<?php
require_once 'config.php';
require_once 'email.php';

// ===== AFFILIATE TRACKING CODE =====
session_start(); // Ensure session is started

$affiliate_code = isset($_GET['ref']) ? sanitize($_GET['ref']) : '';
$affiliate = null;
$affiliate_signup_id = null;
$adminPdo = null;

if (!empty($affiliate_code)) {
    try {
        // Connect to admin database
        $adminPdo = new PDO(
            "mysql:host=localhost;dbname=u752449863_rrshop;charset=utf8mb4",
            'u752449863_rradmin',
            'S@n@h2016',
            [
                PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
            ]
        );
        
        // Check if affiliate exists and is active
        $stmt = $adminPdo->prepare("SELECT * FROM affiliates WHERE affiliate_code = ? AND status = 'active'");
        $stmt->execute([$affiliate_code]);
        $affiliate = $stmt->fetch();
        
        if ($affiliate) {
            // Track the click (only if not already tracked in this session)
            if (!isset($_SESSION['affiliate_tracked_' . $affiliate['id']])) {
                $trackStmt = $adminPdo->prepare("
                    INSERT INTO affiliate_signups (affiliate_id, ip_address, user_agent, clicked_at)
                    VALUES (?, ?, ?, NOW())
                ");
                $trackStmt->execute([
                    $affiliate['id'],
                    $_SERVER['REMOTE_ADDR'] ?? null,
                    $_SERVER['HTTP_USER_AGENT'] ?? null
                ]);
                
                $_SESSION['affiliate_tracked_' . $affiliate['id']] = true;
                $_SESSION['affiliate_signup_id'] = $adminPdo->lastInsertId();
            }
            
            $affiliate_signup_id = $_SESSION['affiliate_signup_id'] ?? null;
        }
    } catch (Exception $e) {
        logError('Affiliate tracking error: ' . $e->getMessage());
    }
}
// ===== END AFFILIATE TRACKING CODE =====

$errors = [];
$success_message = '';
$form_data = [];

// ===== ANTI-BOT: Generate CSRF token =====
if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
// Reset form timing on page load (GET), not POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    $_SESSION['form_loaded_at'] = time();
}

// ===== ANTI-BOT: reCAPTCHA v3 config =====
$recaptcha_site_key = defined('RECAPTCHA_SITE_KEY') ? RECAPTCHA_SITE_KEY : '';
$recaptcha_secret_key = defined('RECAPTCHA_SECRET_KEY') ? RECAPTCHA_SECRET_KEY : '';

// Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Initialize database
    try {
        $db = new Database();
        $pdo = $db->getConnection();
    } catch (Exception $e) {
        logError('Database connection failed in signup.php: ' . $e->getMessage());
        $errors[] = 'System error. Please try again later.';
    }

    if (empty($errors)) {
        $clientIP = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
        $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
        $honeypotTriggered = false;

        // ===== ANTI-BOT CHECK 1: Honeypot field =====
        if (!empty($_POST['website_url'])) {
            // Bots fill hidden fields - silently reject
            $honeypotTriggered = true;
            logError('Honeypot triggered on signup', ['ip' => $clientIP, 'ua' => $userAgent]);
            // Log the attempt
            try {
                $pdo->prepare("INSERT INTO registration_attempts (ip_address, email, attempt_type, success, user_agent, honeypot_triggered) VALUES (?, ?, 'registration', 0, ?, 1)")
                    ->execute([$clientIP, $_POST['email'] ?? '', $userAgent]);
            } catch (Exception $e) {}
            // Show fake success to not alert the bot
            $success_message = 'Registration successful! We\'ve sent a verification link to your email address. Please check your inbox and click the link to activate your account.';
            $form_data = [];
        }

        // ===== ANTI-BOT CHECK 2: CSRF token =====
        if (!$honeypotTriggered) {
            $submittedToken = $_POST['csrf_token'] ?? '';
            if (empty($submittedToken) || !hash_equals($_SESSION['csrf_token'], $submittedToken)) {
                $errors[] = 'Security validation failed. Please refresh the page and try again.';
                logError('CSRF token mismatch on signup', ['ip' => $clientIP]);
            }
        }

