<?php
session_name("admin_session");
session_start();
include("connection.php");

if (isset($_POST['change'])) { 
    $uname=$_SESSION['username'];
    $password = $_POST['password'];
    $support_email = $_POST['support_email'];
    $support_number = $_POST['support_number'];
    $title = $_POST['title'];
    $answer = $_POST['answer'];

    // Validate and sanitize user input
    $password = mysqli_real_escape_string($conn, $password);
    $answer = mysqli_real_escape_string($conn, $answer);

    // Perform the update query using prepared statements
     $updateQuery = "UPDATE user_admin SET password='$password',answer='$answer',support_email='$support_email',title='$title',support_number='$support_number' WHERE username='$uname'";
    $res = mysqli_query($conn, $updateQuery);

    if ($res) {
        header("Location: profile_setting.php?msg=1");
        exit;
    } else {
        header("Location: profile_setting.php?msg=2");
        exit;
    }
}
?>
