,8 @@ $user = currentUser();
 $message = '';
 $error = '';
 
+$requestId = null;
+
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $data = [
         'band_id' => $bandId,
@@ -30,6 +32,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $error = 'Bitte Datum und Ort ausfüllen.';
     } else {
         createRequest($data);
+        $requestId = (int) db()->lastInsertId();
         $message = 'Anfrage gespeichert und an die Band gemeldet.';
         sendEmail('info@' . preg_replace('/\s+/', '', strtolower($band['name'])) . '.ch', 'Neue Anfrage', 'Neue Anfrage für ' . $band['name']);
     }
@@ -52,8 +55,21 @@ $settings = settings();
         <p>PayPal Zahlungsabwicklung ist <?= $settings['paypal_enabled'] === '1' ? 'aktiviert' : 'optional' ?>, Service Fee: <?= htmlspecialchars($settings['service_fee']) ?>%.</p>
     </header>
     <main>
-        <?php if ($message): ?><div class="alert alert-success"><?= htmlspecialchars($message) ?></div><?php endif; ?>
+        <?php if ($message): ?>
+            <div class="alert alert-success">
+                <?= htmlspecialchars($message) ?>
+                <?php if ($requestId && $settings['paypal_enabled'] === '1'): ?>
+                    <div style="margin-top: 1rem;">
+                        <a href="paypal-checkout.php?request_id=<?= $requestId ?>" class="btn-primary" style="display: inline-block; padding: 0.75rem 1.5rem; text-decoration: none;">
+                            Jetzt mit PayPal bezahlen
+                        </a>
+                    </div>
+                <?php endif; ?>
+            </div>
+        <?php endif; ?>
         <?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
+
+        <?php if (!$message): ?>
         <form method="post">
             <label>Event-Datum
                 <input type="date" class="form-control" name="event_date" required>
@@ -72,6 +88,7 @@ $settings = settings();
             </label>
             <button class="btn-primary">Anfrage senden</button>
         </form>
+        <?php endif; ?>
     </main>
 </body>
 </html>

database.sql

@@ -74,3 +74,17 @@ CREATE TABLE IF NOT EXISTS settings (
     key TEXT PRIMARY KEY,
     value TEXT NOT NULL
 );
+
+CREATE TABLE IF NOT EXISTS payments (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    request_id INTEGER NOT NULL,
+    amount REAL NOT NULL,
+    service_fee REAL NOT NULL,
+    total_amount REAL NOT NULL,
+    paypal_order_id TEXT,
+    paypal_payer_id TEXT,
+    status TEXT NOT NULL DEFAULT 'pending',
+    created_at TEXT DEFAULT CURRENT_TIMESTAMP,
+    completed_at TEXT,
+    FOREIGN KEY(request_id) REFERENCES requests(id) ON DELETE CASCADE
+);

