<?php
ini_set('session.save_path','/tmp');
session_start();
include "config.php";

$mobile = trim($_POST['mobile']);
$user_otp = trim($_POST['otp']);

if(!isset($_SESSION['otp'])){
echo "OTP expired";
exit;
}

if(time() - $_SESSION['otp_time'] > 300){
echo "OTP expired";
exit;
}

if($mobile !== $_SESSION['otp_mobile']){
echo "Mobile mismatch";
exit;
}

if($user_otp === $_SESSION['otp']){

$q = mysqli_query($conn,
"SELECT id FROM patients WHERE mobile='$mobile'");

if(mysqli_num_rows($q)==1){

$row = mysqli_fetch_assoc($q);
$_SESSION['patient_id'] = $row['id'];

unset($_SESSION['otp']);
unset($_SESSION['otp_mobile']);
unset($_SESSION['otp_time']);

header("Location: patient_dashboard.php");
exit;

}else{
echo "Mobile not registered";
}

}else{
echo "Wrong OTP";
}