<?php
session_start();

// Get the email and code from session + form
$email = $_SESSION['change_email'] ?? '';
$codeFromForm = $_POST['code'] ?? '';
$codeInSession = $_SESSION['verification_code'] ?? '';

if (empty($email) || empty($codeFromForm)) {
    die("Missing email or code.");
}

// Check if code matches
if ($codeFromForm == $codeInSession) {
    // Correct code — allow password reset
    $_SESSION['reset_email'] = $email;
    header("Location: reset-password-change.html");
    exit;
} else {
    die("Incorrect verification code.");
}