        // ===== ANTI-BOT CHECK 3: Time-based detection (form filled too fast) =====
        if (!$honeypotTriggered && empty($errors)) {
            $formLoadedAt = $_SESSION['form_loaded_at'] ?? time();
            $timeTaken = time() - $formLoadedAt;
            if ($timeTaken < 3) {
                // Human can't fill the form in under 3 seconds
                $errors[] = 'Please take your time filling out the form.';
                logError('Form submitted too quickly', ['ip' => $clientIP, 'seconds' => $timeTaken]);
                try {
                    $pdo->prepare("INSERT INTO registration_attempts (ip_address, attempt_type, success, user_agent) VALUES (?, 'registration', 0, ?)")
                        ->execute([$clientIP, $userAgent]);
                } catch (Exception $e) {}
            }
        }

        // ===== ANTI-BOT CHECK 4: IP blocklist =====
        if (!$honeypotTriggered && empty($errors)) {
            try {
                $stmt = $pdo->prepare("SELECT id FROM ip_blocklist WHERE ip_address = ? AND (expires_at IS NULL OR expires_at > NOW())");
                $stmt->execute([$clientIP]);
                if ($stmt->fetch()) {
                    $errors[] = 'Registration is temporarily unavailable from your network. Please contact support.';
                    logError('Blocked IP attempted signup', ['ip' => $clientIP]);
                }
            } catch (Exception $e) {}
        }

        // ===== ANTI-BOT CHECK 5: Rate limiting (max 3 attempts per IP per hour) =====
        if (!$honeypotTriggered && empty($errors)) {
            try {
                $stmt = $pdo->prepare("SELECT COUNT(*) as cnt FROM registration_attempts WHERE ip_address = ? AND attempt_type = 'registration' AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)");
                $stmt->execute([$clientIP]);
                $attempts = $stmt->fetch();
                if ($attempts && $attempts['cnt'] >= 3) {
                    $errors[] = 'Too many registration attempts. Please try again later.';
                    logError('Rate limit exceeded on signup', ['ip' => $clientIP, 'attempts' => $attempts['cnt']]);
                    // Auto-block IP for 2 hours if 5+ attempts
                    if ($attempts['cnt'] >= 5) {
                        try {
                            $pdo->prepare("INSERT IGNORE INTO ip_blocklist (ip_address, reason, blocked_by, expires_at) VALUES (?, 'Excessive registration attempts', 'system', DATE_ADD(NOW(), INTERVAL 2 HOUR))")
                                ->execute([$clientIP]);
                        } catch (Exception $e) {}
                    }
                }
            } catch (Exception $e) {}
        }

        // ===== ANTI-BOT CHECK 6: IP duplicate registration (max 1 account per IP) =====
        if (!$honeypotTriggered && empty($errors)) {
            try {
                $stmt = $pdo->prepare("SELECT COUNT(*) as cnt FROM users WHERE signup_ip = ? AND created_at > DATE_SUB(NOW(), INTERVAL 24 HOUR)");
                $stmt->execute([$clientIP]);
                $ipSignups = $stmt->fetch();
                if ($ipSignups && $ipSignups['cnt'] >= 1) {
                    $errors[] = 'Only one registration is allowed per network within 24 hours. If you believe this is an error, please contact support@relevantreflex.com.';
                    logError('Duplicate IP registration blocked', ['ip' => $clientIP, 'existing_count' => $ipSignups['cnt']]);
                    try {
                        $pdo->prepare("INSERT INTO registration_attempts (ip_address, email, attempt_type, success, user_agent) VALUES (?, ?, 'registration', 0, ?)")
                            ->execute([$clientIP, $_POST['email'] ?? '', $userAgent]);
                    } catch (Exception $e) {}
                }
            } catch (Exception $e) {}
        }

        // ===== ANTI-BOT CHECK 7: reCAPTCHA v3 verification =====
        if (!$honeypotTriggered && empty($errors) && !empty($recaptcha_secret_key)) {
            $recaptchaResponse = $_POST['g-recaptcha-response'] ?? '';
            if (empty($recaptchaResponse)) {
                $errors[] = 'Security verification failed. Please try again.';
            } else {
                $verifyUrl = 'https://www.google.com/recaptcha/api/siteverify';
                $response = file_get_contents($verifyUrl . '?' . http_build_query([
                    'secret' => $recaptcha_secret_key,
                    'response' => $recaptchaResponse,
                    'remoteip' => $clientIP
                ]));
                $recaptchaResult = json_decode($response, true);
                $captchaScore = $recaptchaResult['score'] ?? 0;
                
                if (!($recaptchaResult['success'] ?? false) || $captchaScore < 0.3) {
                    $errors[] = 'Security verification failed. If you are not a robot, please try again.';
                    logError('reCAPTCHA failed', ['ip' => $clientIP, 'score' => $captchaScore]);
                    try {
                        $pdo->prepare("INSERT INTO registration_attempts (ip_address, attempt_type, success, user_agent, captcha_score) VALUES (?, 'registration', 0, ?, ?)")
                            ->execute([$clientIP, $userAgent, $captchaScore]);
                    } catch (Exception $e) {}
                }
            }
        }

