| 
<?php
 require_once '../session.php';
 
 if ($_SERVER['REQUEST_METHOD'] == "POST") {
 $msg_code = "";
 
 if ($auth->checkToken($_POST['csrf'], $_SESSION['csrf']) == false) {
 $msg_code = "csrf";
 } else {
 $user_array = [];
 $current_id = (int) $data->id;
 $id = (int) $_POST['id'];
 if ($id == $current_id) {
 $user_array['username'] = $utils->sanitize($_POST['Username']);
 
 if ($_POST['Password'] || $_POST['Password'] != "") {
 $password = $utils->sanitize($_POST['Password']);
 $user_array['password'] = password_hash($password, PASSWORD_BCRYPT);
 }
 
 if ($user->updateUser($id, $user_array)) {
 $_SESSION['username'] = $user_array['username'];
 $msg_code = "yes";
 } else {
 $msg_code = "error";
 }
 } else {
 $msg_code = "attack";
 }
 }
 
 $utils->redirect(SITE_URL . "/user.php?msg=" . $msg_code);
 }
 
 |