<?php
    session_start();
    include "../../connect/db.php";

    if (isset($_POST['email'])) {

        // Sanitize POST data
        $firstname = mysqli_real_escape_string($con, $_POST['firstname']);
        $lastname = mysqli_real_escape_string($con, $_POST['lastname']);
        $middlename = mysqli_real_escape_string($con, $_POST['middlename']);
        $nickname = mysqli_real_escape_string($con, $_POST['nickname']);
        $email = mysqli_real_escape_string($con, $_POST['email']);
        $phone = mysqli_real_escape_string($con, $_POST['phone']);
        $dob = mysqli_real_escape_string($con, $_POST['dob']);
        $zipcode = mysqli_real_escape_string($con, $_POST['zipcode']);
        $title = mysqli_real_escape_string($con, $_POST['title']);
        $gender = mysqli_real_escape_string($con, $_POST['gender']);
        $address = mysqli_real_escape_string($con, $_POST['address']);
        $country = mysqli_real_escape_string($con, $_POST['country']);
        $state = mysqli_real_escape_string($con, $_POST['state']);
        $ssn = mysqli_real_escape_string($con, $_POST['ssn']);
        $city = mysqli_real_escape_string($con, $_POST['city']);
        $usercurrency = mysqli_real_escape_string($con, $_POST['usercurrency']);
        $occupation = mysqli_real_escape_string($con, $_POST['occupation']);
        $income = mysqli_real_escape_string($con, $_POST['income']);
        $next_kin = mysqli_real_escape_string($con, $_POST['next_kin']);
        $next_address = mysqli_real_escape_string($con, $_POST['next_address']);
        $next_relationship = mysqli_real_escape_string($con, $_POST['next_relationship']);
        $password = mysqli_real_escape_string($con, $_POST['password']);
        $secretCode = mysqli_real_escape_string($con, $_POST['secretCode']);
        $securityquestion = mysqli_real_escape_string($con, $_POST['securityquestion']);
        $answer = mysqli_real_escape_string($con, $_POST['answer']);
        $securityquestion2 = mysqli_real_escape_string($con, $_POST['securityquestion2']);
        $answer2 = mysqli_real_escape_string($con, $_POST['answer2']);
        $account_num = mysqli_real_escape_string($con, $_POST['account_num']);
        $status = mysqli_real_escape_string($con, $_POST['status']);
        $checking_balance = mysqli_real_escape_string($con, $_POST['checking_balance']);
        $bsl_balance = mysqli_real_escape_string($con, $_POST['bsl_balance']);
        $fico_score = mysqli_real_escape_string($con, $_POST['fico_score']);
        $linked_card = mysqli_real_escape_string($con, $_POST['linked_card']);
        $code_level = mysqli_real_escape_string($con, $_POST['code_level']);
        $code_status = mysqli_real_escape_string($con, $_POST['code_status']);
        $pincode = mysqli_real_escape_string($con, $_POST['pincode'] ?? '');
        $pin_stat = mysqli_real_escape_string($con, $_POST['pin_stat'] ?? 'active');
        $admin_otp = (int)($_POST['admin_otp'] ?? 0);
        $kyc_status = mysqli_real_escape_string($con, $_POST['kyc_status']);
        $transfer_limit = (int)($_POST['transfer_limit'] ?? 0);
        $limit_message = mysqli_real_escape_string($con, $_POST['limit_message'] ?? '');

        // Only update password if a new one was provided
        $pwdUpdate = !empty($password) ? "password = '$password'," : "";

        // Update query
        $sql = mysqli_query($con, "UPDATE users SET
            firstname = '$firstname',
            lastname = '$lastname',
            middlename = '$middlename',
            nickname = '$nickname',
            phone = '$phone',
            pincode = '$pincode',
            pin_stat = '$pin_stat',
            dob = '$dob',
            zipcode = '$zipcode',
            title = '$title',
            gender = '$gender',
            address = '$address',
            country = '$country',
            state = '$state',
            ssn = '$ssn',
            city = '$city',
            usercurrency = '$usercurrency',
            occupation = '$occupation',
            income = '$income',
            next_kin = '$next_kin',
            next_address = '$next_address',
            next_relationship = '$next_relationship',
            $pwdUpdate
            secretCode = '$secretCode',
            securityquestion = '$securityquestion',
            answer = '$answer',
            securityquestion2 = '$securityquestion2',
            answer2 = '$answer2',
            account_num = '$account_num',
            status = '$status',
            checking_balance = '$checking_balance',
            bsl_balance = '$bsl_balance',
            fico_score = '$fico_score',
            linked_card = '$linked_card',
            code_level = '$code_level',
            code_status = '$code_status',
            kyc_status = '$kyc_status',
            admin_otp = $admin_otp,
            transfer_limit = $transfer_limit,
            limit_message = '$limit_message'
        WHERE email = '$email'");

        // Check query execution
        if ($sql) {
            echo "success";
        } else {
            echo "Error: " . mysqli_error($con);
        }
    }
?>