        // Get and sanitize form data
        $email = isset($_POST['email']) ? sanitize($_POST['email']) : '';
        $password = isset($_POST['password']) ? $_POST['password'] : '';
        $gender = isset($_POST['gender']) ? sanitize($_POST['gender']) : '';
        $dateOfBirth = isset($_POST['date_of_birth']) ? sanitize($_POST['date_of_birth']) : '';
        $postcode = isset($_POST['postcode']) ? sanitize($_POST['postcode']) : '';
        $privacyAccepted = isset($_POST['privacy_policy']) ? true : false;

        // Store form data for repopulating form on error
        $form_data = [
            'email' => $email,
            'gender' => $gender,
            'date_of_birth' => $dateOfBirth,
            'postcode' => $postcode
        ];

        // Validation
        if (empty($email)) {
            $errors[] = 'Email is required.';
        }

        if (empty($password)) {
            $errors[] = 'Password is required.';
        }

        if (empty($gender)) {
            $errors[] = 'Gender is required.';
        }

        if (empty($dateOfBirth)) {
            $errors[] = 'Date of birth is required.';
        }

        if (empty($postcode)) {
            $errors[] = 'Postcode is required.';
        }

        if (!$privacyAccepted) {
            $errors[] = 'You must agree to the Privacy Policy and Terms & Conditions.';
        }

        // Validate email format
        if (!empty($email) && !validateEmail($email)) {
            $errors[] = 'Please provide a valid email address.';
        }

        // Validate password strength
        if (!empty($password) && !validatePassword($password)) {
            $errors[] = 'Password must be at least 8 characters long.';
        }

        // Validate gender
        if (!empty($gender) && !in_array($gender, ['Male', 'Female'])) {
            $errors[] = 'Please select a valid gender.';
        }

        // Validate date of birth
        if (!empty($dateOfBirth) && !validateDateOfBirth($dateOfBirth)) {
            $errors[] = 'You must be at least 18 years old to register.';
        }

        // Validate postcode
        if (!empty($postcode) && !validatePostcode($postcode)) {
            $errors[] = 'Please provide a valid 6-digit postal code.';
        }

        // If no validation errors, proceed with registration
        if (empty($errors)) {
            try {
                // Check if email already exists
                $stmt = $pdo->prepare("SELECT id FROM users WHERE email = ?");
                $stmt->execute([$email]);
                
                if ($stmt->rowCount() > 0) {
                    $errors[] = 'An account with this email address already exists. Please try logging in or use a different email.';
                } else {
                    // Hash the password
                    $hashedPassword = hashPassword($password);
                    
                    // Start transaction
                    $pdo->beginTransaction();
                    
                    // Insert new user (with signup IP)
                    $stmt = $pdo->prepare("
                        INSERT INTO users (email, password, gender, date_of_birth, postcode, signup_ip, email_verified, status, created_at) 
                        VALUES (?, ?, ?, ?, ?, ?, 0, 'inactive', NOW())
                    ");
                    
                    $stmt->execute([$email, $hashedPassword, $gender, $dateOfBirth, $postcode, $clientIP]);
                    $userId = $pdo->lastInsertId();
                    
                    // Generate verification token
                    $verificationToken = generateSecureToken();
                    $expiresAt = date('Y-m-d H:i:s', strtotime('+' . TOKEN_EXPIRY_HOURS . ' hours'));
                    
                    // Insert verification token
                    $stmt = $pdo->prepare("
                        INSERT INTO email_verifications (user_id, token, expires_at, created_at) 
                        VALUES (?, ?, ?, NOW())
                    ");
                    
                    $stmt->execute([$userId, $verificationToken, $expiresAt]);
                    
                    // Commit transaction
                    $pdo->commit();
                    
                    // ===== Log successful registration attempt =====
                    try {
                        $pdo->prepare("INSERT INTO registration_attempts (ip_address, email, attempt_type, success, user_agent) VALUES (?, ?, 'registration', 1, ?)")
                            ->execute([$clientIP, $email, $userAgent]);
                    } catch (Exception $e) {}
                    
