<?php
include '../db/db.php';
session_start();

if(isset($_SESSION['userID'])) {
	$log = htmlspecialchars(strip_tags(trim($_SESSION['userID'])), ENT_QUOTES, 'UTF-8');
} else {
	$log = '';
}

if (empty($log)) {     
	$redirectUrl = "../";
	echo "<script type=\"text/javascript\">";
	echo "window.location.href = '$redirectUrl'";
	echo "</script>";
	 
} else {
	$sqlu = "SELECT id FROM user_acc_tbl WHERE userID='$log' and access=1 and val=1";
	$stmtu = mysqli_query($conn, $sqlu);
	$countu = mysqli_num_rows($stmtu);
	
	if($countu == 1) {
		$rowu = mysqli_fetch_assoc($stmtu);
		$uid = $rowu['id'];
		
		/*************************** Update ***************************/
		
		if(isset($_POST['password'])) {
			$pw = htmlspecialchars(strip_tags(trim($_POST['password'])), ENT_QUOTES, 'UTF-8');
			$password = hash('sha256', $pw);
		
			if(empty($pw)) {
				echo 'empty';
			
			} else {
				$sql = "UPDATE user_acc_tbl SET pass='$password' WHERE id='$uid' AND userID='$log'";
				$stmt_log = mysqli_query($conn, $sql);
				
				if($stmt_log === false) {
					echo 'error';
				
				} else {
					echo 'success';
				}
				
			}
		}
		
	} else {
		$redirectUrl = "../";
		echo "<script type=\"text/javascript\">";
		echo "window.location.href = '$redirectUrl'";
		echo "</script>";
	}
}
?>