Here is an in-depth look at how Android 36 is redefining the mobile experience.

1. The Core Architecture: Neural Engine 2.0

The most significant change in Android 36 isn’t a button or a menu; it’s the kernel-level integration of Neural Engine 2.0. In older versions, AI was an app or a service. In Android 36, the OS itself is a predictive engine.

• Zero-Latency On-Device Processing: Unlike previous generations that relied on cloud processing for complex tasks, Android 36 performs 90% of its reasoning on-device. This ensures that privacy is maintained while drastically reducing battery drain associated with data transmission.
• Predictive Resource Allocation: The OS anticipates which apps you will open based on your location, biometric stress levels, and time of day, pre-loading them into a “Virtual RAM” state that makes the interface feel instantaneous.

2. The User Interface: “Fluid Material”

Android 36 introduces Fluid Material, an evolution of Google’s design language. The static grid of icons is finally beginning to fade.

The Dynamic Canvas

Instead of a traditional home screen, Android 36 features a Dynamic Canvas. If you are at the gym, your health metrics and music controls expand to take up 70% of the screen. If you are at work, your calendar and document snippets take priority. The UI “flows” around your context.

Semantic Search Integration

The search bar at the bottom of the screen has been replaced by the Semantic Hub. You no longer search for “Files” or “Photos.” You type or say, “Show me that document I was reading on the train yesterday about the budget,” and the OS pulls the specific section of the PDF regardless of where it’s stored.

3. Communication: Real-Time Universal Translator

Android 36 has effectively broken the language barrier. Building on the foundations of Live Translate, the new Universal Audio Bridge allows for:

• Two-Way Voice Translation in Third-Party Apps: Whether you are on a WhatsApp call or a Zoom meeting, Android 36 provides real-time, lag-free voice dubbing in over 120 languages.
• Contextual Nuance: The AI now recognizes sarcasm, regional dialects, and emotional tone, ensuring that the translation isn’t just accurate in words, but also in intent.

4. Privacy and the “Private Compute Core”

With great AI power comes the need for great privacy. Android 36 introduces The Vault, a hardware-isolated environment for all personal data.

• Data Poisoning Protection: To prevent malicious apps from “learning” your habits, Android 36 generates “noise” data to confuse trackers while keeping your actual usage patterns locked in the Vault.
• One-Time Permissions 2.0: You can now grant “Visual Permissions” where an app can see the screen for a specific task (like scanning a QR code) and then immediately loses access the microsecond the task is finished.

5. Connectivity: The “Satellite-First” Era

Android 36 marks the end of “No Service” zones. Through partnerships with global satellite constellations, Android 36 features Seamless Satellite Roaming.

When terrestrial 5G or 6G signals drop below a certain threshold, the OS automatically handshakes with low-earth orbit (LEO) satellites. This isn’t just for emergencies anymore; Android 36 supports low-bandwidth messaging and navigation via satellite as a standard feature, included in the OS core.

Originally published at https://whatandroidwhy.blogspot.com.

What is Android API 36 was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

Here is a deep dive into the speculative world of Android 37: The Neural-Spatio OS.

1. From “Mobile First” to “Neural First”

The most significant shift in Android 37 is the retirement of the traditional Graphic User Interface (GUI). While Android 14 relied on Material You, Android 37 utilizes Material Mind.

By 2047, non-invasive BCI (Brain-Computer Interface) wearables-integrated into glasses, ear-pieces, or even biocompatible dermal patches-have replaced the handheld smartphone. Android 37 doesn’t wait for you to tap an icon; it anticipates intent through synaptic patterns. If you think about wanting to see the “Upay of Anant Kaal Sarp Yog” (as found on your blog), the OS doesn’t open a browser; it projects the text directly into your visual field via augmented reality (AR) or synthesized thought.

2. The Architecture: Quantum-Linux Kernel

The Linux kernel that served as the foundation for decades has evolved into the Quantum-Linux Kernel (QLK).

• Instantaneous Processing: Android 37 leverages quantum entanglement for data transfer, meaning “latency” is a word found only in history books.
• Infinite Multitasking: Unlike the restricted RAM management of the 2020s, Android 37 uses “Dynamic Reality Sharding.” It can run thousands of “Applets” (now called Entities) simultaneously across a distributed cloud network, ensuring your device never slows down, regardless of the complexity of the task.

