prepare("SELECT * FROM invitations WHERE token = ? AND expires_at > NOW() AND is_registered = false");
$stmt->execute([$token]);
$invitation = $stmt->fetch();
if (!$invitation) {
die('Invalid or expired invitation token.');
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$name = $_POST['name'] ?? '';
$password = $_POST['password'] ?? '';
$password_confirm = $_POST['password_confirm'] ?? '';
if ($password !== $password_confirm) {
$error = 'Passwords do not match.';
} else {
try {
// Create user
$password_hash = password_hash($password, PASSWORD_DEFAULT);
$stmt = $pdo->prepare("INSERT INTO users (name, email, password, role) VALUES (?, ?, ?, 'sdr')");
$stmt->execute([$name, $invitation['email'], $password_hash]);
// Mark invitation as registered
$stmt = $pdo->prepare("UPDATE invitations SET is_registered = true WHERE id = ?");
$stmt->execute([$invitation['id']]);
$success = 'Registration successful! You can now login.';
} catch (PDOException $e) {
if ($e->errorInfo[1] == 1062) { // Duplicate entry
$error = 'An account with this email already exists.';
} else {
$error = 'Database error: ' . $e->getMessage();
}
}
}
}
?>
Register