paypal-checkout.php

@@ -0,0 +1,167 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/includes/auth.php';
+
+$requestId = isset($_GET['request_id']) ? (int) $_GET['request_id'] : 0;
+if (!$requestId) {
+    http_response_code(400);
+    echo 'Keine Anfrage-ID angegeben';
+    exit;
+}
+
+$user = currentUser();
+
+// Get request details
+$stmt = db()->prepare('SELECT r.*, b.name as band_name, b.price as band_price
+    FROM requests r
+    JOIN bands b ON b.id = r.band_id
+    WHERE r.id = :id AND r.user_id = :user_id');
+$stmt->execute([':id' => $requestId, ':user_id' => $user['id']]);
+$request = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$request) {
+    http_response_code(404);
+    echo 'Anfrage nicht gefunden';
+    exit;
+}
+
+$settings = settings();
+if ($settings['paypal_enabled'] !== '1') {
+    http_response_code(403);
+    echo 'PayPal-Zahlungen sind derzeit nicht aktiviert';
+    exit;
+}
+
+// Calculate amounts
+$bandPrice = (int) $request['band_price'];
+$serviceFeePercent = (float) $settings['service_fee'];
+$serviceFee = $bandPrice * ($serviceFeePercent / 100);
+$totalAmount = $bandPrice + $serviceFee;
+
+// Check if already paid
+$stmt = db()->prepare('SELECT * FROM payments WHERE request_id = :id AND status = "completed"');
+$stmt->execute([':id' => $requestId]);
+$existingPayment = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if ($existingPayment) {
+    $message = 'Diese Buchung wurde bereits bezahlt.';
+}
+?>
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>PayPal Zahlung – <?= SITE_NAME ?></title>
+    <link rel="stylesheet" href="assets/css/style.css">
+</head>
+<body>
+    <header>
+        <a class="badge" href="profil.php">← Zurück zum Profil</a>
+        <h1>Zahlung für Buchung</h1>
+    </header>
+    <main style="max-width: 600px; margin: 0 auto;">
+        <?php if (isset($message)): ?>
+            <div class="alert alert-success"><?= htmlspecialchars($message) ?></div>
+        <?php else: ?>
+            <h2>Buchungsdetails</h2>
+            <table class="table" style="margin-bottom: 2rem;">
+                <tr><td><strong>Band:</strong></td><td><?= htmlspecialchars($request['band_name']) ?></td></tr>
+                <tr><td><strong>Event-Datum:</strong></td><td><?= htmlspecialchars($request['event_date']) ?></td></tr>
+                <tr><td><strong>Location:</strong></td><td><?= htmlspecialchars($request['location']) ?></td></tr>
+                <tr><td><strong>Event-Typ:</strong></td><td><?= htmlspecialchars($request['event_type']) ?></td></tr>
+            </table>
+
+            <h2>Zahlungsübersicht</h2>
+            <table class="table" style="margin-bottom: 2rem;">
+                <tr><td><strong>Band-Gage:</strong></td><td><?= formatPrice($bandPrice) ?></td></tr>
+                <tr><td><strong>Service Fee (<?= htmlspecialchars($serviceFeePercent) ?>%):</strong></td><td><?= formatPrice((int) $serviceFee) ?></td></tr>
+                <tr style="border-top: 2px solid #ffb703;"><td><strong>Gesamtbetrag:</strong></td><td><strong><?= formatPrice((int) $totalAmount) ?></strong></td></tr>
+            </table>
+
+            <div id="payment-status" style="display:none; padding: 1rem; margin-bottom: 1rem; border-radius: 4px;"></div>
+
+            <!-- PayPal Button Container -->
+            <div id="paypal-button-container" style="margin: 2rem 0;"></div>
+
+            <p style="color: #666; font-size: 0.875rem; margin-top: 2rem;">
+                <strong>Hinweis:</strong> Dies ist eine Demo-Integration. Für die Produktivumgebung benötigen Sie echte PayPal API-Credentials.
+                Aktuell wird im Sandbox-Modus gearbeitet.
+            </p>
+        <?php endif; ?>
+    </main>
+
+    <?php if (!isset($message)): ?>
+    <!-- PayPal SDK -->
+    <script src="https://www.paypal.com/sdk/js?client-id=YOUR_PAYPAL_CLIENT_ID&currency=CHF"></script>
+
+    <script>
+        paypal.Buttons({
+            createOrder: function(data, actions) {
+                return actions.order.create({
+                    purchase_units: [{
+                        amount: {
+                            value: '<?= number_format($totalAmount, 2, '.', '') ?>',
+                            currency_code: 'CHF',
+                            breakdown: {
+                                item_total: {
+                                    value: '<?= number_format($bandPrice, 2, '.', '') ?>',
+                                    currency_code: 'CHF'
+                                },
+                                tax_total: {
+                                    value: '<?= number_format($serviceFee, 2, '.', '') ?>',
+                                    currency_code: 'CHF'
+                                }
+                            }
+                        },
+                        description: 'Buchung: <?= htmlspecialchars($request['band_name']) ?> - <?= htmlspecialchars($request['event_date']) ?>'
+                    }]
+                });
+            },
+            onApprove: function(data, actions) {
+                return actions.order.capture().then(function(details) {
+                    // Save payment to database
+                    const statusDiv = document.getElementById('payment-status');
+                    statusDiv.style.display = 'block';
+                    statusDiv.style.background = '#28a745';
+                    statusDiv.style.color = 'white';
+                    statusDiv.textContent = 'Zahlung erfolgreich! Verarbeite Transaktion...';
+
+                    fetch('paypal-process.php', {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({
+                            request_id: <?= $requestId ?>,
+                            amount: <?= $bandPrice ?>,
+                            service_fee: <?= number_format($serviceFee, 2, '.', '') ?>,
+                            total_amount: <?= number_format($totalAmount, 2, '.', '') ?>,
+                            paypal_order_id: data.orderID,
+                            paypal_payer_id: details.payer.payer_id
+                        })
+                    })
+                    .then(response => response.json())
+                    .then(result => {
+                        if (result.success) {
+                            statusDiv.textContent = 'Zahlung erfolgreich abgeschlossen! Sie werden weitergeleitet...';
+                            setTimeout(() => {
+                                window.location.href = 'profil.php?payment_success=1';
+                            }, 2000);
+                        } else {
+                            statusDiv.style.background = '#dc3545';
+                            statusDiv.textContent = 'Fehler beim Speichern der Zahlung: ' + result.error;
+                        }
+                    });
+                });
+            },
+            onError: function(err) {
+                const statusDiv = document.getElementById('payment-status');
+                statusDiv.style.display = 'block';
+                statusDiv.style.background = '#dc3545';
+                statusDiv.style.color = 'white';
+                statusDiv.textContent = 'Fehler bei der Zahlung: ' + err;
+            }
+        }).render('#paypal-button-container');
+    </script>
+    <?php endif; ?>
+</body>
+</html>

