prepare("SELECT id, username, email, password FROM users WHERE email = ?"); $stmt->bind_param("s", $username); $stmt->execute(); $result = $stmt->get_result(); if ($user = $result->fetch_assoc()) { if (password_verify($password, $user['password'])) { // Generate secure OTP $otp = random_int(100000, 999999); $otpExpiry = date("Y-m-d H:i:s", strtotime('+10 minutes')); // Save OTP with prepared statement $updateStmt = $conn->prepare("UPDATE users SET otp = ?, otp_expiry = ? WHERE id = ?"); $updateStmt->bind_param("ssi", $otp, $otpExpiry, $user['id']); if ($updateStmt->execute()) { // Send OTP via PHPMailer $mail = new PHPMailer(true); try { // Server settings - Move to environment variables in production $mail->isSMTP(); $mail->Host = 'ecogenix.in'; $mail->SMTPAuth = true; $mail->Username = 'no-reply@ecogenix.in'; // TODO: Move password to environment variable $mail->Password = 'freeDOM@611#'; // This should be in $_ENV['SMTP_PASSWORD'] $mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS; $mail->Port = 587; // Recipients $mail->setFrom('no-reply@ecogenix.in', 'Ecogenix System'); $mail->addAddress($username); $mail->addReplyTo('no-reply@ecogenix.in', 'Ecogenix System'); // Content $mail->isHTML(true); $mail->Subject = 'Your OTP Code - Ecogenix'; $mail->Body = "
Hi " . htmlspecialchars($user['username']) . ",
Your One-Time Password (OTP) for login verification is:
Important: This OTP will expire in 10 minutes.
If you didn't request this login, please ignore this email and ensure your account is secure.
This is an automated message. Please do not reply to this email.
🔒 Secure login with two-factor authentication