3. The “Gemini Omega” Core

Artificial Intelligence is no longer an app or a side-feature; it is the core of the OS. Gemini Omega, the successor to the AI of the 2020s, acts as a digital twin.

In Android 37, the OS knows your astrological chart, your health metrics, and your professional schedule better than you do. It uses Predictive Life Path Modeling to suggest actions. For example, if it detects a planetary transit that might cause stress (based on your Jyotish interests), it automatically adjusts your environment-dimming smart lights, playing frequency-tuned audio, and rescheduling non-essential meetings.

4. Privacy: The Sovereign Vault

In an era where the OS is connected to your thoughts, privacy is the ultimate concern. Android 37 introduces the Sovereign Vault.

Instead of your data living on Google’s servers, Android 37 operates on a decentralized, “Zero-Knowledge” mesh network. Your memories, biometric data, and personal preferences are encrypted with post-quantum cryptography. The OS operates on a “Local-Only” logic for sensitive neural data, ensuring that even Google cannot “see” your thoughts-only the metadata required to provide services.

5. Visuals: The Death of the Screen

By the time Android 37 arrives, hardware has bifurcated into two categories:

1. Ambient Surfaces: Every window, mirror, and tabletop is a potential display. Android 37 uses “Surface Casting” to move your workspace from a kitchen counter to a car windshield seamlessly.
2. Retinal Projection: Using low-power micro-LEDs or laser projection, the OS draws the interface directly onto your retina.

The “Home Screen” is now a 360-degree 3D environment. You don’t scroll through a feed; you walk through a digital gallery of your news, messages, and social updates.

6. Connectivity: 9G and Beyond

While we currently struggle with 5G dead zones, Android 37 utilizes 9G (Terahertz) connectivity combined with Satellite Mesh.

Connectivity is no longer about “bars” of signal. It is about “Atmospheric Data.” The very air around us becomes a medium for data transmission using light-fidelity (Li-Fi) and satellite-to-neural links. This ensures that whether you are in a remote mountain temple or a subterranean city, your connection to the global collective remains unbroken.

7. The Developer Ecosystem: Prompt-Based Creation

Coding in Android 37 has shifted from Java and Kotlin to Natural Intent Language (NIL).

Developers no longer write lines of code. They define the “Persona” and “Purpose” of an Entity. To build an app for your Jyotish blog in 2047, you would simply tell the OS: “Create a localized astral-tracking Entity that provides real-time remedies for Kaal Sarp Yog using haptic feedback.” The OS then compiles the necessary quantum logic gates in real-time.

8. Sustainability: Kinetic and Thermal Charging

Battery anxiety is a relic of the past. Android 37 devices are powered by Energy Harvesting.

• Kinetic: Charging via the movement of your body.
• Thermal: Using the heat of your skin to power the micro-processors.
• Solar-Dermal: Transparent solar cells integrated into the device’s casing or the wearable itself.

A single “charge” can last months, or in some cases, the device is perpetually powered as long as it is near a human heat source.

9. Integration with the Physical World (Matter 5.0)

Android 37 acts as the “remote control for reality.” Through an advanced version of the Matter protocol, the OS can manipulate physical objects.

• Molecular Haptics: When you touch a holographic object in Android 37, ultrasound waves create the sensation of resistance and texture, making digital objects feel real.
• Smart Matter: The OS can command “programmable matter” to change shape. Your phone might literally unfold into a tablet or reshape itself into a wearable bracelet depending on the context.

The Human-OS Symbiosis

Android 37 represents the final transition of technology from a tool we use to an extension of who we are. It bridges the gap between the ancient wisdom of the stars and the future of quantum computation.

In 2047, you won’t “search” for a remedy on a blog; you will feel the solution as part of your intuition, provided by an operating system that has become as natural as breathing.

Originally published at https://whatandroidwhy.blogspot.com.

What is Android 37 was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

1. The Compass: My AI-Powered Digital Chief of Staff

Then (2020): A chaotic mix of bookmarks, a cluttered bookmark bar, and a dozen open tabs for email, calendar, news, and project management.
Now (2026): [The Compass] — a single, unified dashboard that serves as the operational hub of my digital life.

The Compass isn’t just an aggregator; it’s an intelligent interface. Upon logging in, it greets me by name and provides a “Morning Briefing.” This isn’t a simple list of links. It’s a synthesized summary prepared by my AI assistant, pulling from the other sites on this list. It highlights my top three priorities for the day from my project management tool, warns me of a potential traffic delay for my first meeting, and surfaces one news article deeply relevant to my industry, summarizing its key points in two sentences.

