<?php
session_start();
header('Access-Control-Allow-Origin: *');

header('Access-Control-Allow-Methods: GET, POST');

header("Access-Control-Allow-Headers: X-Requested-With");

if(isset($_POST['user_id'])  && isset($_POST['auth']) && isset($_POST['password']))
{
include 'config.php';

$password=$_POST['password'];
$password=stripslashes($password);
$password=mysqli_escape_string($con, $password);

$pass = sha1($password);


$user_id=$_POST['user_id'];
$user_id=stripslashes($user_id);
$user_id=mysqli_escape_string($con, $user_id);


$auth=$_POST['auth'];
$auth=stripslashes($auth);
$auth=mysqli_escape_string($con, $auth);


$new_password=$_POST['new_password'];
$new_password=stripslashes($new_password);
$new_password=mysqli_escape_string($con, $new_password);

$new_pass = sha1($new_password);


$sql="SELECT * FROM users WHERE  user_id ='$user_id' AND auth = '$auth' AND password = '$pass'";
$result=$con->query($sql) or die ("error: Server error ".mysqli_error($con));
$count=mysqli_num_rows($result);

if($count == 1)
{

$rows = mysqli_fetch_array($result);
$expiry = $rows['code_expiry'];
$user_id = $rows['user_id'];
$now = strtotime("now"); 


$sqlx="UPDATE users set password = '$new_pass' WHERE  user_id ='$user_id' AND auth = '$auth' AND password = '$pass' ";
$resultx=$con->query($sqlx) or die ("error2: Server error ".mysqli_error($con));

if($resultx)
{
$suc = "Successful";
$status = true;
}
}
else
{
$suc = "Wrong Password!"; 
$status = false; 
 
}

$con->close();

header('Content-Type: application/json; charset=utf-8');

$output = array('status'=>$status, 'success'=>$suc, 'user_id'=>$user_id);
echo json_encode($output); //output JSON data
}

?>
