<?php
session_start();

if (!isset($_SESSION['verified']) || !$_SESSION['reset_email']) {
  die("Unauthorized access.");
}

$email = $_SESSION['reset_email'];
$newPassword = $_POST['new_password'] ?? '';

// Hash and save new password to database
$hashedPassword = password_hash($newPassword, PASSWORD_BCRYPT);

// UPDATE your database users SET password = $hashedPassword WHERE email = $email

echo "Password updated successfully.";
