<?php
include('config.php');


//sending email
$emailsms = wordwrap($emailsms,70);
$headers = 'From: <'.$site_email.'>' . "\r\n";
$senemail = mail($adminemail, $subject, $message, $headers);


//Changing Of Password
if (isset($_POST['change_password'])) {

$oldword = mysqli_real_escape_string($db,$_POST["old_password"]);
$newword = mysqli_real_escape_string($db, $_POST["new_password"]);
$oldmd = MD5($oldword);
$passmd = MD5($newword);


$cpass =  mysqli_fetch_array(mysqli_query($db,"SELECT password FROM user WHERE accountnumber='".$accountnumber."'"));



//Check if the existing password matches
if ($cpass[0]!=$oldmd){$err1=1;}

//If new password is empty
if(trim($newword)==""){$err3=1;}

//If new password is less than 4digits
if(strlen($newword)<=3){$err4=1;}

$error = $err1+$err3+$err4;


if ($error == 0){

$res =  mysqli_query($db, "UPDATE user SET password='".$passmd."' WHERE accountnumber='".$accountnumber."'");
if($res){
    $to = $useremail;
    
    $emailmsg = 'Dear '. $namee.'
         
    Your password has been successfully changed.
    
    Your new password is '. $newword.' 
    
    And your username is '. $username.' 
    
    Thanks For Choosing . 
    www..com.ng';

        $emailmsg = wordwrap($emailmsg,70);
        $subject= 'Password Change Successful';
        $replyto= 'info@';
        $headers = 'Reply-To:<info@>' . "\r\n";
        $headers = 'From: Services <info@>' . "\r\n";
        //if (mail($to, $subject, $emailmsg, $headers))

 $mcred= $site_url.'/include/email/password.php';
           file_get_contents($mcred);
           
	$msg =  "<div class=\"alert alert-success alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Password Has Been Successfully Changed!

</div>";
}else{
	$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Some Problem Occurs, Please Try Again. 

</div>";
}
} else {
	
if ($err1 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Current Password Is Incorrect.

</div>";
}		
if ($err3 == 1){
$msg = "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Password Can Not Be Empty.

</div>";
echo"<h1></h1>";
}		
if ($err4 == 1){
	$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Password Must Be Four Or More Characters.

</div>";
}
}
}
//End of change password

	    
	    
	    
	    
//Changing Of Pin    
if (isset($_POST['change_pin'])) {

$oldword = mysqli_real_escape_string($db,$_POST["old_pin"]);
$newword = mysqli_real_escape_string($db, $_POST["new_pin"]);


$cpass =  mysqli_fetch_array(mysqli_query($db,"SELECT pin FROM user WHERE accountnumber='".$accountnumber."'"));

//Check if the existing password matches
if ($cpass[0]!=$oldword){$err1=1;}

//If new password is empty
if(trim($newword)==""){$err3=1;}

//If new password is less than 4digits
if(strlen($newword)<=3){$err4=1;}

$error = $err1+$err3+$err4;


if ($error == 0){

$res =  mysqli_query($db, "UPDATE user SET pin='".$newword."' WHERE accountnumber='".$accountnumber."'");
if($res){
    $to = $useremail;
    
    $emailmsg = 'Dear '. $namee.'
         
    Your password has been successfully changed.
    
    Your new password is '. $newword.' 
    
    And your username is '. $username.' 
    
    Thanks For Choosing . 
    www..com.ng';

        $emailmsg = wordwrap($emailmsg,70);
        $subject= 'Password Change Successful';
        $replyto= 'info@';
        $headers = 'Reply-To:<info@>' . "\r\n";
        $headers = 'From: Services <info@>' . "\r\n";
        //if (mail($to, $subject, $emailmsg, $headers))

 $mcred= $site_url.'/include/email/pin.php';
           file_get_contents($mcred);
           
	$msg =  "<div class=\"alert alert-success alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Transaction Pin Has Been Successfully Changed

</div>";
}else{
	$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Some Problem Occurs, Please Try Again. 

</div>";
}
} else {

if ($err1 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Old Pin Is Incorrect.

</div>";
}		
if ($err3 == 1){
$msg = "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Pin Can Not Be Empty.

</div>";
echo"<h1></h1>";
}		
if ($err4 == 1){
	$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Pin Must Be Four Characters.

