prepare("SELECT * FROM otp_tokens WHERE token = ? AND expires_at > NOW()");
$stmt->execute([$token]);
$otpRow = $stmt->fetch();
if (!$otpRow) {
header("Location: login.php?tab=otp&error=" . urlencode("OTP session expired or invalid. Please request a new code."));
exit();
}
// ── Handle OTP submission ─────────────────────────────────────────────────────
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$inputOtp = trim($_POST['otp_code'] ?? '');
if (empty($inputOtp) || !ctype_digit($inputOtp) || strlen($inputOtp) !== 6) {
$errorMsg = "Please enter the 6-digit code.";
} elseif (!password_verify($inputOtp, $otpRow['otp_code'])) {
$errorMsg = "Incorrect code. Please try again.";
} else {
// OTP correct — log the user in
$userStmt = $pdo->prepare("SELECT * FROM users WHERE email = ? AND is_banned = 0");
$userStmt->execute([$otpRow['email']]);
$user = $userStmt->fetch();
if (!$user) {
$errorMsg = "Account not found or has been banned.";
} else {
// Delete used OTP
$pdo->prepare("DELETE FROM otp_tokens WHERE id = ?")->execute([$otpRow['id']]);
// Set session
$_SESSION['user_id'] = $user['id'];
$_SESSION['username'] = $user['username'];
$_SESSION['role'] = $user['role'];
header("Location: " . $redirect . "?success=" . urlencode("Signed in with Email OTP successfully!"));
exit();
}
}
}
renderHeader(__('otp_page_title'));
?>