<?php 
    ob_start();
	include 'db.php'; 
	$id = $_POST['id'];
	$otp=str_replace("'","''", $_POST['otp']);
	$sql = $dbh->query("select * from employee_login where id='$id' and otp='$otp'");
	$rows = $sql->fetchAll();
	$num_rows = count($rows);
	if($num_rows==0)
	{
		header("location:get_otp.php?wrong=Invalid OTP");
	}
	else
	{
		header("location:new_pass.php");	
	}
?>