diff --git a/app/Http/Controllers/BookingController.php b/app/Http/Controllers/BookingController.php
index 6046ce03..f97afe4a 100644
--- a/app/Http/Controllers/BookingController.php
+++ b/app/Http/Controllers/BookingController.php
@@ -4,11 +4,13 @@ namespace App\Http\Controllers;
 
 use App\PurchaseOrder;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
 use App\Booking;
 use App\Rate;
 use App\UserBankSlip;
 use App\User;
 use Auth;
+use Validator;
 
 class BookingController extends Controller
 {
@@ -115,77 +117,95 @@ class BookingController extends Controller
 
     public function uploadbankslip(Request $request, $id)
     {
-        $post = User::find($id);
-        if (!$post)
+        $user_bankslip = Booking::where("user_id", Auth::user()->id)->first();
+        if (!$user_bankslip)
         {
-            return response()->json(['message'=>'Access denied'],401);
+            return response()->json(['message'=>'Access denied'], 200);
         }
 
-        // Handle File Upload
-        if($request->hasFile('bankslip_url')){
-            // Get filename with the extension
-            $filenameWithExt = $request->file('bankslip_url')->getClientOriginalName();
-            // Get just filename
-            $filename = pathinfo($filenameWithExt, PATHINFO_FILENAME);
-            // Get just ext
-            $extension = $request->file('bankslip_url')->getClientOriginalExtension();
-            // Filename to store
-            $fileNameToStore= $filename.'_'.time().'.'.$extension;
-            // Upload Image
-            $path = $request->file('bankslip_url')->storeAs('public/userbankslip', $fileNameToStore);
-        } else {
-            return response()->json(['message'=>'No file detected'],400);
+        $validator = Validator::make($request->all(), [
+            'bankslip_url'   => 'image|mimes:jpg,jpeg,bmp,png'
+        ]);
 
+        if($validator->fails())
+        {
+            return response()->json(['message'=>'Incorrect format'],200);
         }
 
+        if($file = $request->file('bankslip_url'))
+        {
+            $bankslip_url = $request->file('bankslip_url');
+            $filename = $bankslip_url->getClientOriginalName();
+            $unique_name = 'bank_slip_' . md5($filename. time());
+
+            $file = $request->file('bankslip_url');
+            $ext = $file->getClientOriginalExtension();
+            $input['bankslip_url'] = $filename;
+            Storage::putFileAs(
+                'bankslip_url',/*folder name*/ $file, $unique_name. '.' .$ext
+            );
+            $user_bankslip->bankslip_url = $unique_name. '.' .$ext; //update database
+        } //end if
+        else {
+            return response()->json(['message' => 'No file detected'], 400);
+        }
+
+
         $booking = Booking::find($id);
         $booking->cust_marking = $request->input('cust_marking');
         $booking->bank_slip_type = $request->input('bank_slip_type');
 
         // Create Post
-        $post = new UserBankSlip;
-        $post->book_id = $booking->id;
-        $post->transfer_amount = $request->input('transfer_amount');
-        $post->bankslip_url = $fileNameToStore;
-        $post->save();
-        return response()->json(['message'=>'Success'],201);
+        $user_bankslip = new UserBankSlip;
+        $user_bankslip->book_id = $booking->id;
+        $user_bankslip->transfer_amount = $request->input('transfer_amount');
+        $user_bankslip->save();
 
+        return response()->json(['message'=>$user_bankslip],200);
 
     }
 
     public function uploadPurchaseOrder(Request $request, $id)
     {
-        $post = User::where("user_id", Auth::user()->id)->first();
-        if (!$post)
+        $user_po = Booking::where("user_id", Auth::user()->id)->first();
+        if (!$user_po)
         {
-            return response()->json(['message'=>'Access denied'], 401);
+            return response()->json(['message'=>'Access denied'], 200);
         }
 
