<?php
session_start();
require("mebdb.php");  // DB connection

// Check logged-in user
if (!isset($_SESSION['lt_username'])) {
    die("Unauthorized");
}

$session_username = $_SESSION['lt_username'];

// Prepared statement to fetch user
$stmt = $conn->prepare("SELECT id FROM user WHERE phone_number = ? OR phone_number1 = ?");
$stmt->bind_param("ss", $session_username, $session_username);
$stmt->execute();
$result = $stmt->get_result();
if (!$result || $result->num_rows == 0) {
    die("User not found");
}
$user = $result->fetch_assoc();
$user_id = $user['id'];

// If updating phone number
if (isset($_GET['update_data'])) {
    $number = $_GET['phone_number'] ?? '';
    $from   = $_GET['from'] ?? '';

    if ($from == "1") {
        $stmt = $conn->prepare("UPDATE user SET phone_number=? WHERE id=?");
    } else {
        $stmt = $conn->prepare("UPDATE user SET phone_number1=? WHERE id=?");
    }
    $stmt->bind_param("si", $number, $user_id);
    if ($stmt->execute()) {
        echo "updated";
    } else {
        echo "error updating";
    }
    exit;
}

// Else → generate OTP
$otp = rand(1000, 9999);
$number = $_GET['phone_number'] ?? $session_username;

// Save OTP in session (or DB)
$_SESSION['otp'] = $otp;

// SMS Message
$message = "Hello, your OTP to verify your mobile number at lagnatharle.com is ".$otp.". Kindly don’t share it with anyone.";

$pid = '1701160974470871960';
$tid = '1707163662167007867';
$sender_id = 'YESLGN';
$password = '123456';
$username = 'lagnatharle';
$number = '91'.$number;
$message = urlencode($message);

$data = "&password={$password}&sender={$sender_id}&sendto={$number}&message={$message}&PEID={$pid}&templateid={$tid}";
$url  = "http://truebulksms.biz/api.php?username={$username}{$data}";

// Send SMS via cURL
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
if ($response === false) {
    error_log("SMS sending failed: " . curl_error($ch));
}
curl_close($ch);

echo "OTP sent to your number";
?>