I don’t “use” The Compass so much as I “consult” it. It’s my digital chief of staff, filtering the noise and presenting only the signal I need to start my day effectively. My 2020 self, drowning in tab overload, would have wept with relief at its serene efficiency.

2. Nexus: The Return of the Interest-Based Forum

Then (2020): Endlessly doom-scrolling through Twitter/X and Reddit, seeing a jumbled mix of world news, memes, and personal drama from strangers.
Now (2026): [Nexus] — a platform built not on followers, but on passions.

Nexus killed the influencer. Instead, it revived the deeply-nested forum model with a modern, AI-curated twist. I’m a member of “Nexus Nodes” for “Post-Climate Adaptive Architecture,” “Vintage Analog Synthesizers,” and “Competitive Sourdough Baking.” Each Node has strict, community-enforced quality standards. Low-effort posts are filtered out, and AI assistants help summarize long technical threads or fact-check claims in real-time.

My daily visit feels like stepping into a specialized library or a dedicated clubhouse. The conversations are nuanced, knowledgeable, and constructive. The dopamine hit doesn’t come from likes, but from genuine learning and connection. The chaotic, anger-driven algorithms of old social media feel like a distant, bad dream.

3. DeepRead: Beyond the Clickbait

Then (2020): Skimming headlines from a dozen different news sites, most of them designed for outrage or clicks, leaving me informed of the controversy but not the context.
Now (2026): [DeepRead] — the anti-clickbait news platform.

DeepRead operates on a simple, brilliant model: it only publishes one major, in-depth “Context Brief” per day on a leading story, and two or three shorter “Explainer” pieces. There are no headlines in the traditional sense, only posed questions: “What Are the Real-World Implications of the New EU AI Accord?” or “How is the Re-greening of the Sahel Actually Progressing?”

Each piece is a multi-format masterpiece — text, integrated data visualizations, short expert video interviews, and a timeline of key events. Reading it feels like taking a 15-minute masterclass on the most important thing happening in the world. It has single-handedly cured my news anxiety by replacing shallow information with deep understanding.

4. Soma: The Digital Wellness Prescription

Then (2020): Using a meditation app sporadically, feeling guilty about screen time reports, and having no real structure for mental fitness.
Now (2026): [Soma] — my personalized digital wellness clinic.

Soma understands that wellness isn’t one-size-fits-all. Each morning, I begin with a 60-second “Pulse Check” — a quick series of questions and voice analysis that gauges my mood and energy levels. Based on this, Soma “prescribes” my daily regimen. It might be a 5-minute focused breathing exercise, a 10-minute guided journaling prompt about gratitude, or a “Audio Walk” that pairs ambient soundscapes with a narrative designed to stimulate creative thinking.

My daily visit is non-negotiable, like brushing my teeth. It’s the site that actively repairs the cognitive drain caused by the rest of the digital world. It’s not an app I ignore; it’s a practice I engage with, and it has fundamentally changed my relationship with stress and focus.

5. The Forge: My Continuous Learning Engine

Then (2020): Occasionally browsing YouTube tutorials or signing up for a multi-week online course I’d never finish.
Now (2026): [The Forge] — a platform for “micro-apprenticeships.”

The Forge is built on the premise that learning is a continuous, daily process, not a periodic event. Each day, it serves me a single, 10-minute “Learning Module.” This week, I’m on a track for “Basic Quantum Computing Concepts.” Yesterday’s module was a 7-minute interactive simulation explaining superposition. Today’s is a 3-minute read on qubit stability, followed by a two-question quiz.

The genius is in the consistency and the granularity. It doesn’t feel like a chore; it feels like a daily mental warm-up. Over a year, these tiny modules compound into genuine, retained expertise. It has made lifelong learning not just an aspiration, but a seamless part of my daily routine.

6. Mycelia: The Anti-Silo Social Network

Then (2020): Posting the same photo to Instagram, the same thought to Twitter, and the same life update to Facebook, fragmenting my digital identity.
Now (2026): [Mycelia] — the decentralized, owner-controlled social web.

