<?php
$error = $error2 = $error3 = $error4 = $sucess = "";
error_reporting(0);
session_start();
require("db.php");

if (isset($_POST['submit'])) {

    // Check honeypot field — should be empty
    if (!empty($_POST['website'])) {
        exit("Bot detected.");
    }

    // reCAPTCHA verification
    $recaptcha_secret = "6LdF8xcrAAAAAMyXpYL67jvyb97Pv2VvKpKr1VlW";
    $recaptcha_response = $_POST['g-recaptcha-response'];

    $verify_response = file_get_contents(
        "https://www.google.com/recaptcha/api/siteverify?secret=" . $recaptcha_secret . "&response=" . $recaptcha_response
    );

    $response_data = json_decode($verify_response);
    if (
        !$response_data->success ||
        !isset($response_data->score) ||
        $response_data->score < 0.5
    ) {
        exit("reCAPTCHA failed. Please try again.");
    }

    // Now process the form
    $username = mysqli_real_escape_string($db, $_POST['usernameBox']);
    $password = mysqli_real_escape_string($db, $_POST['passwordBox']);
    $password_1 = mysqli_real_escape_string($db, $_POST['passwordBox_1']);
    $forename = mysqli_real_escape_string($db, $_POST['forenameBox']);
    $surname = mysqli_real_escape_string($db, $_POST['surnameBox']);
    $postcode = mysqli_real_escape_string($db, $_POST['postcodeBox']);
    $phone = mysqli_real_escape_string($db, $_POST['phoneBox']);
    $email = mysqli_real_escape_string($db, $_POST['emailBox']);
    $country = mysqli_real_escape_string($db, $_POST['txtcountry']);
    $state = mysqli_real_escape_string($db, $_POST['txtstate']);
    $city = mysqli_real_escape_string($db, $_POST['txtcity']);
    $invest_type = mysqli_real_escape_string($db, $_POST['invest_type']);

    $check = mysqli_query($db, "SELECT username FROM logins WHERE username = '$username'");
    $echeck = mysqli_query($db, "SELECT email FROM logins WHERE email = '$email'");

    $numrows = mysqli_num_rows($check);
    $enumrows = mysqli_num_rows($echeck);

    if ($numrows >= 1) {
        $error = 'Username already exists';
    } elseif ($enumrows >= 1) {
        $error2 = 'Email already exists';
    } elseif (strlen($phone) > 20) {
        $error3 = 'Invalid phone number';
    } elseif ($password_1 !== $password) {
        $error4 = 'Passwords do not match';
    } else {
        // ✅ HASH THE PASSWORD before saving
        $hashedPassword = password_hash($password, PASSWORD_DEFAULT);

        $addresssql = mysqli_query($db, "INSERT INTO `logins` (`username`, `firstname`, `lastname`, `email`, `password`, `country`, `state`, `city`, `phone`, `currency`, `verified`, `member_no`) 
        VALUES ('$username', '$forename', '$surname', '$email', '$hashedPassword', '$country', '$state', '$city', '$phone', '$postcode', 0, '$invest_type')");

        $link = "https://alphachequers.com/0397002103YYZZSGQverifylink.php";
        $length = 20;
        $key = substr(str_shuffle(md5(time())), 0, $length);
        $to = $email;
        $message = 'Click or copy paste the following link to verify your account: ' . $config_basedir . $link;
        $from = "noreply@alphachequers.com";
        $subject = "Account Verification";
        $headers = "From: " . $from;

        mail($to, $subject, $message, $headers);

        $sucess = "<br><div class='success' align='center'><img src='download.png' height='30' width='40'> Registration successful! Please <a href='../Signin/access-login.php' style='color:blue'>Login</a>. A verification link has been sent to your email.</div>";
    }
}
?>