<?
session_start();
include 'protect.php';
$id = $_SESSION['id'];
$prodsql = $dbh->prepare("select fullname,email,credentials from users where id = ?");
$prodsql->bindValue(1,$id);
$prodsql->execute();
$prodrow=$prodsql->fetch();

$submit = $_POST['submit'];
	if ($submit == 'submit' ){
	$newpass = $_POST['newpass'];
	if ($newpass){
		$curpass = md5(md5(md5($_POST['curpass'])));
	$newpass = $_POST['newpass'];
	
	if ($curpass == $prodrow[2]){
	$encpass = md5(md5(md5($newpass)));
	$uppass = $dbh->prepare("update users set credentials = ? where email = ? ");
	$uppass->execute(array($encpass,$email));
	}
if ($uppass) {
		echo 'Password has been updated!'; 
				}
	     }
$pic = $_FILES['avatar']['tmp_name'];
if ($pic)
{
$newpicname = $id.'.jpg';
move_uploaded_file($pic,'userpics/'.$newpicname);
}
		 
$newemail= $_POST['email'];
$newfullname= $_POST['fullname'];
$insql = $dbh->prepare("update users set fullname = ?,email = ? where id =?");
$insql->execute(array($newfullname,$newemail,$id));		 
if ($insql) echo "Record Update!";
	}
	
	
$prodsql = $dbh->prepare("select fullname,email from users where id = ?");
$prodsql->bindValue(1,$id);
$prodsql->execute();
$prodrow=$prodsql->fetch();

if (file_exists('userpics/'.$id.'.jpg')){
	echo '<img src = "thumbnail.php?pic=userpics/'.$id.'.jpg&ht=75&wd=75"/>';
}

?>

<form action = "profile.php" name = "profile" method = "post"  enctype="multipart/form-data" class="pure-form pure-form-stacked">
Upload Pic:<input type = "file" name = "avatar"/><br/>
<input type = "text" name  = "fullname" value = " <?= $prodrow[0];?>"/><br/>
<input type = "email" name  = "email" value = " <?= $prodrow[1];?>"/><br/>
Current Password: <input type = "text" name = "curpass"/><br/>
New Password:<input type = "text" name = "newpass" /><br/>
<input type = "submit" name = "submit" value ="submit" class="pure-button pure-button-primary"/>
</form>