<?php
session_start();
include "../../connect/db.php";
csrf_verify();

if (isset($_POST['accountnumber'])) {
    $accountnumber = mysqli_real_escape_string($mysqli, $_POST['accountnumber']);

    $query = mysqli_query($mysqli, "SELECT firstname, middlename, lastname FROM users WHERE account_num = '$accountnumber'");
    $row = mysqli_fetch_assoc($query);

    if ($row) {
        $accountname = trim($row['firstname'] . " " . $row['middlename'] . " " . $row['lastname']);
        echo $accountname;
    } else {
        echo "no user found with this account number";
    }
} else {
    echo "error";
}
?>
