<?php ob_start(); ?>
<div class="card">
  <h2>Edit User</h2>
  <?php if(!empty($errors)) foreach($errors as $e) echo '<p class="error">'.htmlspecialchars($e).'</p>'; ?>
  <form method="post" onsubmit="return validateUserForm(this)">
    <input type="hidden" name="csrf" value="<?php echo htmlspecialchars(csrf_token()); ?>">
    <div class="form-row">
      <div class="field"><label>Username</label><input name="username" class="form-control" value="<?=htmlspecialchars($user['username'])?>" required></div>
      <div class="field"><label>Full name</label><input name="fullname" class="form-control" value="<?=htmlspecialchars($user['fullname'])?>"></div>
    </div>
    <div class="form-row"><div class="field"><label>New Password (leave blank to keep)</label><input type="password" class="form-control" name="password"></div></div>
    <div style="margin-top:12px"><button type="submit" class="btn btn-primary">Save</button> <a href="index.php?controller=user&action=index" class="btn btn-secondary">Cancel</a></div>
  </form>
</div>
<?php $content = ob_get_clean(); include __DIR__ . '/../layout.php'; ?>
