diff --git a/scripts/update_phone.php b/scripts/update_phone.php
new file mode 100644
index 0000000..46365f7
--- /dev/null
+++ b/scripts/update_phone.php
@@ -0,0 +1,38 @@
+<?php
+/**
+ * Update User Phone Script (Secure)
+ * Run: php scripts/update_phone.php --email=admin@musadaq.com --phone=963992952235
+ */
+
+require_once __DIR__ . '/../app/bootstrap/init.php';
+
+use App\Core\Database;
+use App\Core\Encryption;
+
+// Parse CLI arguments
+$options = getopt("", ["email:", "phone:"]);
+$email = $options['email'] ?? null;
+$phone = $options['phone'] ?? null;
+
+if (!$email || !$phone) {
+    die("Usage: php scripts/update_phone.php --email=feras@intaleqapp.com --phone=963992952235\n");
+}
+
+$db = Database::getInstance();
+
+// 1. Sanitize phone
+$cleanPhone = preg_replace('/[^0-9+]/', '', $phone);
+$phoneHash = hash('sha256', $cleanPhone);
+$encryptedPhone = Encryption::encrypt($cleanPhone);
+
+// 2. Update user
+$stmt = $db->prepare("UPDATE users SET phone = ?, phone_hash = ? WHERE email = ?");
+$stmt->execute([$encryptedPhone, $phoneHash, $email]);
+
+if ($stmt->rowCount() > 0) {
+    echo "✅ Success! Phone updated for $email\n";
+    echo "   Encrypted: $encryptedPhone\n";
+    echo "   Hash: $phoneHash\n";
+} else {
+    echo "❌ Failed. User with email $email not found or no changes made.\n";
+}