<?php
header('Content-Type: application/json');
include '../connection.php';

$email = $_POST['email'];
$otp = $_POST['otp'];

$stmt = $conn->prepare("SELECT otp_code FROM tblcred WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();
$result = $stmt->get_result();

if ($result->num_rows == 1) {
    $row = $result->fetch_assoc();
    if ($row['otp_code'] == $otp) {
        // Mark user as verified
        $conn->query("UPDATE tblcred SET is_verified = 1, otp_code = NULL WHERE email = '$email'");
        echo json_encode(["success" => true, "message" => "OTP verified"]);
    } else {
        echo json_encode(["success" => false, "message" => "Invalid OTP"]);
    }
} else {
    echo json_encode(["success" => false, "message" => "Email not found"]);
}

$stmt->close();
$conn->close();
?>
