<?php
// Start the session to access session variables like expected_otp
session_start();

// Get the OTP entered by the user from the POST request; if not set, default to an empty string
$enteredOTP = $_POST['otp'] ?? '';

// Get the expected OTP that was stored in the session earlier (e.g., during OTP generation)
// If not set, default to an empty string
$expectedOTP = $_SESSION['expected_otp'] ?? ''; // You should have stored it earlier

// Check if either the entered OTP is empty or does not match the expected OTP
if (empty($enteredOTP) || $enteredOTP != $expectedOTP) {
    // Set an error message in the session to notify user of invalid/expired OTP
    $_SESSION['otp_error'] = "Invalid or expired OTP. Please try again.";

    // Redirect the user back to the OTP verification page
    header("Refresh: 2; URL=login.html");

    // Terminate script execution to prevent further processing
    exit();
}

// OTP verified

// Remove the expected OTP from the session after successful verification to prevent reuse
unset($_SESSION['expected_otp']); // Clear OTP after success

// Redirect the user to the reset password page
header("Location: reset_password.php");

// Terminate script execution
exit();