                    // Regenerate CSRF token
                    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
                    
                    // ===== UPDATE AFFILIATE TRACKING =====
                    if ($affiliate && $affiliate_signup_id && $adminPdo) {
                        try {
                            $updateStmt = $adminPdo->prepare("
                                UPDATE affiliate_signups 
                                SET panel_user_id = ?, 
                                    email = ?, 
                                    signup_completed = 1, 
                                    signed_up_at = NOW(),
                                    reward_amount = ?
                                WHERE id = ?
                            ");
                            $updateStmt->execute([
                                $userId,
                                $email,
                                $affiliate['signup_reward'],
                                $affiliate_signup_id
                            ]);
                            
                            // Update affiliate total signups
                            $adminPdo->exec("UPDATE affiliates SET total_signups = total_signups + 1 WHERE id = " . intval($affiliate['id']));
                            
                            logError('Affiliate signup tracked', [
                                'user_id' => $userId,
                                'affiliate_code' => $affiliate_code,
                                'email' => $email
                            ]);
                        } catch (Exception $e) {
                            logError('Failed to update affiliate tracking: ' . $e->getMessage());
                        }
                    }
                    // ===== END UPDATE AFFILIATE TRACKING =====
                    
                    // Send verification email
                    $emailHandler = new EmailHandler();
                    $emailSent = $emailHandler->sendVerificationEmail($email, $verificationToken);
                    
                    if ($emailSent) {
                        logError('User registered successfully', [
                            'user_id' => $userId,
                            'email' => $email,
                            'verification_token_sent' => true,
                            'affiliate_code' => $affiliate_code ?? null
                        ]);
                        
                        $success_message = 'Registration successful! We\'ve sent a verification link to your email address. Please check your inbox and click the link to activate your account.';
                        $form_data = []; // Clear form data on success
                    } else {
                        // Registration was successful but email failed
                        logError('User registered but email verification failed', [
                            'user_id' => $userId,
                            'email' => $email
                        ]);
                        
                        $success_message = 'Registration successful! However, we encountered an issue sending the verification email. Please contact support at support@relevantreflex.com to activate your account.';
                        $form_data = [];
                    }
                }
            } catch (PDOException $e) {
                // Rollback transaction on error
                if ($pdo->inTransaction()) {
                    $pdo->rollback();
                }
                
                logError('Database error during registration', [
                    'error' => $e->getMessage(),
                    'email' => $email
                ]);
                
                $errors[] = 'Registration failed due to a system error. Please try again later.';
                
            } catch (Exception $e) {
                // Rollback transaction on error
                if ($pdo->inTransaction()) {
                    $pdo->rollback();
                }
                
                logError('General error during registration', [
                    'error' => $e->getMessage(),
                    'email' => $email
                ]);
                
                $errors[] = 'An unexpected error occurred. Please try again later.';
            }
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">

<head>
    <title>Sign Up - Relevant Reflex Paid Online Surveys India</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">

    <link rel="apple-touch-icon" href="assets/img/apple-icon.png">
    <link rel="shortcut icon" type="image/x-icon" href="assets/img/favicon.png">

    <link rel="stylesheet" href="assets/css/bootstrap.min.css">
    <link rel="stylesheet" href="assets/css/templatemo.css">
    <link rel="stylesheet" href="assets/css/custom.css">

    <!-- Load fonts style after rendering the layout styles -->
    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Roboto:wght@100;200;300;400;500;700;900&display=swap">
    <link rel="stylesheet" href="assets/css/fontawesome.min.css">