-        // Handle File Upload
-        if($request->hasFile('image_url')){
-            // Get filename with the extension
-            $filenameWithExt = $request->file('image_url')->getClientOriginalName();
-            // Get just filename
-            $filename = pathinfo($filenameWithExt, PATHINFO_FILENAME);
-            // Get just ext
-            $extension = $request->file('image_url')->getClientOriginalExtension();
-            // Filename to store
-            $fileNameToStore= $filename.'_'.time().'.'.$extension;
-            // Upload Image
-            $path = $request->file('image_url')->storeAs('public/userPurchaseOrder', $fileNameToStore);
-        } else {
-            return response()->json(['message'=>'No file detected'],400);
+        $validator = Validator::make($request->all(), [
+            'image_url'   => 'image|mimes:jpg,jpeg,bmp,png'
+        ]);
+
+        if($validator->fails())
+        {
+            return response()->json(['message'=>'Incorrect format'],200);
+        }
+
+        if($file = $request->file('image_url'))
+        {
+            $image_url = $request->file('image_url');
+            $filename = $image_url->getClientOriginalName();
+            $unique_name = 'purchase_order_' . md5($filename. time());
+
+            $file = $request->file('image_url');
+            $ext = $file->getClientOriginalExtension();
+            $input['image_url'] = $filename;
+            Storage::putFileAs(
+                'image_url',/*folder name*/ $file, $unique_name. '.' .$ext
+            );
+            $user_po->image_url = $unique_name. '.' .$ext; //update database
+        } //end if
+        else {
+            return response()->json(['message' => 'No file detected'], 400);
         }
 
         $booking = Booking::find($id);
-
-        // Create Post
-        $post = new PurchaseOrder;
-        $post->book_id = $booking->id;
-        $post->amount = $request->input('amount');
-        $post->image_url = $fileNameToStore;
-        $post->save();
-        return response()->json(['message'=>'Success'],201);
+        $user_po = new PurchaseOrder;
+        $user_po->book_id = $booking->id;
+        $user_po->amount = $request->input('amount');
+        $user_po->save();
+        return response()->json(['message'=>'Success'],200);
     }
 
     public function update(Request $request, $book_id)
diff --git a/tests/Unit/BookingTest.php b/tests/Unit/BookingTest.php
index 3f23ea6d..9e198b4f 100644
--- a/tests/Unit/BookingTest.php
+++ b/tests/Unit/BookingTest.php
@@ -63,10 +63,11 @@ class BookingTest extends TestCase
 
         $response = $this->json('POST', '/api/booking/1/upload-user-bankslip', [
             'bankslip_url' => UploadedFile::fake()->image('comp.jpg'),
-            'transfer_amount' => '12345'
+            'transfer_amount' => '9000'
         ]);
+
         dd($response->getContent());
-        $response->assertStatus(201);
+        $response->assertStatus(200);
     }
 
     public function testuploadPO()
@@ -78,38 +79,7 @@ class BookingTest extends TestCase
             'amount' => '12345'
         ]);
         dd($response->getContent());
-        $response->assertStatus(201);
+        $response->assertStatus(200);
     }
 
-
-//    function upload_bankslip_test()
-//    {
-//        Storage::fake('public');
-//
-//        $this->json('post', '/api/booking/1/upload-user-bankslip', [
-//            'bankslip_url' => $file = UploadedFile::fake()->image('random.jpg'),
-//            'transfer_amount' => '12345',
-//        ]);
-//
-//        $this->assertEquals('file/' . $file->hashName(), Upload::latest()->first()->file);
-//
-//        Storage::disk('public')->assertExists('file/' . $file->hashName());
-//
-//    }
-//
-//    function upload_po_test()
-//    {
-//        Storage::fake('public');
-//
-//        $this->json('post', '/api/booking/1/upload-po', [
-//            'image_url' => $file = UploadedFile::fake()->image('random.jpg'),
-//            'amount' => '12345',
-//        ]);
-//
-//        $this->assertEquals('file/' . $file->hashName(), Upload::latest()->first()->file);
-//
-//        Storage::disk('public')->assertExists('file/' . $file->hashName());
-//
-//    }
-
 }
\ No newline at end of file