reset_password.php

<?php
session_start();
require 'db.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $token = trim($_POST['token'] ?? '');
    $password = trim($_POST['password'] ?? '');
    $confirm = trim($_POST['confirm_password'] ?? '');

    if (empty($token) || empty($password) || empty($confirm)) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'All fields required']);
        exit();
    }

    if ($password !== $confirm) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'Passwords do not match']);
        exit();
    }

    if (strlen($password) < 6) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'Password must be at least 6 characters']);
        exit();
    }

    // Find valid token
    $stmt = $conn->prepare("SELECT email FROM password_resets WHERE token = ? AND expires > NOW() ORDER BY created_at DESC LIMIT 1");
    $stmt->bind_param("s", $token);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows === 0) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'Invalid or expired reset token']);
        exit();
    }

    $row = $result->fetch_assoc();
    $email = $row['email'];

    // Update user password
    $hashed = password_hash($password, PASSWORD_DEFAULT);
    $update = $conn->prepare("UPDATE users SET password = ? WHERE email = ?");
    $update->bind_param("ss", $hashed, $email);

    if ($update->execute()) {
        // Delete used token
        $del = $conn->prepare("DELETE FROM password_resets WHERE email = ?");
        $del->bind_param("s", $email);
        $del->execute();

        echo json_encode(['success' => true, 'message' => 'Password reset successful']);
    } else {
        http_response_code(500);
        echo json_encode(['success' => false, 'message' => 'Failed to reset password']);
    }
}
?>