<?php
session_start();
include 'dbcon.php'; // your database connection file

$email = $_POST['email'] ?? '';
$pass1 = $_POST['npassword'] ?? '';
$pass2 = $_POST['cpassword'] ?? '';

if ($pass1 !== $pass2) {
  die("Passwords do not match.");
}

if ($email !== $_SESSION['otp_email']) {
  die("Email verification mismatch.");
}

$hashed = password_hash($pass1, PASSWORD_BCRYPT);
$stmt = $mysqli->prepare("UPDATE admin SET pass=? WHERE email=?");
$stmt->bind_param("ss", $hashed, $email);


if ($stmt->execute()) {
  // ✅ Password updated — redirect to login
  echo "<script>alert('Password updated successfully.'); window.location.href='index.php';</script>";
} else {
  echo "<script>alert('Failed to update password.'); window.history.back();</script>";
}
?>
