<?php
require_once 'includes/db.php';
session_start();

if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_SESSION['user_id'])) {
    $user_id = $_SESSION['user_id'];
    $name = $_POST['name'] ?? '';
    $phone = $_POST['phone'] ?? '';
    $address = $_POST['address'] ?? '';
    $city = $_POST['city'] ?? '';
    $pincode = $_POST['pincode'] ?? '';

    // Sanitize inputs
    $name = mysqli_real_escape_string($conn, $name);
    $phone = mysqli_real_escape_string($conn, $phone);
    $address = mysqli_real_escape_string($conn, $address);
    $city = mysqli_real_escape_string($conn, $city);
    $pincode = mysqli_real_escape_string($conn, $pincode);

    $sql = "UPDATE users SET 
            name = '$name', 
            phone = '$phone', 
            address = '$address', 
            city = '$city', 
            pincode = '$pincode' 
            WHERE id = $user_id";

    if ($conn->query($sql)) {
        $_SESSION['user_name'] = $name; // Update session name
        header("Location: account.php?success=1");
    } else {
        header("Location: account.php?error=update_failed");
    }
    exit();
} else {
    header("Location: login.php");
    exit();
}
?>