Not-super-secure SMS validation

example.html

<script>
store.preventPost = true;
var phone = document.getElementById('phone');
var code = document.getElementById('code');
var submit = document.getElementById('submit');
code.hidden = true;
code.required = false;

window.beforePost = function () {
  if (store.submitCount === 1) {
    // ping the webhook that sends their # an SMS
    var xmlHttp = new XMLHttpRequest();
    xmlHttp.open("post", 'https://YOUR-WEBHOOK-THAT-SENDS-SMS.com/whoa');
    xmlHttp.setRequestHeader(
      "Content-Type",
      "application/json; charset=UTF-8"
    );
    xmlHttp.send(JSON.stringify({ phone: phone.value }));
    code.hidden = false;
    code.required = true;
    code.disabled = false;
    phone.disabled = true;
    submit.disabled = false;
    submit.innerHTML = 'Confirm 6-Digit Code 👉';
    store.preventPost = true;
    form.onsubmit = verifyCode;
    return;
  };
};

function verifyCode(e) {
  store.preventPost = false;
  if (code.value !== 'batman') {
    alert('Invalid code. Please refresh the page and try again.');
    e.preventDefault();
    return;
  };
  window.formSubmit(e);
};
</script>