<?php
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = $_POST['email'] ?? '';
    $code = $_POST['code'] ?? '';

    if (
        isset($_SESSION['verification_code']) &&
        isset($_SESSION['email_to_verify']) &&
        $email === $_SESSION['email_to_verify'] &&
        $code == $_SESSION['verification_code']
    ) {
        // Verified — redirect to set password
        header("Location: set-password.html?email=" . urlencode($email));
        exit;
    } else {
        echo "Invalid verification code.";
    }
} else {
    echo "Invalid request.";
}