<?php
session_name("vadmin_session");
session_start();
include("connection.php");

if (isset($_POST['change'])) { 
    $uname=$_SESSION['vname'];
    $password = $_POST['password'];
    $answer = $_POST['answer'];

    // Validate and sanitize user input
    $password = mysqli_real_escape_string($conn, $password);
    $answer = mysqli_real_escape_string($conn, $answer);

    // Perform the update query using prepared statements
     $updateQuery = "UPDATE v_admin SET password='$password',answer='$answer' WHERE username='$uname'";
    $res = mysqli_query($conn, $updateQuery);

    if ($res) {
        header("Location: profile_setting.php?msg=1");
        exit;
    } else {
        header("Location: profile_setting.php?msg=2");
        exit;
    }
}
?>