paypal-process.php

@@ -0,0 +1,95 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/includes/auth.php';
+require_once __DIR__ . '/includes/email.php';
+requireLogin();
+
+header('Content-Type: application/json');
+
+$user = currentUser();
+
+// Get JSON input
+$input = json_decode(file_get_contents('php://input'), true);
+
+if (!$input || !isset($input['request_id'])) {
+    http_response_code(400);
+    echo json_encode(['error' => 'Ungültige Anfrage']);
+    exit;
+}
+
+$requestId = (int) $input['request_id'];
+$amount = (float) $input['amount'];
+$serviceFee = (float) $input['service_fee'];
+$totalAmount = (float) $input['total_amount'];
+$paypalOrderId = $input['paypal_order_id'] ?? '';
+$paypalPayerId = $input['paypal_payer_id'] ?? '';
+
+// Verify request belongs to user
+$stmt = db()->prepare('SELECT r.*, b.name as band_name, b.user_id as band_user_id
+    FROM requests r
+    JOIN bands b ON b.id = r.band_id
+    WHERE r.id = :id AND r.user_id = :user_id');
+$stmt->execute([':id' => $requestId, ':user_id' => $user['id']]);
+$request = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$request) {
+    http_response_code(404);
+    echo json_encode(['error' => 'Anfrage nicht gefunden']);
+    exit;
+}
+
+// Check if already paid
+$stmt = db()->prepare('SELECT * FROM payments WHERE request_id = :id AND status = "completed"');
+$stmt->execute([':id' => $requestId]);
+if ($stmt->fetch(PDO::FETCH_ASSOC)) {
+    http_response_code(400);
+    echo json_encode(['error' => 'Diese Buchung wurde bereits bezahlt']);
+    exit;
+}
+
+try {
+    // Save payment
+    $stmt = db()->prepare('INSERT INTO payments (request_id, amount, service_fee, total_amount, paypal_order_id, paypal_payer_id, status, completed_at)
+        VALUES (:request_id, :amount, :service_fee, :total_amount, :paypal_order_id, :paypal_payer_id, :status, :completed_at)');
+
+    $stmt->execute([
+        ':request_id' => $requestId,
+        ':amount' => $amount,
+        ':service_fee' => $serviceFee,
+        ':total_amount' => $totalAmount,
+        ':paypal_order_id' => $paypalOrderId,
+        ':paypal_payer_id' => $paypalPayerId,
+        ':status' => 'completed',
+        ':completed_at' => (new DateTimeImmutable())->format('c')
+    ]);
+
+    // Update request status to confirmed
+    $stmt = db()->prepare('UPDATE requests SET status = :status WHERE id = :id');
+    $stmt->execute([':status' => 'bestätigt', ':id' => $requestId]);
+
+    // Send confirmation emails
+    sendEmail($user['email'], 'Zahlungsbestätigung',
+        'Ihre Zahlung für die Buchung von ' . $request['band_name'] . ' wurde erfolgreich verarbeitet.');
+
+    // Notify band
+    if ($request['band_user_id']) {
+        $bandUserStmt = db()->prepare('SELECT email FROM users WHERE id = :id');
+        $bandUserStmt->execute([':id' => $request['band_user_id']]);
+        $bandUser = $bandUserStmt->fetch(PDO::FETCH_ASSOC);
+
+        if ($bandUser) {
+            sendEmail($bandUser['email'], 'Neue bezahlte Buchung',
+                'Sie haben eine neue bezahlte Buchung für ' . $request['event_date'] . ' erhalten.');
+        }
+    }
+
+    echo json_encode([
+        'success' => true,
+        'message' => 'Zahlung erfolgreich verarbeitet',
+        'payment_id' => (int) db()->lastInsertId()
+    ]);
+
+} catch (Exception $e) {
+    http_response_code(500);
+    echo json_encode(['error' => 'Fehler beim Speichern der Zahlung: ' . $e->getMessage()]);
+}

profil.php

@@ -66,20 +66,138 @@ if ($user['role'] === 'band') {
                 </label>
                 <button class="btn-primary">Speichern</button>
             </form>
+
+            <h2 style="margin-top: 2rem;">Band-Galerie</h2>
+            <div id="upload-status" style="display:none; padding: 1rem; margin-bottom: 1rem; background: #28a745; color: white; border-radius: 4px;"></div>
+            <div style="margin-bottom: 1rem;">
+                <label class="btn-primary" style="display: inline-block; cursor: pointer;">
+                    <input type="file" id="image-upload" accept="image/*" style="display: none;">
+                    + Bild hochladen
+                </label>
+                <small style="display: block; margin-top: 0.5rem; color: #666;">Max 5MB (JPG, PNG, GIF, WEBP)</small>
+            </div>
+            <div id="gallery" style="display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 1rem;">
+                <?php foreach (bandMedia((int) $band['id']) as $media): ?>
+                    <div class="gallery-item" data-media-id="<?= $media['id'] ?>">
+                        <img src="<?= htmlspecialchars($media['url']) ?>" alt="Band Foto" style="width: 100%; height: 200px; object-fit: cover; border-radius: 4px;">
+                        <button class="delete-image" data-id="<?= $media['id'] ?>" style="margin-top: 0.5rem; background: #dc3545; color: white; border: none; padding: 0.5rem 1rem; border-radius: 4px; cursor: pointer; width: 100%;">Löschen</button>
+                    </div>
+                <?php endforeach; ?>
+            </div>
+
+            <script>
+            document.getElementById('image-upload').addEventListener('change', function(e) {
+                const file = e.target.files[0];
+                if (!file) return;
+
+                const formData = new FormData();
+                formData.append('image', file);
+
+                const statusDiv = document.getElementById('upload-status');
+                statusDiv.style.display = 'block';
+                statusDiv.style.background = '#ffc107';
+                statusDiv.textContent = 'Uploading...';
+
+                fetch('upload-handler.php', {
+                    method: 'POST',
+                    body: formData
+                })
+                .then(response => response.json())
+                .then(data => {
+                    if (data.success) {
+                        statusDiv.style.background = '#28a745';
+                        statusDiv.textContent = data.message;
+
+                        // Add to gallery
+                        const gallery = document.getElementById('gallery');
+                        const div = document.createElement('div');
+                        div.className = 'gallery-item';
+                        div.setAttribute('data-media-id', data.id);
+                        div.innerHTML = `
+                            <img src="${data.url}" alt="Band Foto" style="width: 100%; height: 200px; object-fit: cover; border-radius: 4px;">
+                            <button class="delete-image" data-id="${data.id}" style="margin-top: 0.5rem; background: #dc3545; color: white; border: none; padding: 0.5rem 1rem; border-radius: 4px; cursor: pointer; width: 100%;">Löschen</button>
+                        `;
+                        gallery.appendChild(div);
+
+                        setTimeout(() => { statusDiv.style.display = 'none'; }, 3000);
+                    } else {
+                        statusDiv.style.background = '#dc3545';
+                        statusDiv.textContent = data.error;
+                    }
+                })
+                .catch(error => {
+                    statusDiv.style.background = '#dc3545';
+                    statusDiv.textContent = 'Upload fehlgeschlagen: ' + error.message;
+                });
+
+                e.target.value = '';
+            });
+
+            document.addEventListener('click', function(e) {
+                if (e.target.classList.contains('delete-image')) {
+                    if (!confirm('Bild wirklich löschen?')) return;
+
+                    const mediaId = e.target.getAttribute('data-id');
+                    const galleryItem = e.target.closest('.gallery-item');
+
+                    fetch('upload-handler.php', {
+                        method: 'DELETE',
+                        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                        body: 'media_id=' + mediaId
+                    })
+                    .then(response => response.json())
+                    .then(data => {
+                        if (data.success) {
+                            galleryItem.remove();
+                        } else {
+                            alert(data.error);
+                        }
+                    });
+                }
+            });
+            </script>
         <?php else: ?>
             <p>Du hast noch kein Bandprofil angelegt.</p>
         <?php endif; ?>
 