    <style>
        .registration-form {
            background: white;
            border-radius: 8px;
            padding: 2rem;
            box-shadow: 0 2px 10px rgba(0,0,0,0.1);
            max-width: 500px;
            margin: 0 auto;
        }
        .form-tabs {
            border-bottom: 1px solid #e5e5e5;
            margin-bottom: 1.5rem;
        }
        .form-tabs .nav-link {
            border: none;
            border-bottom: 2px solid transparent;
            color: #666;
            padding: 0.5rem 1rem;
        }
        .form-tabs .nav-link.active {
            border-bottom: 2px solid #59ab6e;
            color: #59ab6e;
            background: none;
        }
        .form-group {
            margin-bottom: 1rem;
        }
        .form-label {
            font-weight: 500;
            color: #333;
            display: block;
            margin-bottom: 0.5rem;
        }
        .required {
            color: #dc3545;
        }
        .form-control {
            width: 100%;
            padding: 0.75rem;
            border: 1px solid #ddd;
            border-radius: 4px;
            font-size: 1rem;
        }
        .form-control:focus {
            outline: none;
            border-color: #59ab6e;
            box-shadow: 0 0 0 0.2rem rgba(89, 171, 110, 0.25);
        }
        .gender-options {
            display: flex;
            gap: 2rem;
        }
        .gender-options label {
            display: flex;
            align-items: center;
            cursor: pointer;
        }
        .gender-options input[type="radio"] {
            margin-right: 0.5rem;
        }
        .password-toggle {
            position: relative;
        }
        .toggle-password {
            position: absolute;
            right: 10px;
            top: 50%;
            transform: translateY(-50%);
            background: none;
            border: none;
            cursor: pointer;
            color: #666;
        }
        .privacy-text {
            background: #f8f9fa;
            padding: 1rem;
            border-radius: 4px;
            font-size: 0.9rem;
            color: #666;
            margin-bottom: 1rem;
        }
        .checkbox-container {
            display: flex;
            align-items: flex-start;
            margin-bottom: 1rem;
        }
        .checkbox-container input[type="checkbox"] {
            margin-right: 0.5rem;
            margin-top: 0.25rem;
        }
        .register-btn {
            width: 100%;
            padding: 0.75rem;
            background: #59ab6e;
            color: white;
            border: none;
            border-radius: 4px;
            font-size: 1rem;
            font-weight: 500;
            cursor: pointer;
            transition: background 0.3s;
        }
        .register-btn:hover {
            background: #4a9a5e;
        }
        .login-link {
            text-align: center;
            margin-top: 1rem;
        }
        .login-link a {
            color: #59ab6e;
            text-decoration: none;
        }
        .login-link a:hover {
            text-decoration: underline;
        }
        .alert {
            padding: 1rem;
            border-radius: 4px;
            margin-bottom: 1rem;
        }
        .alert-success {
            background: #d4edda;
            border: 1px solid #c3e6cb;
            color: #155724;
        }
        .alert-danger {
            background: #f8d7da;
            border: 1px solid #f5c6cb;
            color: #721c24;
        }
        .affiliate-banner {
            background: linear-gradient(135deg, #59ab6e 0%, #4a9a5e 100%);
            color: white;
            padding: 1rem;
            border-radius: 8px;
            margin-bottom: 1.5rem;
            text-align: center;
        }
        .affiliate-banner strong {
            font-size: 1.1rem;
        }
        .reward-badge {
            display: inline-block;
            background: rgba(255, 255, 255, 0.2);
            padding: 0.5rem 1rem;
            border-radius: 20px;
            margin-top: 0.5rem;
        }
    </style>
</head>

<body>
    <!-- Start Top Nav -->
    <nav class="navbar navbar-expand-lg bg-dark navbar-light d-none d-lg-block" id="templatemo_nav_top">
        <div class="container text-light">
            <div class="w-100 d-flex justify-content-between">
                <div>
                    <i class="fa fa-envelope mx-2"></i>
                    <a class="navbar-sm-brand text-light text-decoration-none" href="mailto:support@relevantreflex.com">support@relevantreflex.com</a>
                    <i class="fa fa-phone mx-2"></i>
                    <span class="navbar-sm-brand text-light">India's Premier Survey Platform</span>
                </div>
                <div>
                    <a class="text-light" href="login.php"><u>Already have an account? Log In</u></a>
                </div>
            </div>
        </div>
    </nav>
    <!-- Close Top Nav -->

    <!-- Header -->
    <nav class="navbar navbar-expand-lg navbar-light shadow">
        <div class="container d-flex justify-content-between align-items-center">
            <a class="navbar-brand text-success logo h1 align-self-center" href="index.php">
                Relevant Reflex
            </a>

            <button class="navbar-toggler border-0" type="button" data-bs-toggle="collapse" data-bs-target="#templatemo_main_nav" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
                <span class="navbar-toggler-icon"></span>
            </button>