</div>";
}
}
}
//End of change pin




//Local Transfer   
if (isset($_POST['local_transfer'])) {

$receiver_bnk = mysqli_real_escape_string($db,$_POST["receiver_bnk"]);
$receiver_account = mysqli_real_escape_string($db, $_POST["receiver_account"]);
$account_number = mysqli_real_escape_string($db,$_POST["account_number"]);
$amount = mysqli_real_escape_string($db, $_POST["amount_transfer"]);
$pin = mysqli_real_escape_string($db,$_POST["transaction_pin"]);


$cpass =  mysqli_fetch_array(mysqli_query($db,"SELECT pin FROM user WHERE accountnumber='".$accountnumber."'"));

//Check if the pin matches
if ($cpass[0]!=$pin){$err1=1;}

//If new password is empty
if(trim($receiver_account)==""){$err3=1;}


$error = $err1+$err3;


if ($error == 0){
    
if($wallet < $amount){

$msg="<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>
<b>Insufficient Fund.</b>
<br>You have only &#36;$wallet left in your account.

</div>";


}

if($wallet >= $amount){ 

$description = "Local Transfer To $account_number $receiver_bnk $receiver_account";
$newbal = $wallet - $amount;

$res = mysqli_query($db,"UPDATE user SET wallet='".$newbal."' WHERE accountnumber='".$accountnumber."'");
 
 mysqli_query($db,"INSERT INTO transaction SET accountnumber='".$accountnumber."', amount='".$amount."', prebalance='".$wallet."', postbalance='".$newbal."', status='Pending', ref='".$trx."', date='".$date."', time='".$time."', description='".$description."', sig='-'");  
 
$msg =  "<div class=\"alert alert-success alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Transaction Has Been Successfully Processed

</div>";

}
}else {

if ($err1 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Transaction Pin Is Incorrect.

</div>";
}		
if ($err3 == 1){
$msg = "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Receiver's Account Type Can Not Be Empty.

</div>";
echo"<h1></h1>";
}		
}
}
//End Of Local Transfer  			




//International Transfer   
if (isset($_POST['inter_transfer'])) {

$receiver_name = mysqli_real_escape_string($db, $_POST["receiver_name"]);
$receiver_account = mysqli_real_escape_string($db,$_POST["receiver_account"]);
$receiver_bank = mysqli_real_escape_string($db,$_POST["receiver_bank"]);
$account_type = mysqli_real_escape_string($db,$_POST["account_type"]);
$receiver_address = mysqli_real_escape_string($db, $_POST["receiver_address"]);

$country = mysqli_real_escape_string($db,$_POST["country"]);
$routine_number = mysqli_real_escape_string($db, $_POST["routine_number"]);
$amount = mysqli_real_escape_string($db,$_POST["amount_transfer"]);
$reason_transfer = mysqli_real_escape_string($db, $_POST["reason_transfer"]);
$pin = mysqli_real_escape_string($db,$_POST["transaction_pin"]);


$cpass =  mysqli_fetch_array(mysqli_query($db,"SELECT pin FROM user WHERE accountnumber='".$accountnumber."'"));

//Check if the pin matches
if ($cpass[0]!=$pin){$err1=1;}

//If new password is empty
if(trim($account_type)==""){$err3=1;}


$error = $err1+$err3;


if ($error == 0){
    
if($wallet < $amount){

$msg="<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>
<b>Insufficient Fund.</b>
<br>You have only &#36;$wallet left in your account.

</div>";


}

if($wallet >= $amount){ 

$description = "International Transfer To $receiver_account $receiver_bank $receiver_name $routine_number";
$newbal = $wallet - $amount;

$res = mysqli_query($db,"UPDATE user SET wallet='".$newbal."' WHERE accountnumber='".$accountnumber."'");
 
 mysqli_query($db,"INSERT INTO transaction SET accountnumber='".$accountnumber."', amount='".$amount."', prebalance='".$wallet."', postbalance='".$newbal."', status='Pending', ref='".$trx."', date='".$date."', time='".$time."', description='".$description."', sig='-'");  
 
$msg =  "<div class=\"alert alert-success alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Transaction Has Been Successfully Processed

</div>";

}
}else {

if ($err1 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Transaction Pin Is Incorrect.

</div>";
}		
if ($err3 == 1){
$msg = "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Receiver's Account Type Can Not Be Empty.