         <?php if ($user['role'] === 'kunde'): ?>
+            <?php if (isset($_GET['payment_success'])): ?>
+                <div class="alert alert-success">Zahlung erfolgreich abgeschlossen! Vielen Dank für Ihre Buchung.</div>
+            <?php endif; ?>
+
             <h2>Meine Anfragen</h2>
             <table class="table">
-                <thead><tr><th>Band</th><th>Datum</th><th>Status</th></tr></thead>
+                <thead><tr><th>Band</th><th>Datum</th><th>Status</th><th>Zahlung</th><th>Aktion</th></tr></thead>
                 <tbody>
-                    <?php foreach (userRequests((int) $user['id']) as $request): $bandName = findBand((int) $request['band_id']); ?>
+                    <?php
+                    $settings = settings();
+                    foreach (userRequests((int) $user['id']) as $request):
+                        $bandName = findBand((int) $request['band_id']);
+
+                        // Check payment status
+                        $stmt = db()->prepare('SELECT * FROM payments WHERE request_id = :id AND status = "completed"');
+                        $stmt->execute([':id' => $request['id']]);
+                        $payment = $stmt->fetch(PDO::FETCH_ASSOC);
+                    ?>
                         <tr>
                             <td><?= htmlspecialchars($bandName['name'] ?? 'Band #' . $request['band_id']) ?></td>
                             <td><?= htmlspecialchars($request['event_date']) ?></td>
                             <td><?= htmlspecialchars($request['status']) ?></td>
+                            <td>
+                                <?php if ($payment): ?>
+                                    <span style="color: #28a745;">✓ Bezahlt</span><br>
+                                    <small style="color: #666;"><?= formatPrice((int) $payment['total_amount']) ?></small>
+                                <?php else: ?>
+                                    <span style="color: #dc3545;">Ausstehend</span>
+                                <?php endif; ?>
+                            </td>
+                            <td>
+                                <?php if (!$payment && $settings['paypal_enabled'] === '1'): ?>
+                                    <a href="paypal-checkout.php?request_id=<?= $request['id'] ?>" class="badge" style="background: #0070ba; color: white; text-decoration: none;">
+                                        PayPal bezahlen
+                                    </a>
+                                <?php endif; ?>
+                            </td>
                         </tr>
                     <?php endforeach; ?>
                 </tbody>