            <div class="align-self-center collapse navbar-collapse flex-fill d-lg-flex justify-content-lg-between" id="templatemo_main_nav">
                <div class="flex-fill">
                    <ul class="nav navbar-nav d-flex justify-content-between mx-lg-auto">
                        <li class="nav-item">
                            <a class="nav-link" href="index.php">Home</a>
                        </li>
                        <li class="nav-item">
                            <a class="nav-link" href="about.php">About</a>
                        </li>
                        <li class="nav-item">
                            <a class="nav-link" href="doubts.php">How It Works</a>
                        </li>
                        <li class="nav-item">
                            <a class="nav-link" href="articles.php">Articles</a>
                        </li>
                        <li class="nav-item">
                            <a class="nav-link" href="contact.php">Contact</a>
                        </li>
                    </ul>
                </div>
                <div class="navbar align-self-center d-flex">
                    <a class="btn btn-outline-success me-2" href="login.php">
                        <i class="fa fa-sign-in-alt"></i> Login
                    </a>
                    <a class="btn btn-success" href="signup.php">
                        <i class="fa fa-user-plus"></i> Sign Up
                    </a>
                </div>
            </div>
        </div>
    </nav>
    <!-- Close Header -->

    <!-- Start Section -->
    <section class="container py-5">
        <div class="row text-center pt-3 pb-3">
            <div class="col-lg-6 m-auto">
                <h1 class="h1">Register as a Survey Taker for FREE!</h1>
                <p>Furnish some of your basic information below and start making money online through Paid Surveys.</p>
                
                <?php if ($affiliate): ?>
                <div class="affiliate-banner">
                    <div><strong>ðŸŽ‰ Partner Signup</strong></div>
                    <div>Referred by: <?php echo htmlspecialchars($affiliate['company_name']); ?></div>
                    <?php if ($affiliate['signup_reward'] > 0): ?>
                    <div class="reward-badge">
                        ðŸŽ Earn â‚¹<?php echo number_format($affiliate['signup_reward'], 2); ?> bonus on email & Mobile phone verification!
                    </div>
                    <?php endif; ?>
                </div>
                <?php endif; ?>
            </div>
        </div>
        
        <div class="row justify-content-center">
            <div class="col-lg-6">
                <div class="registration-form">
                    <!-- Tab Navigation -->
                    <ul class="nav nav-tabs form-tabs" id="registrationTabs">
                        <li class="nav-item">
                            <a class="nav-link" href="login.php">Log in</a>
                        </li>
                        <li class="nav-item">
                            <a class="nav-link active" href="#signup">Sign up</a>
                        </li>
                    </ul>

                    <!-- Success/Error Messages -->
                    <?php if (!empty($success_message)): ?>
                        <div class="alert alert-success">
                            <i class="fa fa-check-circle"></i> <?php echo htmlspecialchars($success_message); ?>
                        </div>
                    <?php endif; ?>

                    <?php if (!empty($errors)): ?>
                        <div class="alert alert-danger">
                            <i class="fa fa-exclamation-triangle"></i>
                            <?php foreach ($errors as $error): ?>
                                <div><?php echo htmlspecialchars($error); ?></div>
                            <?php endforeach; ?>
                        </div>
                    <?php endif; ?>

                    <!-- Registration Form -->
                    <?php if (empty($success_message)): ?>
                    <form method="POST" action="signup.php<?php echo !empty($affiliate_code) ? '?ref=' . htmlspecialchars($affiliate_code) : ''; ?>" id="signupForm">
                        <!-- CSRF Token -->
                        <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">
                        
                        <!-- Honeypot field - hidden from humans, bots fill it -->
                        <div style="position:absolute;left:-9999px;top:-9999px;opacity:0;height:0;width:0;overflow:hidden;" aria-hidden="true">
                            <label for="website_url">Website URL</label>
                            <input type="text" name="website_url" id="website_url" tabindex="-1" autocomplete="off" value="">
                        </div>
                        <!-- Gender -->
                        <div class="form-group">
                            <label class="form-label">Gender<span class="required">*</span></label>
                            <div class="gender-options">
                                <label>
                                    <input type="radio" name="gender" value="Male" <?php echo (isset($form_data['gender']) && $form_data['gender'] === 'Male') ? 'checked' : ''; ?> required>
                                    Male
                                </label>
                                <label>
                                    <input type="radio" name="gender" value="Female" <?php echo (isset($form_data['gender']) && $form_data['gender'] === 'Female') ? 'checked' : ''; ?> required>
                                    Female
                                </label>
                            </div>
                        </div>

