<?php
include('database.php');
session_start();
$id= $_SESSION['id'];

if(isset($_POST['submit']))
{
	$password = mysqli_real_escape_string($connection, $_POST['password']);
	$pina = mysqli_real_escape_string($connection,  $_POST['pina']);
	$pinb = mysqli_real_escape_string($connection,  $_POST['pinb']);
	$pinc = mysqli_real_escape_string($connection,  $_POST['pinc']);
	$pind = mysqli_real_escape_string($connection,  $_POST['pind']);
	
	
	if ($stmt = $connection->prepare('SELECT password FROM users WHERE id =?')){
	$stmt->bind_param('i', $_SESSION['id']);
	$stmt->execute();
	// Store the result so we can check if the account exists in the database.
	$stmt->store_result();
	}
	if($stmt->num_rows > 0) {
	$stmt->bind_result($password);
	$stmt->fetch();
	if ($_POST['password'] == $password)
	{
	
    $query ="UPDATE users SET pina='$pina', pinb='$pinb', pinc='$pinc', pind='$pind' WHERE id='$id'";
    $query_run = mysqli_query($connection, $query);
    if($query_run)
    {
		$_SESSION['status'] = "<h5 style='padding:8px; background: #000; border-radius: 10px; color: #fff; text-align: center;'>PIN UPDATED SUCCESSFULLY</h5>";
		header('location:../profile.php');
	}
    else
    {
		$_SESSION['status'] = "error.. pin not updated";
		header('location:../change-code.php');
	}		
}else {
	$_SESSION['status'] = "<h5 style='padding:8px; background: #fe8b8e; border-radius: 10px; color: #fff; text-align: center;'>INCORRECT CURRENT PASSWORD</h5>";
	header('location:../change-code.php');	
}
}else{
	$_SESSION['status'] = "error.. pin not updated";
	header('location:../change-code.php');	
}
}
else{
	$_SESSION['status'] = "error.. pin not updated";
	header('location:../change-code.php');	
}

?>