<?php
session_start();
include 'dbconn.php'; // your database connection

$email = $_POST['email'] ?? '';
$pass1 = $_POST['npassword'] ?? '';
$pass2 = $_POST['cpassword'] ?? '';

if ($pass1 !== $pass2) {
  echo "<script>alert('Passwords do not match.'); window.history.back();</script>";
  exit;
}

if ($email !== $_SESSION['otp_email']) {
  echo "<script>alert('Email verification mismatch.'); window.history.back();</script>";
  exit;
}

$hashed = password_hash($pass1, PASSWORD_BCRYPT);
$stmt = $mysqli->prepare("UPDATE clinics SET pass=? WHERE email=?");
$stmt->bind_param("ss", $hashed, $email);

if ($stmt->execute()) {
  // ✅ Password updated — redirect to login
  echo "<script>alert('Password updated successfully.'); window.location.href='index.php';</script>";
} else {
  echo "<script>alert('Failed to update password.'); window.history.back();</script>";
}
?>