                        <!-- Email -->
                        <div class="form-group">
                            <label class="form-label" for="email">Email<span class="required">*</span></label>
                            <input type="email" 
                                   class="form-control" 
                                   id="email" 
                                   name="email" 
                                   value="<?php echo isset($form_data['email']) ? htmlspecialchars($form_data['email']) : ''; ?>"
                                   required>
                        </div>

                        <!-- Password -->
                        <div class="form-group">
                            <label class="form-label" for="password">Password<span class="required">*</span></label>
                            <div class="password-toggle">
                                <input type="password" class="form-control" id="password" name="password" required minlength="8">
                                <button type="button" class="toggle-password" onclick="togglePassword('password')">
                                    <i class="fa fa-eye" id="password-eye"></i>
                                </button>
                            </div>
                            <small class="text-muted">Minimum 8 characters</small>
                        </div>

                        <!-- Date of Birth -->
                        <div class="form-group">
                            <label class="form-label" for="dob">Date of birth<span class="required">*</span></label>
                            <input type="date" 
                                   class="form-control" 
                                   id="dob" 
                                   name="date_of_birth" 
                                   value="<?php echo isset($form_data['date_of_birth']) ? htmlspecialchars($form_data['date_of_birth']) : ''; ?>"
                                   required 
                                   max="<?php echo date('Y-m-d', strtotime('-18 years')); ?>">
                        </div>

                        <!-- Postcode -->
                        <div class="form-group">
                            <label class="form-label" for="postcode">Postcode<span class="required">*</span></label>
                            <input type="text" 
                                   class="form-control" 
                                   id="postcode" 
                                   name="postcode" 
                                   value="<?php echo isset($form_data['postcode']) ? htmlspecialchars($form_data['postcode']) : ''; ?>"
                                   required 
                                   pattern="[0-9]{6}" 
                                   maxlength="6" 
                                   title="Please enter a valid 6-digit postal code">
                        </div>

                        <!-- Privacy Notice -->
                        <div class="privacy-text">
                            We care about your privacy. By sharing your personal data you will be able to get research opportunities targeted to your interests, help to improve products and services and earn rewards for participation
                        </div>

                        <!-- Privacy Policy Checkbox -->
                        <div class="checkbox-container">
                            <input type="checkbox" id="privacy" name="privacy_policy" required>
                            <label for="privacy">
                                I agree to the <a href="privacy.html" target="_blank">Privacy Notice</a> and <a href="terms.html" target="_blank">Terms and Conditions</a>
                            </label>
                        </div>

                        <!-- reCAPTCHA v3 hidden token -->
                        <?php if (!empty($recaptcha_site_key)): ?>
                        <input type="hidden" name="g-recaptcha-response" id="recaptchaResponse">
                        <?php endif; ?>

                        <!-- Submit Button -->
                        <button type="submit" class="register-btn" id="submitBtn">
                            <i class="fa fa-user-plus"></i> Register
                        </button>

                        <!-- Login Link -->
                        <div class="login-link">
                            <p>Already have an account? <a href="login.php">Log in here</a></p>
                        </div>
                    </form>
                    <?php else: ?>
                        <!-- Show success actions -->
                        <div class="text-center">
                            <h5>What's Next?</h5>
                            <p>Check your email inbox and click the verification link to activate your account.</p>
                            <div class="mt-3">
                                <a href="login.php" class="btn btn-success">
                                    <i class="fa fa-sign-in-alt"></i> Go to Login Page
                                </a>
                            </div>
                            <div class="mt-3" style="background:#f8fafc;border:1px solid #e2e8f0;border-radius:8px;padding:16px;text-align:left;">
                                <p style="font-size:13px;color:#475569;margin-bottom:10px;">
                                    <i class="fa fa-info-circle" style="color:#3b82f6;"></i> 
                                    <strong>Didn't receive the email?</strong> Check your spam/junk folder. If it's not there, click below to resend.
                                </p>
                                <form method="POST" action="login.php">
                                    <input type="hidden" name="action" value="resend_verification">
                                    <input type="hidden" name="email" value="<?php echo htmlspecialchars($email ?? ''); ?>">
                                    <button type="submit" style="background:#059669;color:#fff;border:none;padding:10px 18px;border-radius:6px;font-size:13px;font-weight:600;cursor:pointer;font-family:inherit;width:100%;">
                                        <i class="fa fa-paper-plane"></i> Resend Verification Email
                                    </button>
                                </form>
                            </div>
                        </div>
                    <?php endif; ?>
                </div>
            </div>
        </div>
    </section>
    <!-- End Section -->