Mycelia is less a “website” and more a “home base.” It’s my personal blog, photo gallery, and status update hub, all rolled into one. I own all the content and data. The magic, however, is in the “Connective Threads.” When I post a photo from a recent hike, it doesn’t just sit on my page. With my permission, it’s seamlessly syndicated to the “Close Friends” circle on a friend’s Nexus Node, appears as a preview in my family’s Compass feeds, and is archived in my private Soma journal.

My daily visit is to tend my own digital garden. I write a short reflection, post a photo, or share an interesting link from DeepRead. I’m not posting for an algorithm; I’m connecting my little node of the web to the nodes of the people I care about. It’s quiet, personal, and profoundly human.

This daily ritual across these six sites represents a broader shift: from a web that happened to us to a web that works for us. It’s a move away from centralized attention markets and toward a distributed, purposeful, and human-centric digital experience. My 2020 self was a passive consumer in a crowded, noisy bazaar. In 2026, I am an active curator in a well-designed library of my own making. And the difference, quite literally, is day and night.

6 Websites I Visit Every Day in 2026 (And Why My 2020 Self Would Be Shocked) was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

1. Create new Digital Asset Links file (assetlinks.json)

Every app must have its own package name and SHA256 certificate fingerprints in the assetlinks.json.

For your new app (let’s say package_name = com.yourorg.newapp):

[
{
“relation”: [“delegate_permission/common.handle_all_urls”],
“target”: {
“namespace”: “android_app”,
“package_name”: “com.yourorg.newapp”,
“sha256_cert_fingerprints”: [
“AA:BB:CC:DD:…:FF” // Replace with your new app signing certificate SHA-256
]
}
}
]

2. Host the assetlinks.json file

• Make sure it is publicly accessible (check with browser).
• If you already have an assetlinks.json for the first app, you just need to add another object for the second app.

Example with two apps in same file:

[
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "nanoakhi.rcfinternal",
      "sha256_cert_fingerprints": [
        "AA:BB:CC:DD:…:FF",   //this is Google play console u will get
        "AA:BB:CC:DD:…:FF"  //this is Android Studio u will get for debugging
      ]
    }
  },
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.yourorg.newapp",
      "sha256_cert_fingerprints": [
"AA:BB:CC:DD:…:FF",   //this is Google play console u will get
        "AA:BB:CC:DD:…:FF"  //this is Android Studio u will get for debugging
      ]
    }
  }
]

3. Update your new app’s AndroidManifest.xml

Add an intent filter to handle deep links:

<activity
    android:name=".YourDeepLinkActivity"
    android:exported="true">
    
    <intent-filter android:autoVerify="true">
        <action android:name="android.intent.action.VIEW" />

        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />

        <!-- Change host/path according to your domain -->
        <data
            android:scheme="https"
            android:host="yourdomain.com"
            android:pathPrefix="/deeplink" />
    </intent-filter>
</activity>

android:autoVerify="true" makes Android check assetlinks.json during install.

4. Handle the deep link in code

In your YourDeepLinkActivity (or MainActivity):

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    Intent intent = getIntent();
    Uri data = intent.getData();

    if (data != null) {
        String path = data.getPath();
        String query = data.getQueryParameter("id"); // Example
        Toast.makeText(this, "Deep link opened: " + path + " id=" + query, Toast.LENGTH_LONG).show();
    }
}

Summary:

• Keep one assetlinks.json for all apps, with multiple entries.
• Each app must have its own package + SHA256 fingerprint entry.
• Add intent filter in manifest.
• Handle the deep link in activity code.

Steps to Implement Deep Link (2 + App Links) for Your New App was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

Step-by-step changes:

1. Set flag when OTP is verified

In insertOtpToCmms() method, after successful login (whether success == 1 or success == 2), save a flag in SharedPreferences.

SharedPreferences.Editor editor = settings.edit();
editor.putBoolean(“otp_verified”, true);
editor.apply();

For Example

So, your if (success == 1) and if (success == 2) blocks become:

if (success == 1) {
    SharedPreferences.Editor editor = settings.edit();
    editor.putBoolean("otp_verified", true);
    editor.apply();

    Intent intent = new Intent(MainActivity.this, entry_page_register.class);
    intent.putExtra("MOBILE", mobile);
    intent.putExtra("TYPE", "LOGIN");
    intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
    startActivity(intent);
} else if (success == 2) {
    SharedPreferences.Editor editor = settings.edit();
    editor.putBoolean("otp_verified", true);
    editor.apply();

