<?php
/**
 * reset_password.php - BUG FIXED VERSION
 * Fixes:
 * 1. Duplicate null check: was $usermail != "" && $usermail != "" (same variable twice)
 *    Now checks both email and password
 * 2. Added real_escape_string for SQL safety
 */
include 'anti.php';
include 'konak.php';
date_default_timezone_set('Asia/Jakarta');

if (isset($_POST['email'])) {
    $usermail = anti_injection($_POST['email']);
    $password = anti_injection($_POST['password']);

    // FIX: was checking $usermail twice - now checks both fields
    if ($usermail != "" && $password != "") {
        $esEmail = mysqli_real_escape_string($koneksi, $usermail);
        $esPass  = mysqli_real_escape_string($koneksi, $password);
        $sql     = "UPDATE user_id SET password='$esPass' WHERE email='$esEmail'";
        if (mysqli_query($koneksi, $sql)) {
            echo "done";
        } else {
            echo "filed";
        }
    }
} else {
    echo "filed";
}