    <!-- Start Footer -->
    <footer class="bg-dark" id="tempaltemo_footer">
        <div class="container">
            <div class="row">
                <div class="col-md-4 pt-5">
                    <h2 class="h2 text-success border-bottom pb-3 border-light logo">Relevant Reflex</h2>
                    <ul class="list-unstyled text-light footer-link-list">
                        <li>
                            <i class="fas fa-map-marker-alt fa-fw"></i>
                            Ethirmedu, NH 544, Tamilnadu - 638183, India
                        </li>
                        <li>
                            <i class="fa fa-envelope fa-fw"></i>
                            <a class="text-decoration-none" href="mailto:support@relevantreflex.com">support@relevantreflex.com</a>
                        </li>
                    </ul>
                </div>

                <div class="col-md-4 pt-5">
                    <h2 class="h2 text-light border-bottom pb-3 border-light">Quick Links</h2>
                    <ul class="list-unstyled text-light footer-link-list">
                        <li><a class="text-decoration-none" href="index.php">Home</a></li>
                        <li><a class="text-decoration-none" href="signup.php">Sign Up</a></li>
                        <li><a class="text-decoration-none" href="login.php">Log In</a></li>
                        <li><a class="text-decoration-none" href="doubts.php">How It Works</a></li>
                        <li><a class="text-decoration-none" href="contact.php">Contact</a></li>
                    </ul>
                </div>

                <div class="col-md-4 pt-5">
                    <h2 class="h2 text-light border-bottom pb-3 border-light">Further Info</h2>
                    <ul class="list-unstyled text-light footer-link-list">
                        <li><a class="text-decoration-none" href="about.php">About</a></li>
                        <li><a class="text-decoration-none" href="privacy.html">Privacy Policy</a></li>
                        <li><a class="text-decoration-none" href="terms.html">Terms</a></li>
                        <li><a class="text-decoration-none" href="articles.php">Articles</a></li>
                        <li><a class="text-decoration-none" href="contact.php">Support</a></li>
                    </ul>
                </div>
            </div>
        </div>

        <div class="w-100 bg-black py-3">
            <div class="container">
                <div class="row pt-2">
                    <div class="col-12">
                        <p class="text-center text-light">
                            Copyright &copy; <?php echo date('Y'); ?> Relevant Reflex | All Rights Reserved
                        </p>
                    </div>
                </div>
            </div>
        </div>
    </footer>
    <!-- End Footer -->

    <!-- Start Script -->
    <script src="assets/js/jquery-1.11.0.min.js"></script>
    <script src="assets/js/jquery-migrate-1.2.1.min.js"></script>
    <script src="assets/js/bootstrap.bundle.min.js"></script>
    <script src="assets/js/templatemo.js"></script>
    <script src="assets/js/custom.js"></script>
    
    <script>
        function togglePassword(inputId) {
            const passwordInput = document.getElementById(inputId);
            const eyeIcon = document.getElementById(inputId + '-eye');
            
            if (passwordInput.type === 'password') {
                passwordInput.type = 'text';
                eyeIcon.classList.remove('fa-eye');
                eyeIcon.classList.add('fa-eye-slash');
            } else {
                passwordInput.type = 'password';
                eyeIcon.classList.remove('fa-eye-slash');
                eyeIcon.classList.add('fa-eye');
            }
        }
    </script>

    <?php if (!empty($recaptcha_site_key)): ?>
    <!-- reCAPTCHA v3 -->
    <script src="https://www.google.com/recaptcha/api.js?render=<?php echo htmlspecialchars($recaptcha_site_key); ?>"></script>
    <script>
        document.getElementById('signupForm')?.addEventListener('submit', function(e) {
            e.preventDefault();
            var form = this;
            var btn = document.getElementById('submitBtn');
            btn.disabled = true;
            btn.innerHTML = '<i class="fa fa-spinner fa-spin"></i> Verifying...';
            grecaptcha.ready(function() {
                grecaptcha.execute('<?php echo htmlspecialchars($recaptcha_site_key); ?>', {action: 'signup'}).then(function(token) {
                    document.getElementById('recaptchaResponse').value = token;
                    form.submit();
                }).catch(function() {
                    btn.disabled = false;
                    btn.innerHTML = '<i class="fa fa-user-plus"></i> Register';
                    form.submit(); // Submit anyway if reCAPTCHA fails to load
                });
            });
        });
    </script>
    <?php endif; ?>
    <!-- End Script -->
</body>
</html>