<?php include('partials/menu.php'); ?>
<div class="main-content">
  <div class="wrapper">
    <h1>Change Password</h1>
    <br><br><br>

    <?php
    //we have to get id for the password so that we can update it
      if (isset($_GET['id'])) {
        {
          $id=$_GET['id'];
        }
      }
     ?>
    <form action='' method='POST'>
      <table class="tbl">
        <tr>
          <td>
            Current Password
          </td>
          <td><input type="password" name="current_password" placeholder="current_password"></td>

        </tr>
        <tr>
          <td>New Password</td>
          <td><input type="password" placeholder="new_password" name="new_password"</td>

        </tr>
        <tr>
          <td>Confirm Password</td>
          <td><input type="password" placeholder="confirm_password" name="confirm_password"</td>


        </tr>
        <tr>
          <td colspan="2">
              <input type="hidden" name="id" value="<?php echo $id; ?>">
            <input class="btnsecondary" type="submit" name="submit" value="update Password">
          </td>
        </tr>
      </table>
    </form>
  </div>
</div>
<?php
 //check whether the btn is clicked or not
 if (isset($_POST['submit'])) {
   //1.GET THE DATA FRM THE FORM
   $_id=$_POST['id'];
   $current_password=md5($_POST['current_password']);
   $new_password=md5($_POST['new_password']);
   $confirm_password=md5($_POST['confirm_password']);
   //2.CHECK WHERTHER THE USER WITH CURRENT PASSWORD EXISTS
   $sql="SELECT * FROM tbl_admin WHERE id=$id AND password='$current_password'";
   //execute the querry
   $res=mysqli_query($conn, $sql);
   if($res==true)
   {
     //check whether data is available or not
     $count=mysqli_num_rows($res);
     if ($count==1) {
       //user exists and password can be changed
       //echo "user found";
       //check if the new password and confirm password matches
       if ($new_password==$confirm_password) {
         // update the password
         $sql2 = "UPDATE tbl_admin SET
         password='$new_password'
         WHERE id=$id
         ";
         //execute the querry
         $res2=mysqli_query($conn, $sql2);
         //check whether the qerry executed or not
         if ($res2==true) {
           // display success msg
           $_SESSION['update-password'] = "<div class='success'>password updated succefully</div>";
           //redirect the user
             header('location:' .SITEURL.'backend/manage-admin.php');
         }else{
           //display error msg
           $_SESSION['update-password'] = "<div class='error'>failed to update the password</div>";
           //redirect the user
             header('location:' .SITEURL.'backend/manage-admin.php');
         }
       }else{
         //redirect the user to manage-admin with error msg
         $_SESSION['new-password-and-confirm-pasword-does-not-match'] = "<div class='error'>new_password and confirm_password does not match</div>";
              header('location:' .SITEURL.'backend/manage-admin.php');
       }
     }else{
       //the user does not exist set a nsg and redirect
       $_SESSION['user-not-found'] = "<div class='error'>User Does Not Exist</div>";
       //redirect the user
         header('location:' .SITEURL.'backend/manage-admin.php');
     }
   }
   //3.CHECK WHETHER THE NEW PASSWORD AND CONFIRM PASSWORD MATCH OR NOT
   //4. CHANGE PASSWORD IF ALL ABOVE IS TRUE
 }
 ?>
<?php include('partials/footer.php'); ?>
