diff --git a/bulitipp/tippeintragen.php b/bulitipp/tippeintragen.php
index 397c61a..b7f4394 100755
--- a/bulitipp/tippeintragen.php
+++ b/bulitipp/tippeintragen.php
@@ -1,12 +1,32 @@
 <?php
+header("Access-Control-Allow-Origin: *");
+header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
+header("Access-Control-Allow-Headers: Authorization");
+
+if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
+    http_response_code(200);
+    exit;
+}
+
+
 require '../vendor/autoload.php';
 use Firebase\JWT\JWT;
 use Firebase\JWT\Key;
 
 include("jwtsecret.php");
+include("../../mysqlverbinden.php");
 
-if(!isset($_GET["token"])) die("GET token fehlt");
-$token=$_GET["token"];
+$headers = getallheaders();
+if(isset($headers['Authorization'])) {
+    $authHeader = $headers['Authorization'];
+    if (preg_match('/Bearer\s(\S+)/', $authHeader, $matches)) {
+        $token = $matches[1];
+    } else {
+        die("Invalid Authorization header format");
+    }
+} else {
+    die("Authorization header not found");
+}
 
 $payload = JWT::decode($token, new Key($secret, 'HS256'));
 
@@ -14,5 +34,21 @@ if($payload->exp < time()){
     die("Token abgelaufen");
 }
 
-print_r($payload);
+if(!isset($_GET["spieltag"])) die("GET spieltag fehlt");
+$spieltag = $_GET["spieltag"];
 
+if(!isset($_GET["tipps"])) die("GET tipps fehlt");
+$tipps = json_decode($_GET["tipps"],true);
+
+$tippids=[];
+foreach($tipps as $tipp){
+    $paarungsid = $tipp['paarung']["id"];
+    $score1 = $tipp['heim'];
+    $score2 = $tipp['gast'];
+    mysqli_execute_query($db_id,"INSERT INTO `buli-tipp` (`spieltag`,`paarung`,`score1`,`score2`) VALUES (?,?,?,?);",[$spieltag,$paarungsid,$score1,$score2]);
+    $tippids[] = mysqli_insert_id($db_id);
+}
+array_push($tippids, $spieltag);
+array_push($tippids, $payload->id);
+
+mysqli_execute_query($db_id,"INSERT INTO `buli-tipps` (`tipp1`, `tipp2`, `tipp3`, `tipp4`, `tipp5`, `tipp6`, `tipp7`, `tipp8`, `tipp9`, `spieltag`, `user`) VALUES (?,?,?,?,?,?,?,?,?,?,?);",$tippids);