<?php
// Include database connection
include "../config.php";

// Check if the OTP and phone number are provided
if (isset($_POST['phone']) && isset($_POST['otp'])) {
    $phone = $_POST['phone'];
    $otp = $_POST['otp'];

    // Query to check the OTP in the database
    $query = "SELECT otp FROM users WHERE phone = '$phone' AND otp = '$otp'";
    $result = mysqli_query($conn, $query);

    if (mysqli_num_rows($result) > 0) {
        // OTP is correct, allow user to update the password
        // Delete OTP from database after verification
        $deleteOtpQuery = "UPDATE users SET otp = NULL WHERE phone = '$phone'";
        mysqli_query($conn, $deleteOtpQuery);

        echo json_encode(["success" => true, "message" => "OTP verified, proceed to reset password"]);
    } else {
        echo json_encode(["success" => false, "message" => "Invalid OTP"]);
    }
} else {
    echo json_encode(["success" => false, "message" => "Phone number and OTP are required"]);
}
?>
