📄 account.php

<?php
require_once __DIR__ . '/../includes/functions.php';
requireAdmin();
require __DIR__ . '/includes/ui.php';
$pageTitle = 'My Account';

if ($_SERVER['REQUEST_METHOD'] === 'POST' && csrfVerify($_POST['csrf_token'] ?? null)) {
    $stmt = db()->prepare('SELECT * FROM admin_users WHERE id = ?');
    $stmt->execute([$_SESSION['admin_id']]);
    $user = $stmt->fetch();

    $currentPassword = $_POST['current_password'] ?? '';
    $newPassword = $_POST['new_password'] ?? '';
    $confirmPassword = $_POST['confirm_password'] ?? '';
    $name = trim($_POST['name'] ?? '');

    if (!$user || !password_verify($currentPassword, $user['password_hash'])) {
        flash('error', 'Current password is incorrect.');
    } elseif ($newPassword !== '' && strlen($newPassword) < 8) {
        flash('error', 'New password must be at least 8 characters.');
    } elseif ($newPassword !== '' && $newPassword !== $confirmPassword) {
        flash('error', 'New password confirmation does not match.');
    } else {
        if ($newPassword !== '') {
            db()->prepare('UPDATE admin_users SET name = ?, password_hash = ? WHERE id = ?')->execute([$name, password_hash($newPassword, PASSWORD_DEFAULT), $user['id']]);
        } else {
            db()->prepare('UPDATE admin_users SET name = ? WHERE id = ?')->execute([$name, $user['id']]);
        }
        $_SESSION['admin_name'] = $name;
        flash('success', 'Account updated.');
    }
    redirect('account.php');
}

require __DIR__ . '/includes/admin-header.php';
adminFlashBox();
$stmt = db()->prepare('SELECT * FROM admin_users WHERE id = ?');
$stmt->execute([$_SESSION['admin_id']]);
$user = $stmt->fetch();
?>
<form method="post" class="bg-white rounded-2xl border border-gray-100 p-6 max-w-md">
  <input type="hidden" name="csrf_token" value="<?= e(csrfToken()) ?>" />
  <?php inputField('Name', 'name', $user['name'] ?? '', 'text', true); ?>
  <p class="text-sm text-gray-500 mb-4">Email: <?= e($user['email'] ?? '') ?></p>
  <?php inputField('Current Password', 'current_password', '', 'password', true); ?>
  <?php inputField('New Password (leave blank to keep current)', 'new_password', '', 'password'); ?>
  <?php inputField('Confirm New Password', 'confirm_password', '', 'password'); ?>
  <button class="btn-primary-brand bg-primary text-white px-6 py-3 rounded-lg font-semibold mt-2">Save Changes</button>
</form>
<?php require __DIR__ . '/includes/admin-footer.php'; ?>