✏ 编辑: admin_change_password.php

<?php
session_start();

// Database connection
$servername = "localhost";
$username = "askmanisha_newuser";
$password = "Webgennie@developers";
$dbname = "askmanisha_astrology_site";

$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $entered_otp = $_POST['otp'];
    $new_password = mysqli_real_escape_string($conn, $_POST['password']);
    
    // Check if OTP exists in session
    if (!isset($_SESSION['reset_otp']) || !isset($_SESSION['otp_expiry']) || !isset($_SESSION['reset_admin_id'])) {
        $_SESSION['message'] = '<div class="alert alert-danger">Invalid request. Please request OTP again.</div>';
        header("Location: ../login.php");
        exit();
    }
    
    // Check if OTP has expired
    if (time() > $_SESSION['otp_expiry']) {
        unset($_SESSION['reset_otp']);
        unset($_SESSION['otp_expiry']);
        unset($_SESSION['reset_admin_id']);
        $_SESSION['message'] = '<div class="alert alert-danger">OTP has expired. Please request a new one.</div>';
        header("Location: ../login.php");
        exit();
    }
    
    // Verify OTP
    if ($entered_otp == $_SESSION['reset_otp']) {
        $admin_id = $_SESSION['reset_admin_id'];
        
        // Update password (plain text)
        $sql = "UPDATE admin_users SET password = ? WHERE id = ?";
        $stmt = $conn->prepare($sql);
        $stmt->bind_param("si", $new_password, $admin_id);
        
        if ($stmt->execute()) {
            // Clear OTP session
            unset($_SESSION['reset_otp']);
            unset($_SESSION['otp_expiry']);
            unset($_SESSION['reset_admin_id']);
            
            $_SESSION['message'] = '<div class="alert alert-success">Password changed successfully! Please login with your new password.</div>';
            header("Location: ../login.php");
            exit();
        } else {
            $_SESSION['message'] = '<div class="alert alert-danger">Error updating password. Please try again.</div>';
            header("Location: ../login.php");
            exit();
        }
        
        $stmt->close();
    } else {
        $_SESSION['message'] = '<div class="alert alert-danger">Invalid OTP. Please try again.</div>';
        header("Location: ../login.php");
        exit();
    }
}

$conn->close();
?>

[X] 取消