synth/index.php

@@ -0,0 +1,184 @@
+<?php
+$btcPrice = null;
+$btcChange = null;
+$btcSource = 'https://api.coindesk.com/v1/bpi/currentprice/USD.json';
+try {
+    $response = @file_get_contents($btcSource);
+    if ($response !== false) {
+        $payload = json_decode($response, true);
+        if (isset($payload['bpi']['USD']['rate_float'])) {
+            $btcPrice = (float) $payload['bpi']['USD']['rate_float'];
+        }
+        if (isset($payload['chartName'])) {
+            $btcChange = $payload['chartName'];
+        }
+
+        
+    }
+} catch (Throwable $e) {
+    // Silently ignore network failures, we degrade gracefully in the UI.
+}
+
+
+$btcLabel = $btcPrice ? number_format($btcPrice, 2) . ' $' : 'unbekannt';
+?>
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+
+    
+    <title>Mouse Synth Lab</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;600&display=swap" rel="stylesheet">
+    <style>
+        :root {
+            color-scheme: dark;
+            font-family: 'Space Grotesk', system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+            background: radial-gradient(circle at top, #10152b, #050608 60%);
+            color: #e4f6ff;
+        }
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            justify-content: center;
+            gap: 2rem;
+            padding: 2rem;
+        }
+        .panel {
+            background: rgba(15, 18, 40, 0.85);
+            border: 1px solid rgba(102, 204, 255, 0.25);
+            border-radius: 20px;
+            padding: 2rem;
+            width: min(960px, 100%);
+            box-shadow: 0 30px 60px rgba(5, 10, 50, 0.55);
+            backdrop-filter: blur(10px);
+        }
+        h1 {
+            margin: 0 0 1rem 0;
+            font-size: clamp(2rem, 4vw, 3rem);
+            letter-spacing: 0.04em;
+            text-transform: uppercase;
+        }
+        p {
+            margin: 0 0 1rem 0;
+            line-height: 1.6;
+        }
+        .synth-pad {
+            border-radius: 24px;
+            background: linear-gradient(135deg, rgba(35, 58, 122, 0.9), rgba(161, 92, 255, 0.75));
+            border: 1px solid rgba(255,255,255,0.2);
+            height: 320px;
+            position: relative;
+            overflow: hidden;
+            cursor: crosshair;
+        }
+        .synth-pad::after {
+            content: "";
+            position: absolute;
+            inset: 1rem;
+            border: 1px dashed rgba(255,255,255,0.2);
+            border-radius: 18px;
+        }
+        .pad-indicator {
+            position: absolute;
+            width: 20px;
+            height: 20px;
+            border-radius: 50%;
+            border: 2px solid #ffffff;
+            pointer-events: none;
+            transform: translate(-50%, -50%);
+            transition: transform 0.1s ease-out;
+        }
+        .controls {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+            gap: 1rem;
+            margin-top: 1.5rem;
+        }
+        label {
+            font-size: 0.85rem;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: rgba(255,255,255,0.65);
+        }
+        input[type="range"] {
+            width: 100%;
+        }
+        button {
+            border: none;
+            border-radius: 999px;
+            padding: 0.85rem 1.8rem;
+            font-size: 1rem;
+            cursor: pointer;
+            background: linear-gradient(135deg, #6a5af9, #32d9ff);
+            color: #050608;
+            font-weight: 600;
+            text-transform: uppercase;
+            letter-spacing: 0.08em;
+            transition: transform 0.2s ease, box-shadow 0.2s ease;
+        }
+        button:hover {
+            transform: translateY(-2px);
+            box-shadow: 0 20px 30px rgba(50, 217, 255, 0.3);
+        }
+        .status {
+            font-size: 0.9rem;
+            color: rgba(255,255,255,0.7);
+            display: flex;
+            flex-direction: column;
+            gap: 0.3rem;
+        }
+        .status span {
+            font-weight: 600;
+            color: #7fffd4;
+        }
+    </style>
+</head>
+<body data-btc-price="<?= htmlspecialchars((string) ($btcPrice ?? '')) ?>">
+    <div class="panel">
+        <h1>Mouse Synth Lab</h1>
+        <p>
+            Zieh deine Maus durch den Pad und verwandle Bewegungen in Klang. Drei LFOs,
+            FM-Experimente und ein Delay/Distortion-Hybrid werden live verschaltet.
+            Der aktuelle Bitcoin-Kurs (<strong><?= htmlspecialchars($btcLabel) ?></strong>)
+            steuert, wie aggressiv der Mix moduliert und rückgekoppelt wird.
+        </p>
+        <div class="status" id="btc-status">
+            <div>Bitcoin Quelle: <span><?= htmlspecialchars($btcSource) ?></span></div>
+            <div>Letzter Wert: <span><?= htmlspecialchars($btcLabel) ?></span></div>
+        </div>
+        <div class="controls">
+            <div>
+                <label for="fm-depth">FM-Intensität</label>
+                <input id="fm-depth" type="range" min="10" max="800" value="320">
+            </div>
+            <div>
+                <label for="lfo-speed">LFO-Speed</label>
+                <input id="lfo-speed" type="range" min="0.05" max="18" value="6" step="0.05">
+            </div>
+            <div>
+                <label for="texture">Texture Morph</label>
+                <input id="texture" type="range" min="0" max="1" step="0.01" value="0.4">
+            </div>
+            <div style="display:flex;align-items:end;gap:0.75rem;">
+                <button id="start-btn">Synth starten</button>
+                <button id="randomize-btn" type="button">Chaos Patch</button>
+            </div>
+        </div>
+        <div class="synth-pad" id="synth-pad">
+            <div class="pad-indicator" id="pad-indicator" style="left:50%;top:50%;"></div>
+        </div>
+        <p style="font-size:0.9rem;color:rgba(255,255,255,0.65);margin-top:1.5rem;">
+            Tipp: Halte die Maus gedrückt, damit der AudioContext aktiv bleibt, und lass den Cursor
+            Kreise fahren. Je nach Bitcoin-Laune schalten sich neue Rückkopplungen zu.
+        </p>
+    </div>
+    <script src="synth.js" type="module"></script>
+</body>
+</html>