</div>";
echo"<h1></h1>";
}		
}
}
//End Of International Transfer  	  



//Direct Transfer   
if (isset($_POST['direct_transfer'])) {

$receiver_acct = mysqli_real_escape_string($db,$_POST["b_acct_number"]);
$amount = mysqli_real_escape_string($db, $_POST["direct_amt"]);
$pin = mysqli_real_escape_string($db,$_POST["transaction_pin"]);


$cpass =  mysqli_fetch_array(mysqli_query($db,"SELECT pin FROM user WHERE accountnumber='".$accountnumber."'"));

$cpas =  mysqli_fetch_array(mysqli_query($db,"SELECT accountnumber, wallet, firstname, lastname FROM user WHERE accountnumber='".$receiver_acct."'"));

//Check if the pin matches
if ($cpass[0]!=$pin){$err1=1;}

//Check if the beneficiary account matches
if ($cpas[0]!=$receiver_acct){$err2=1;}


$error = $err1+$err2;


if ($error == 0){
    
if($wallet < $amount){

$msg="<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>
<b>Insufficient Fund.</b>
<br>You have only &#36;$wallet left in your account.

</div>";


}

if($wallet >= $amount){ 

$description = "Direct Transfer Of &#36;$amount To $receiver_acct $cpas[2] $cpas[3]";
$descriptionn = "$accountnumber $firstname $lastname Transffered &#36;$amount To You";
$newbal = $wallet - $amount;
$newball = $cpas[1] + $amount;

$res = mysqli_query($db,"UPDATE user SET wallet='".$newbal."' WHERE accountnumber='".$accountnumber."'");
$res = mysqli_query($db,"UPDATE user SET wallet='".$newball."' WHERE accountnumber='".$receiver_acct."'");
 
 mysqli_query($db,"INSERT INTO transaction SET accountnumber='".$accountnumber."', amount='".$amount."', prebalance='".$wallet."', postbalance='".$newbal."', status='Successful', ref='".$trx."', date='".$date."', time='".$time."', description='".$description."', sig='-'");
 
  mysqli_query($db,"INSERT INTO transaction SET accountnumber='".$receiver_acct."', amount='".$amount."', prebalance='".$cpas[1]."', postbalance='".$newball."', status='Successful', ref='".$trx."', date='".$date."', time='".$time."', description='".$descriptionn."', sig='+'");
 
$msg =  "<div class=\"alert alert-success alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

You Have Successfully Transferred &#36;$amount To $receiver_acct $cpas[2] $cpas[3]

</div>";

}
}else {

if ($err1 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Transaction Pin Is Incorrect.

</div>";
}
if ($err2 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

$receiver_acct is not registered with us

</div>";
}
}
}
//End Of Direct Transfer  



//Uploading Pics   
if (isset($_POST['upload'])) {

$receiver_bnk = mysqli_real_escape_string($db,$_POST["receiver_bnk"]);
$receiver_account = mysqli_real_escape_string($db, $_POST["receiver_account"]);
$account_number = mysqli_real_escape_string($db,$_POST["account_number"]);
$amount = mysqli_real_escape_string($db, $_POST["amount_transfer"]);
$pin = mysqli_real_escape_string($db,$_POST["transaction_pin"]);

$target_dir = "avatar/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
$pname = basename($_FILES["fileToUpload"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));
 $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);

//Check if the pin matches
if($check == false){$err1=1;}

if($_FILES["fileToUpload"]["size"] > 500000){$err2=1;}

if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
&& $imageFileType != "gif" ){$err3=1;}

$error = $err1+$err2+$err3;


if ($error == 0){

$res = mysqli_query($db,"UPDATE user SET avatar='".$pname."' WHERE accountnumber='".$accountnumber."'");
 move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file);
$msg =  "<div class=\"alert alert-success alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

The file ". htmlspecialchars( basename( $_FILES["fileToUpload"]["name"])). " has been uploaded.

</div>";

}else {

if ($err1 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

File is not an image.

</div>";
}	

if ($err2 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Sorry, your photo is too large..

</div>";
}

if ($err3 == 1){
$msg =  "<div class=\"alert alert-danger alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Sorry, only JPG, JPEG, PNG & GIF files are allowed.

</div>";
}
		
}
}
//End Of Uploading Pics


//Changing Profile  
if (isset($_POST['profile'])) {

$f_name = mysqli_real_escape_string($db,$_POST["f_name"]);
$l_name = mysqli_real_escape_string($db, $_POST["l_name"]);
$country = mysqli_real_escape_string($db,$_POST["country"]);
$city = mysqli_real_escape_string($db, $_POST["city"]);
$phone = mysqli_real_escape_string($db,$_POST["phone"]);
$email = mysqli_real_escape_string($db,$_POST["email"]);



$res = mysqli_query($db,"UPDATE user SET firstname='".$f_name."', lastname='".$l_name."', phone='".$phone."', email='".$email."', city='".$city."', country='".$country."' WHERE accountnumber='".$accountnumber."'");

$msg =  "<div class=\"alert alert-success alert-dismissable\">
<button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>	

Your Profile Has Been Successfully Updated

</div>";


}
//End Of Changing Profile

?>