    Intent intent = new Intent(MainActivity.this, dashboard.class);
    intent.putExtra("MOBILE", mobile);
    intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
    startActivity(intent);
}

2. Check this flag in onCreate() before showing the login UI

Add the following at the very top of your onCreate():

settings = getSharedPreferences(MyPREFERENCES, 0);
boolean isOtpVerified = settings.getBoolean(“otp_verified”, false);

if (isOtpVerified) {
// Redirect to dashboard and finish this activity
Intent intent = new Intent(MainActivity.this, dashboard.class);
intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP | Intent.FLAG_ACTIVITY_NEW_TASK);
startActivity(intent);
finish(); // Don’t allow returning to OTP screen
return;
}

Optional: To reset OTP (e.g. during logout)

When user logs out, you can clear this flag like this:

SharedPreferences.Editor editor = getSharedPreferences(MyPREFERENCES, 0).edit();
editor.remove(“otp_verified”); // or editor.clear() to wipe all
editor.apply();

Final result:

• First login → OTP shown → Verified → Dashboard
• Next time opening app → Goes directly to Dashboard
• Only shows OTP screen if not verified yet or after logout.

OTP login page Android JSON API was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

Here’s how you can diagnose and fix the issue:

Steps to Resolve the Issue

1. Check for Multiple session_start() Calls

• The error indicates that session_start() is being called more than once. Since you have session_start() on line 11 of index.php, check the included files (db.php, functions.php, header.php, or footer.php) for additional calls to session_start().
• Look for session_start() in:
• ../includes/db.php
• ../includes/functions.php
• ../includes/header.php
• ../includes/footer.php

Prevent Multiple session_start() Calls

• To avoid this issue, ensure that session_start() is called only once at the beginning of the request. You can use the session_status() function to check if a session is already active before calling session_start(). Modify the code in index.php (line 11) as follows:
• // Start session only if it hasn’t been started if (session_status() === PHP_SESSION_NONE) { session_start(); }
• This checks if a session is already active (PHP_SESSION_ACTIVE) and only starts a new session if none exists (PHP_SESSION_NONE).

Move session_start() to a Common Include File

• If multiple files in your application need session access, it’s better to move the session_start() call to a single common file that is included early in the request lifecycle, such as ../includes/functions.php or ../includes/header.php. For example, in functions.php:
• // In ../includes/functions.php if (session_status() === PHP_SESSION_NONE) { session_start(); }
• Then, remove the session_start() call from index.php and ensure that functions.php is included before any session-related code.

Best Practices

• Always call session_start() as early as possible in your script, before any output is sent to the browser, to avoid issues with headers already sent
• Consider centralizing session management in a single configuration file to avoid accidental duplicate calls.
• In production, disable display_errors to prevent notices from being exposed to users:

Originally published at https://whatandroidwhy.blogspot.com.

session_start() in PHP: A session had already been started was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

To secure the sensitive parameters (e.g., user_id, dob, birth_time, birth_place, gender, etc.) being passed via URL query strings in the <a> tags, you need to prevent sensitive data from being exposed in the browser’s address bar, history, or logs, and protect against potential tampering or unauthorized access. Below, I’ll outline the steps to make these links secure by avoiding sensitive data in query strings and implementing a more secure approach.

Security Concerns with Current Approach

1. Sensitive Data Exposure: Parameters like dob, birth_time, and birth_place are personally identifiable information (PII) visible in the URL, which can be logged in browser history, server logs, or intercepted by intermediaries.
2. Tampering Risk: Query parameters can be modified by users, potentially leading to unauthorized access or incorrect data processing.
3. Lack of Confidentiality: URLs are not encrypted in transit (unless using HTTPS, which only protects during transmission, not in logs or history).
4. Replay Attacks: URLs can be copied and reused, potentially allowing unauthorized access to restricted data.

Secure Solution

To secure the links, you can:

1. Use POST Requests Instead of GET: Move sensitive data to form submissions via POST, which sends data in the request body, not the URL.
2. Use Encrypted Tokens: Replace sensitive parameters with an encrypted token or temporary ID that maps to the data on the server.
3. Implement Session-Based Data Storage: Store sensitive data in the session or a temporary database table and pass only a reference ID.
4. Add CSRF Protection: Include a CSRF token to prevent cross-site request forgery when using forms.
5. Validate and Authorize Access: Ensure the target pages (horoscope_charts.php and horoscope_matching.php) validate user permissions and data integrity.