synth/synth.js

@@ -0,0 +1,262 @@
+const btcPrice = parseFloat(document.body.dataset.btcPrice || 'NaN');
+const normalizedCoin = Number.isFinite(btcPrice)
+  ? Math.min(Math.max((btcPrice - 15000) / 25000, 0), 1)
+  : 0.5;
+
+const pad = document.getElementById('synth-pad');
+const indicator = document.getElementById('pad-indicator');
+const fmDepthInput = document.getElementById('fm-depth');
+const lfoSpeedInput = document.getElementById('lfo-speed');
+const textureInput = document.getElementById('texture');
+const startBtn = document.getElementById('start-btn');
+const randomizeBtn = document.getElementById('randomize-btn');
+
+class MouseSynth {
+  constructor(options = {}) {
+    const AudioContext = window.AudioContext || window.webkitAudioContext;
+    this.ctx = new AudioContext();
+    this.started = false;
+
+    this.coinBlend = options.coinBlend ?? 0.5;
+
+    this.setupNodes();
+    this.#bindEvents();
+  }
+
+  setupNodes() {
+    const ctx = this.ctx;
+
+    this.masterGain = ctx.createGain();
+    this.masterGain.gain.value = 0.0;
+
+    this.carrier = ctx.createOscillator();
+    this.carrier.type = 'sawtooth';
+
+    this.harmonic = ctx.createOscillator();
+    this.harmonic.type = 'triangle';
+    this.harmonic.detune.value = 702; // perfect fifth
+
+    this.fmOsc = ctx.createOscillator();
+    this.fmGain = ctx.createGain();
+    this.fmGain.gain.value = 320;
+
+    this.ampLfo = ctx.createOscillator();
+    this.ampLfo.type = 'sine';
+    this.ampLfo.frequency.value = 6;
+    this.ampLfoGain = ctx.createGain();
+    this.ampLfoGain.gain.value = 0.5;
+
+    this.filterLfo = ctx.createOscillator();
+    this.filterLfo.type = 'triangle';
+    this.filterLfo.frequency.value = 0.5;
+    this.filterLfoGain = ctx.createGain();
+    this.filterLfoGain.gain.value = 800;
+
+    this.sampleHold = ctx.createOscillator();
+    this.sampleHold.type = 'square';
+    this.sampleHold.frequency.value = 8;
+    this.sampleHoldGain = ctx.createGain();
+    this.sampleHoldGain.gain.value = 0.0025;
+
+    this.filter = ctx.createBiquadFilter();
+    this.filter.type = 'bandpass';
+    this.filter.frequency.value = 600;
+    this.filter.Q.value = 8;
+
+    this.delay = ctx.createDelay(1.2);
+    this.delay.delayTime.value = 0.45;
+    this.feedback = ctx.createGain();
+    this.feedback.gain.value = 0.32;
+
+    this.noise = this.#createNoise();
+    this.noiseGain = ctx.createGain();
+    this.noiseGain.gain.value = 0.0;
+
+    this.distortion = ctx.createWaveShaper();
+    this.#setDrive(400);
+
+    this.coinMorph = ctx.createGain();
+    this.coinMorph.gain.value = this.coinBlend;
+
+    this.reverb = ctx.createConvolver();
+    this.reverb.buffer = this.#makeImpulse(2.5);
+    this.reverbGain = ctx.createGain();
+    this.reverbGain.gain.value = 0.25;
+
+    // Connections
+    this.fmOsc.connect(this.fmGain).connect(this.carrier.frequency);
+    this.harmonic.connect(this.filter);
+    this.carrier.connect(this.filter);
+    this.ampLfo.connect(this.ampLfoGain).connect(this.masterGain.gain);
+    this.filterLfo.connect(this.filterLfoGain).connect(this.filter.frequency);
+    this.sampleHold.connect(this.sampleHoldGain).connect(this.filter.detune);
+
+    this.filter.connect(this.distortion);
+    this.noise.connect(this.noiseGain).connect(this.filter);
+
+    const wet = ctx.createGain();
+    const dry = ctx.createGain();
+    this.distortion.connect(dry).connect(this.masterGain);
+    this.distortion.connect(this.delay);
+    this.delay.connect(this.feedback).connect(this.delay);
+    this.delay.connect(this.coinMorph);
+    this.coinMorph.connect(wet);
+    wet.connect(this.reverb);
+    this.reverb.connect(this.reverbGain).connect(this.masterGain);
+
+    this.masterGain.connect(ctx.destination);
+
+    this.carrier.start();
+    this.harmonic.start();
+    this.fmOsc.start();
+    this.ampLfo.start();
+    this.filterLfo.start();
+    this.sampleHold.start();
+    this.noise.start();
+  }
+
+  async start() {
+    if (this.started) return;
+    await this.ctx.resume();
+    this.masterGain.gain.linearRampToValueAtTime(0.8, this.ctx.currentTime + 0.5);
+    this.started = true;
+  }
+
+  #bindEvents() {
+    fmDepthInput.addEventListener('input', () => {
+      this.fmGain.gain.setTargetAtTime(parseFloat(fmDepthInput.value), this.ctx.currentTime, 0.05);
+    });
+
+    lfoSpeedInput.addEventListener('input', () => {
+      const rate = parseFloat(lfoSpeedInput.value);
+      this.ampLfo.frequency.setTargetAtTime(rate, this.ctx.currentTime, 0.1);
+      this.filterLfo.frequency.setTargetAtTime(rate * 0.25, this.ctx.currentTime, 0.1);
+    });
+
+    textureInput.addEventListener('input', () => {
+      this.#updateTexture(parseFloat(textureInput.value));
