profile.php

<?php
$pageTitle = 'My Profile';
require_once 'includes/auth.php';
require_once 'classes/User.php';
require_once 'config/database.php';

$userModel = new User();
$user = $userModel->getById($_SESSION['user_id']);
$errors = [];
$success = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!validateCsrfToken()) {
        $errors[] = 'Invalid session token. Please try again.';
    } else {
        $result = $userModel->updateProfile(
            $_SESSION['user_id'],
            $_POST['full_name'] ?? '',
            $_POST['email'] ?? '',
            $_POST['current_password'] ?? '',
            $_POST['new_password'] ?? ''
        );
        if ($result['success']) {
            $success = true;
            $user = $userModel->getById($_SESSION['user_id']);
        } else {
            $errors = $result['errors'];
        }
    }
}

require_once 'includes/header.php';
?>

<div class="auth-page">
    <div class="auth-card">
        <h1>My Profile</h1>
        <p class="subtitle">Manage your account details</p>

        <?php if ($success): ?>
            <div class="alert alert-success"><i class="fas fa-check-circle"></i> Profile updated successfully.</div>
        <?php endif; ?>

        <?php if (!empty($errors)): ?>
            <div class="alert alert-error">
                <?php foreach ($errors as $err): ?>
                    <div><i class="fas fa-exclamation-circle"></i> <?= htmlspecialchars($err) ?></div>
                <?php endforeach; ?>
            </div>
        <?php endif; ?>

        <form method="POST">
            <div class="form-group">
                <label for="full_name">Full Name</label>
                <input type="text" id="full_name" name="full_name" required value="<?= htmlspecialchars($user['full_name'] ?? '') ?>">
            </div>
            <div class="form-group">
                <label for="email">Email Address</label>
                <input type="email" id="email" name="email" required value="<?= htmlspecialchars($user['email'] ?? '') ?>">
            </div>
            <hr>
            <div class="form-group">
                <label for="current_password">Current Password</label>
                <input type="password" id="current_password" name="current_password" placeholder="Required to save changes" required>
            </div>
            <div class="form-group">
                <label for="new_password">New Password <span class="form-help">(leave blank to keep current)</span></label>
                <input type="password" id="new_password" name="new_password" placeholder="Min. 6 characters" minlength="6">
            </div>
            <?= csrfField() ?>
            <button type="submit" class="btn-primary">Save Changes</button>
        </form>
    </div>
</div>

<?php require_once 'includes/footer.php'; ?>