Below, I’ll implement the POST request with session-based data storage approach, as it balances security and simplicity while completely avoiding sensitive data in URLs.

Updated PHP and HTML

<?php // Generate unique tokens for horoscope and matching data $horoscope_token = bin2hex(random_bytes(16)); // Unique token for horoscope

$matching_token = bin2hex(random_bytes(16)); // Unique token for matching

// Store horoscope data in session $_SESSION[‘horoscope_data’][$horoscope_token] = [ ‘user_id’ => $user_id, ‘profile_id’ => $profile_id, ‘created_at’ => time() // For expiration check ];

// Store matching data in session $_SESSION[‘matching_data’][$matching_token] = [ ‘user_id’ => $user_id, ‘profile_id’ => $profile_id, ‘user_gender’ => $current_user[‘gender’] ?: ‘’, ‘profile_dob’ => $profile[‘dob’] ?: ‘’, ‘created_at’ => time() ]; // Generate CSRF token if (!isset($_SESSION[‘csrf_token’]))

{ $_SESSION[‘csrf_token’] = bin2hex(random_bytes(32)); } $csrf_token = $_SESSION[‘csrf_token’]; ?> <div class=”side-buttons”> <?php if ($membership_plan === ‘Free’): ?> <form action=”page1.php” method=”POST”> <input type=”hidden” name=”token” value=”<?php echo htmlspecialchars($horoscope_token); ?>”> <input type=”hidden” name=”csrf_token” value=”<?php echo htmlspecialchars($csrf_token); ?>”> <button type=”submit” id=”horoscopeButton”>View Horoscope</button> </form> <form action=”page1=2.php” method=”POST”> <input type=”hidden” name=”token” value=”<?php echo htmlspecialchars($matching_token); ?>”> <input type=”hidden” name=”csrf_token” value=”<?php echo htmlspecialchars($csrf_token); ?>”> <button type=”submit” id=”matchingButton”>Horoscope Matching</button> </form> <?php else: ?> <?php endif; ?> </div>

page1.php

<?php

session_start();

require_once ‘includes/db.php’;

require_once ‘includes/functions.php’;

if (!isset($_SESSION[‘user_id’])) {

header(“Location: login.php”);

exit;

}

// Validate CSRF token

if (!isset($_POST[‘csrf_token’]) || $_POST[‘csrf_token’] !== $_SESSION[‘csrf_token’]) {

$_SESSION[‘errors’] = [“Invalid CSRF token.”];

header(“Location: error.php”);

exit;

}

// Validate token

if (!isset($_POST[‘token’]) || !isset($_SESSION[‘horoscope_data’][$_POST[‘token’]])) {

$_SESSION[‘errors’] = [“Invalid or expired token.”];

header(“Location: error.php”);

exit;

}

// Retrieve data from session

$data = $_SESSION[‘horoscope_data’][$_POST[‘token’]];

// Check token expiration (e.g., 5 minutes)

if (time() — $data[‘created_at’] > 300) {

unset($_SESSION[‘horoscope_data’][$_POST[‘token’]]);

$_SESSION[‘errors’] = [“Token expired.”];

header(“Location: error.php”);

exit;

}

// Verify user membership

$stmt = $conn->prepare(“SELECT * FROM tablename WHERE id = ?”);

$stmt->execute([$_SESSION[‘user_id’]]);

$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user || !in_array($user[‘membership_plan’], [‘Gold’, ‘Platinum’, ‘Diamond’])) {

$_SESSION[‘errors’] = [“Please upgrade .”];

header(“Location: plans.php”);

exit;

}

// Extract data

$user_id = $data[‘user_id’];

$profile_id = $data[‘profile_id’];

// Clean up session data

unset($_SESSION[‘horoscope_data’][$_POST[‘token’]]);

// Your horoscope generation logic here

?>

<!DOCTYPE html>

<html lang=”en”>

<head>

<meta charset=”UTF-8">

<meta name=”viewport” content=”width=device-width, initial-scale=1.0">

<title>Chart</title>

</head>

<body>

<?php require_once ‘includes/header.php’; ?>

<div class=”container mx-auto p-4">

<h2 class=”text-2xl font-bold”>Chart</h2>

<p>Date of Birth: <?php echo htmlspecialchars($dob); ?></p>

<! — Add chart rendering logic here →

</div>

<?php require_once ‘includes/footer.php’; ?>

</body>

</html>

Originally published at https://whatandroidwhy.blogspot.com.

