change-password.php

<?php
session_start();
error_reporting(1);
include 'inc/koneksi.php';
if (empty($_SESSION['login'])) {
header("Location:index.php");
}

?>

<!doctype html>
<html>
<link rel="shortcut icon" type="image/x-icon" href="images/lamp-b.ico" />
<head>
<meta charset="utf-8">
<title>Change Password</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="jquery-mobile/jquery.mobile-1.0.min.css" rel="stylesheet" type="text/css">
<script src="jquery-mobile/jquery-1.6.4.min.js" type="text/javascript"></script>
<script src="jquery-mobile/jquery.mobile-1.0.min.js" type="text/javascript"></script>
</head>
<body>

<div data-role="page" id="rubah password" data-theme="e">
 <div data-role="header" data-position="fixed" data-theme="a">
    <h3>Change Password</h3>
  </div>
<div data-role="content">

<form name="submit" action="change-password.php" method="POST">
<label for="username">Username</label>
<input type="text" name="username" id="username" value=""
<label for="password">Old Password</label>
<input type="password" name="password" id="password" value=""
data-mini="true" size="15" maxlength="15" required />
<label for="newpassword">New Password</label>
<input type="password" name="newpassword" id="newpassword" value=""
data-mini="true" size="15" maxlength="15" required />
<label for="konfirpassword">Confirm New Password</label>
<input type="password" name="konfirpassword" id="konfirpassword" value=""
data-mini="true" size="15" maxlength="15" required />
<div data-role="fieldcontain" align="left">
<input type="submit" value="submit" data-theme="c" data-role="button" name="submit"
data-icon="check" data-theme="b" data-inline="true">
</form></table>
</div>
</div>
</div>
</body>
</html>

<?php
$username = $_POST['username'];
$password = $_POST['password'];
$newpassword = $_POST['newpassword'];
$konfirmpassword = $_POST['konfirpassword'];
$submit = $_POST['submit'];
$result = mysql_query("SELECT * FROM tbl_user WHERE username='$username' and password='$password'");
if(!$result)
{
?>
    <script language="javascript">
    alert("Username Anda Salah.");
    document.location="change-password.php";
    </script>
<?php
//echo "The username you entered does not exist";
}
else if($password!= mysql_result($result, 0))
{
?>
    <script language="javascript">
    alert("Password Anda Salah.");
    document.location="change-password.php";
    </script>
<?php
//echo "You entered an incorrect password";
}
else if ($newpassword!=$konfirpassword)
{
    ?>
    <script language="javascript">
    alert("Password Anda Tidak Sama.");
    document.location="index.php";
    </script>
    <?php
}
else
{
    $sql=mysql_query("UPDATE user SET password='$newpassword' where username='$username'");
    if($sql)
    {
         ?>
        <script language="javascript">
        alert("Password Berhasil diganti.");
        document.location="index.php";
        </script>
        <?php
    }
}
?>