<?php
	session_start();
	include"../../connect/db.php"; 
?>
<?php
	csrf_verify();

	$chap = $_SESSION['chap'];

	if( isset($_POST['oldpin']) ){

		$oldpin = mysqli_real_escape_string($con,$_POST['oldpin']);

		$sql = mysqli_query($con,"SELECT pin FROM users WHERE email = '$chap' ");

		$row = mysqli_fetch_assoc($sql);

		if( $oldpin == $row['pin'] ){
			echo "pin correct";
		}
		else{
			echo "pin incorrect";
		}
	}
	else if( isset($_POST['newpin'])){

		$newpin = mysqli_real_escape_string($con,$_POST['newpin']);

		$sql = mysqli_query($con,"UPDATE users SET pin = '$newpin' WHERE email = '$chap' ");

		if( $sql ){
			echo "success";
		}
		else{
			echo "error";
		}
	}
?> 