csrf_token in PHP for Secure csrf_tokenTransfer was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

pass_resets SQL

CREATE TABLE pass_resets(

id INT AUTO_INCREMENT PRIMARY KEY,

email VARCHAR(255) NOT NULL,

token VARCHAR(64) NOT NULL,

expires_at DATETIME NOT NULL,

created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,

INDEX idx_email (email),

INDEX idx_token (token)

) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

reset-password.php:

<?php

session_start();
$error = $success = null;

if ($_SERVER[‘REQUEST_METHOD’] === ‘POST’ && verifyCSRFToken($_POST[‘csrf’])) {
$token = filter_var($_POST[‘token’], FILTER_SANITIZE_STRING);
$new_password = $_POST[‘new_password’];
$confirm_password = $_POST[‘confirm_password’];

if ($new_password !== $confirm_password) {
$error = “Passwords do not match.”;
} elseif (strlen($new_password) < 8) {
$error = “Password must be at least 8 characters long.”;
} else {
$stmt = $conn->prepare(“SELECT email FROM pass_resets WHERE token = ? AND expires_at > NOW()”);
$stmt->execute([$token]);
$reset = $stmt->fetch();

if ($reset) {
$email = $reset[‘email’];
$hashed_password = password_hash($new_password, PASSWORD_DEFAULT);

// Update user password
$updateStmt = $conn->prepare(“UPDATE users SET password = ? WHERE email = ?”);
$updateStmt->execute([$hashed_password, $email]);

// Delete used token
$deleteStmt = $conn->prepare(“DELETE FROM pass_resets WHERE token = ?”);
$deleteStmt->execute([$token]);

$success = “Password updated successfully. Please log in.”;
} else {
$error = “Invalid or expired reset link.”;
}
}
}

$token = isset($_GET[‘token’]) ? filter_var($_GET[‘token’], FILTER_SANITIZE_STRING) : ‘’;
?>

<!DOCTYPE html>
<html lang=”en”>
<head>

</head>
<body>
<main class=”min-h-screen flex items-center justify-center px-4 py-8">
<div class=”card max-w-md w-full p-6">
<h2 class=”text-2xl sm:text-3xl font-semibold text-red-700 text-center mb-4">Reset Password</h2>
<?php if (isset($error)): ?>
<div class=”alert-danger”><?php echo htmlspecialchars($error); ?></div>
<?php endif; ?>
<?php if (isset($success)): ?>
<div class=”alert-success”><?php echo htmlspecialchars($success); ?></div>
<?php endif; ?>
<form method=”POST” class=”space-y-4">
<input type=”hidden” name=”csrf_token” value=”<?php echo htmlspecialchars(generateCSRFToken()); ?>”>
<input type=”hidden” name=”token” value=”<?php echo htmlspecialchars($token); ?>”>
<div class=”mb-3">
<label for=”new_password” class=”block text-gray-600 font-medium mb-1">New Password</label>
<input type=”password” id=”new_password” name=”new_password” class=”form-control” required placeholder=”Enter new password”>
</div>
<div class=”mb-3">
<label for=”confirm_password” class=”block text-gray-600 font-medium mb-1">Confirm Password</label>
<input type=”password” id=”confirm_password” name=”confirm_password” class=”form-control” required placeholder=”Confirm new password”>
</div>
<button type=”submit” class=”btn-primary w-full”>Reset Password</button>
</form>
<p class=”text-gray-600 text-sm mt-4 text-center”>
Back to <a href=”/matrimonial/login.php” class=”text-red-700 hover:underline”>Login</a>
</p>
</div>
</main>

</body>
</html>

This solution avoids the issue of sending hashed passwords, provides a secure and user-friendly reset process, and maintains all existing functionality. If you need further assistance with reset-password.php or additional features (e.g., password strength validation), let me know!

Password Reset process in PHP was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

The solution, as in previous instances, is to replace the switch statement with an if-else if ladder. This achieves the exact same logic but bypasses the compile-time restriction.

