<?php
    session_start();
    include "../../connect/db.php";

    if (isset($_POST['code_name1'])) {

        // Sanitize POST data
        $email223 = mysqli_real_escape_string($con, $_POST['email223']);
        $code_count = isset($_POST['code_count']) ? (int)$_POST['code_count'] : 6;
        // Clamp code_count to valid range 1-6
        $code_count = max(1, min(6, $code_count));
        $code_name1 = mysqli_real_escape_string($con, $_POST['code_name1']);
        $code_name2 = mysqli_real_escape_string($con, $_POST['code_name2']);
        $code_name3 = mysqli_real_escape_string($con, $_POST['code_name3']);
        $code_name4 = mysqli_real_escape_string($con, $_POST['code_name4']);
        $code_name5 = mysqli_real_escape_string($con, $_POST['code_name5']);
        $code_name6 = mysqli_real_escape_string($con, $_POST['code_name6']);
        $lock_status = mysqli_real_escape_string($con, $_POST['lock_status']);



        // Update query
        $sql = mysqli_query($con, "UPDATE users SET
            code_count = '$code_count',
            code_name1 = '$code_name1',
            code_name2 = '$code_name2',
            code_name3 = '$code_name3',
            code_name4 = '$code_name4',
            code_name5 = '$code_name5',
            code_name6 = '$code_name6',
           lock_status = '$lock_status'
        WHERE email = '$email223'");

        // Check query execution
        if ($sql) {
            echo "success";
        } else {
            echo "DB-ERROR: " . mysqli_error($con);
        }
    } else {
        echo "MISSING: code_name1 not in POST";
    }
?>