+    });
+
+    randomizeBtn.addEventListener('click', () => this.randomize());
+  }
+
+  handlePointer(event) {
+    if (!this.started) return;
+    const rect = pad.getBoundingClientRect();
+    const x = (event.clientX - rect.left) / rect.width;
+    const y = (event.clientY - rect.top) / rect.height;
+    const freq = 120 + (1 - y) * 1080;
+
+    this.carrier.frequency.setTargetAtTime(freq, this.ctx.currentTime, 0.05);
+    this.harmonic.frequency.setTargetAtTime(freq * 1.5, this.ctx.currentTime, 0.05);
+    this.filter.frequency.setTargetAtTime(200 + x * 5200, this.ctx.currentTime, 0.08);
+    this.filter.Q.setTargetAtTime(4 + y * 18, this.ctx.currentTime, 0.1);
+    this.noiseGain.gain.setTargetAtTime(x * 0.3, this.ctx.currentTime, 0.2);
+
+    this.sampleHold.frequency.setTargetAtTime(4 + x * 20, this.ctx.currentTime, 0.1);
+    this.delay.delayTime.setTargetAtTime(0.15 + y * 0.6, this.ctx.currentTime, 0.2);
+    this.feedback.gain.setTargetAtTime(0.2 + x * 0.7 * this.coinBlend, this.ctx.currentTime, 0.2);
+    this.coinMorph.gain.setTargetAtTime(this.coinBlend * (0.4 + y * 0.6), this.ctx.currentTime, 0.3);
+    this.fmGain.gain.setTargetAtTime(parseFloat(fmDepthInput.value) + x * 200, this.ctx.currentTime, 0.05);
+    this.#updateTexture(textureInput.value, x, y);
+  }
+
+  handlePointerLeave() {
+    if (!this.started) return;
+    this.masterGain.gain.cancelScheduledValues(this.ctx.currentTime);
+    this.masterGain.gain.setTargetAtTime(0.15, this.ctx.currentTime, 0.5);
+  }
+
+  randomize() {
+    const fm = 80 + Math.random() * 720;
+    fmDepthInput.value = fm.toFixed(0);
+    this.fmGain.gain.setTargetAtTime(fm, this.ctx.currentTime, 0.1);
+
+    const lfo = 0.1 + Math.random() * 16;
+    lfoSpeedInput.value = lfo.toFixed(2);
+    this.ampLfo.frequency.setTargetAtTime(lfo, this.ctx.currentTime, 0.2);
+    this.filterLfo.frequency.setTargetAtTime(lfo * 0.3, this.ctx.currentTime, 0.2);
+
+    const texture = Math.random();
+    textureInput.value = texture.toFixed(2);
+    this.#updateTexture(texture);
+  }
+
+  #updateTexture(value, x = 0.5, y = 0.5) {
+    const amount = parseFloat(value);
+    const drive = 150 + amount * 850 + this.coinBlend * 400;
+    this.#setDrive(drive);
+    const morph = amount * (0.6 + this.coinBlend * 0.8);
+    this.distortion.oversample = morph > 0.5 ? '4x' : '2x';
+    this.reverbGain.gain.setTargetAtTime(0.15 + morph * 0.6, this.ctx.currentTime, 0.3);
+    const filterType = morph > 0.7 ? 'notch' : morph > 0.35 ? 'bandpass' : 'lowpass';
+    this.filter.type = filterType;
+    this.coinMorph.gain.setTargetAtTime(this.coinBlend * (0.4 + morph), this.ctx.currentTime, 0.3);
+    this.delay.delayTime.setTargetAtTime(0.2 + morph * 0.4 + (x * y) * 0.2, this.ctx.currentTime, 0.2);
+  }
+
+  #setDrive(amount) {
+    const curve = new Float32Array(1024);
+    for (let i = 0; i < curve.length; i++) {
+      const x = (i / curve.length) * 2 - 1;
+      curve[i] = Math.tanh(x * amount * 0.01);
+    }
+    this.distortion.curve = curve;
+  }
+
+  #createNoise() {
+    const buffer = this.ctx.createBuffer(1, this.ctx.sampleRate * 4, this.ctx.sampleRate);
+    const data = buffer.getChannelData(0);
+    for (let i = 0; i < data.length; i++) {
+      data[i] = Math.random() * 2 - 1;
+    }
+    const noise = this.ctx.createBufferSource();
+    noise.buffer = buffer;
+    noise.loop = true;
+    return noise;
+  }
+
+  #makeImpulse(seconds) {
+    const rate = this.ctx.sampleRate;
+    const length = rate * seconds;
+    const impulse = this.ctx.createBuffer(2, length, rate);
+    for (let ch = 0; ch < 2; ch++) {
+      const data = impulse.getChannelData(ch);
+      for (let i = 0; i < length; i++) {
+        data[i] = (Math.random() * 2 - 1) * Math.pow(1 - i / length, 2);
+      }
+    }
+    return impulse;
+  }
+}
+
+const synth = new MouseSynth({ coinBlend: normalizedCoin });
+
+startBtn.addEventListener('click', () => synth.start());
+
+pad.addEventListener('pointerdown', async (event) => {
+  await synth.start();
+  pad.setPointerCapture(event.pointerId);
+  indicator.style.opacity = '1';
+});
+
+pad.addEventListener('pointermove', (event) => {
+  indicator.style.left = `${event.offsetX}px`;
+  indicator.style.top = `${event.offsetY}px`;
+  synth.handlePointer(event);
+});
+
+pad.addEventListener('pointerup', (event) => {
+  pad.releasePointerCapture(event.pointerId);
+  synth.handlePointerLeave();
+});
+
+pad.addEventListener('pointerleave', () => synth.handlePointerLeave());
+
+if (!Number.isFinite(btcPrice)) {
+  const status = document.getElementById('btc-status');
+  if (status) {
+    status.insertAdjacentHTML('beforeend', '<div style="color:#ffa3a3;">BTC Feed nicht erreichbar – Synth läuft im Fantasy-Modus.</div>');
+  }
+}
+