Previous code was

parent.getItemAtPosition(position);

switch (parent.getId()) {

case R.id.spinner_comp_type:

sp1 = getCourse(position);

wing_name.clear();

getWing(sp1);

break;

case R.id.comp_type_list:

Nature_Name = getSUBNATURE_DESC(position);

Nature_Code = getSUBNATURE_CODE(position);

break;

case R.id.location_list:

COMP_LOCATION = comp_location[position];

COMP_LOCATION_SELECTED= comp_location[position];

if(COMP_LOCATION_SELECTED.equalsIgnoreCase(“A”))

{

COMP_LOCATION =”.”;

}

else if(COMP_LOCATION_SELECTED.equalsIgnoreCase(“B”))

{

COMP_LOCATION =”Store Room”;

}

else if(COMP_LOCATION_SELECTED.equalsIgnoreCase(“other”))

{

COMP_LOCATION =”others”;

}

break;

}

Updated Code

// Assuming ‘parent’ is an AdapterView or similar, and ‘position’ is the selected item’s position.
parent.getItemAtPosition(position); // This line remains as is, likely for retrieving the selected item object.

int parentId = parent.getId(); // Get the ID once for comparison

if (parentId == R.id.spinner_comp_type) {
in original
sp1 = getCourse(position);
wing_name.clear();
getWing(sp1);
} else if (parentId == R.id.comp_type_list) {

Nature_Name = getSUBNATURE_DESC(position);
Nature_Code = getSUBNATURE_CODE(position);

} else if (parentId == R.id.location_list) {
// Logic for location_list
COMP_LOCATION = comp_location[position];
COMP_LOCATION_SELECTED = comp_location[position];

if (COMP_LOCATION_SELECTED.equalsIgnoreCase(“A”)) {
COMP_LOCATION = “Entry Room”; // Changed from “.” to “Entry Room”
} else if (COMP_LOCATION_SELECTED.equalsIgnoreCase(“B”)) {
COMP_LOCATION = “Store Room”;
} else if (COMP_LOCATION_SELECTED.equalsIgnoreCase(“अन्य”)) {
COMP_LOCATION = “others”;
}
}
// If there are other cases, you would add more ‘else if’ blocks here.

Key Changes and Explanation:

1. int parentId = parent.getId();: We first retrieve the ID into a local variable.
2. if-else if Ladder: The switch statement is replaced with a series of if and else if conditions that compare parentId directly with the R.id constants. This is perfectly valid and resolves the "constant expression required" error.

Constant expression required in Android was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.

Recommended Alternative

Replace the deprecated QRGEncoder and QRGContents with Google’s official ZXing library, which is actively maintained and works well with the latest Android APIs.

Step 1: Add ZXing Dependency

In your build.gradle:

gradle

dependencies {
    implementation 'com.google.zxing:core:3.5.3' // Latest as of 2025
    implementation 'com.journeyapps:zxing-android-embedded:4.3.0' // Android wrapper
}

Step 2: Replace QRGEncoder with ZXing

Update the QR code generation logic in your guestSuccess.java:

Replace this:

java

qrgEncoder = new QRGEncoder(passno, null, QRGContents.Type.TEXT, dimen);
bitmap = qrgEncoder.encodeAsBitmap();
qrCodeIV.setImageBitmap(bitmap);

With this:

java

import com.journeyapps.barcodescanner.BarcodeEncoder;
import com.google.zxing.BarcodeFormat;
import com.google.zxing.WriterException;
import com.google.zxing.common.BitMatrix;
import com.journeyapps.barcodescanner.BarcodeEncoder;

try {
    BarcodeEncoder barcodeEncoder = new BarcodeEncoder();
    BitMatrix bitMatrix = new com.google.zxing.qrcode.QRCodeWriter().encode(
            passno, BarcodeFormat.QR_CODE, dimen, dimen);
    Bitmap bitmap = barcodeEncoder.createBitmap(bitMatrix);
    qrCodeIV.setImageBitmap(bitmap);
} catch (WriterException e) {
    e.printStackTrace();
}

This replaces the obsolete QR generation and is fully compatible with Android API 34+ and 35.

Cleanup

You can remove these lines from your imports:

java

import androidmads.library.qrgenearator.QRGContents;
import androidmads.library.qrgenearator.QRGEncoder;

That’s it!

Now your QR code generation will work with Android API 35 and later using the Google ZXing library, while the rest of your code remains intact.

Google’s official ZXing library was originally published in TechZenith on Medium, where people are continuing the conversation by highlighting and responding to this story.