📄 change-password.php

<?php
require_once __DIR__ . '/../includes/auth.php';
require_login();
$pageTitle = 'Change Password';

if ($_SERVER['REQUEST_METHOD'] === 'POST' && csrf_verify()) {
    $current = $_POST['current_password'] ?? '';
    $new = $_POST['new_password'] ?? '';
    $confirm = $_POST['confirm_password'] ?? '';

    $stmt = db()->prepare('SELECT * FROM users WHERE id = ?');
    $stmt->execute([$_SESSION['admin_user_id']]);
    $user = $stmt->fetch();

    if (!$user || !password_verify($current, $user['password_hash'])) {
        flash_set('error', 'Current password is incorrect.');
    } elseif (strlen($new) < 8) {
        flash_set('error', 'New password must be at least 8 characters.');
    } elseif ($new !== $confirm) {
        flash_set('error', 'New password and confirmation do not match.');
    } else {
        $hash = password_hash($new, PASSWORD_BCRYPT);
        $upd = db()->prepare('UPDATE users SET password_hash = ? WHERE id = ?');
        $upd->execute([$hash, $user['id']]);
        flash_set('success', 'Password updated successfully.');
    }
    redirect('change-password.php');
}

require __DIR__ . '/partials/header.php';
require __DIR__ . '/partials/sidebar.php';
require __DIR__ . '/partials/topbar.php';
?>

<div class="max-w-lg bg-white rounded-2xl shadow-sm p-6">
  <h2 class="font-heading font-bold text-lg mb-5"><i class="fa-solid fa-key text-brand-red mr-2"></i>Change Your Password</h2>
  <form method="post" class="space-y-4">
    <?= csrf_field() ?>
    <div>
      <label class="block text-sm font-medium mb-1.5">Current Password</label>
      <input type="password" name="current_password" required class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green">
    </div>
    <div>
      <label class="block text-sm font-medium mb-1.5">New Password</label>
      <input type="password" name="new_password" required minlength="8" class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green">
      <p class="text-xs text-gray-400 mt-1">At least 8 characters.</p>
    </div>
    <div>
      <label class="block text-sm font-medium mb-1.5">Confirm New Password</label>
      <input type="password" name="confirm_password" required minlength="8" class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green">
    </div>
    <button type="submit" class="bg-gradient-to-r from-brand-red to-brand-green text-white font-semibold px-6 py-3 rounded-xl hover:brightness-110 transition">
      <i class="fa-solid fa-floppy-disk mr-2"></i>Update Password
    </button>
  </form>
</div>

<?php require __DIR__ . '/partials/footer.php'; ?>