upload-handler.php

@@ -0,0 +1,120 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/includes/auth.php';
+requireLogin();
+
+header('Content-Type: application/json');
+
+$user = currentUser();
+if ($user['role'] !== 'band') {
+    http_response_code(403);
+    echo json_encode(['error' => 'Nur Bands können Bilder hochladen']);
+    exit;
+}
+
+// Get band
+$stmt = db()->prepare('SELECT * FROM bands WHERE user_id = :id');
+$stmt->execute([':id' => $user['id']]);
+$band = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$band) {
+    http_response_code(404);
+    echo json_encode(['error' => 'Kein Bandprofil gefunden']);
+    exit;
+}
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['image'])) {
+    $file = $_FILES['image'];
+
+    // Validate file
+    $allowedTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
+    $maxSize = 5 * 1024 * 1024; // 5MB
+
+    if (!in_array($file['type'], $allowedTypes)) {
+        http_response_code(400);
+        echo json_encode(['error' => 'Ungültiger Dateityp. Erlaubt sind: JPG, PNG, GIF, WEBP']);
+        exit;
+    }
+
+    if ($file['size'] > $maxSize) {
+        http_response_code(400);
+        echo json_encode(['error' => 'Datei zu groß (max 5MB)']);
+        exit;
+    }
+
+    if ($file['error'] !== UPLOAD_ERR_OK) {
+        http_response_code(500);
+        echo json_encode(['error' => 'Upload-Fehler']);
+        exit;
+    }
+
+    // Generate unique filename
+    $extension = pathinfo($file['name'], PATHINFO_EXTENSION);
+    $filename = 'band_' . $band['id'] . '_' . uniqid() . '.' . $extension;
+    $uploadPath = __DIR__ . '/storage/uploads/bands/' . $filename;
+
+    // Move file
+    if (!move_uploaded_file($file['tmp_name'], $uploadPath)) {
+        http_response_code(500);
+        echo json_encode(['error' => 'Datei konnte nicht gespeichert werden']);
+        exit;
+    }
+
+    // Save to database
+    $url = 'storage/uploads/bands/' . $filename;
+    $stmt = db()->prepare('INSERT INTO band_media (band_id, type, url) VALUES (:band_id, :type, :url)');
+    $stmt->execute([
+        ':band_id' => $band['id'],
+        ':type' => 'image',
+        ':url' => $url
+    ]);
+
+    $mediaId = (int) db()->lastInsertId();
+
+    echo json_encode([
+        'success' => true,
+        'id' => $mediaId,
+        'url' => $url,
+        'message' => 'Bild erfolgreich hochgeladen'
+    ]);
+    exit;
+}
+
+// Delete image
+if ($_SERVER['REQUEST_METHOD'] === 'DELETE') {
+    parse_str(file_get_contents('php://input'), $deleteData);
+    $mediaId = (int) ($deleteData['media_id'] ?? 0);
+
+    if (!$mediaId) {
+        http_response_code(400);
+        echo json_encode(['error' => 'Keine Media-ID angegeben']);
+        exit;
+    }
+
+    // Check ownership
+    $stmt = db()->prepare('SELECT * FROM band_media WHERE id = :id AND band_id = :band_id');
+    $stmt->execute([':id' => $mediaId, ':band_id' => $band['id']]);
+    $media = $stmt->fetch(PDO::FETCH_ASSOC);
+
+    if (!$media) {
+        http_response_code(404);
+        echo json_encode(['error' => 'Bild nicht gefunden']);
+        exit;
+    }
+
+    // Delete file
+    $filePath = __DIR__ . '/' . $media['url'];
+    if (file_exists($filePath) && strpos($media['url'], 'storage/uploads/') === 0) {
+        unlink($filePath);
+    }
+
+    // Delete from database
+    $stmt = db()->prepare('DELETE FROM band_media WHERE id = :id');
+    $stmt->execute([':id' => $mediaId]);
+
+    echo json_encode(['success' => true, 'message' => 'Bild gelöscht']);
+    exit;
+}
+
+http_response_code(400);
+echo json_encode(['error' => 'Ungültige Anfrage']);