Old pass change

<?php


include_once("php_includes/check_login_status.php");

// Initialize any variables that the page might echo
$u = "";
$sex = "Male";
$userlevel = "";
$country = "";
$joindate = "";
$lastsession = "";
$password = "";
// Make sure the _GET username is set, and sanitize it
if(isset($_GET["u"])){
    $u = preg_replace('#[^a-z0-9]#i', '', $_GET['u']);
} else {
    header("location: settings.php?u=".$_SESSION["username"]);
    exit();
}

// Select the member from the users table
$sql = "SELECT * FROM users WHERE username='$u' AND activated='1' LIMIT 1";
$user_query = mysqli_query($db_conx, $sql);
// Now make sure that user exists in the table
$numrows = mysqli_num_rows($user_query);
if($numrows < 1){
    echo "That user does not exist or is not yet activated, press back";

    exit();
}
// Check to see if the viewer is the account owner
$isOwner = "no";
if($u == $log_username && $user_ok == true){
    $isOwner = "yes";
}
// Fetch the user row from the query above
while ($row = mysqli_fetch_array($user_query, MYSQLI_ASSOC)) {
    $profile_id = $row["id"];
    $gender = $row["gender"];
    $country = $row["country"];
    $userlevel = $row["userlevel"];
    $signup = $row["signup"];
    $lastlogin = $row["lastlogin"];
    $joindate = strftime("%b %d, %Y", strtotime($signup));
    $lastsession = strftime("%b %d, %Y", strtotime($lastlogin));
    $password = $row["password"];
    if($gender == "f"){
        $sex = "Female";
    }
}
?>

<!doctype html>
    <head>
        <meta charset="utf-8">
        <meta http-equiv="X-UA-Compatible" content="IE=edge">
        <meta name="robots" content="index, follow">

        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <link href="css/bootstrap.css" rel="stylesheet" media="screen" type="text/css">
        <link href="css/custom.css" rel="stylesheet" type="text/css">
        <link href="css/bootstrap-min.css" rel="stylesheet" media="screen" type="text/css">
        <script src="js/main.js"></script>
        <title>KZ|Language exchange</title>
    </head>
    <body>
    <div id="custom-bootstrap-menu" class="navbar navbar-default navbar-fixed-top" role="navigation">
    <div class="container-fluid">
        <div class="navbar-header"><a class="navbar-brand" href="#">Brand</a>
            <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-menubuilder"><span class="sr-only">Toggle navigation</span><span class="icon-bar"></span><span class="icon-bar"></span><span class="icon-bar"></span>
            </button>
        </div>
        <div class="collapse navbar-collapse navbar-menubuilder">
            <ul class="nav navbar-nav navbar-left">
                <li><a href="index.php">Home</a>
                </li>
                <li><a href="user.php">Profile</a>
                </li>
                <li><a href="settings.php">Settings</a>
                </li>

            </ul>
            <ul class="nav navbar-nav navbar-right">

                <li><?php
        if ($isOwner == "yes") {?>

        <a class="navbar-brand" href="logout.php" style="border-left: 1px solid; padding-left: 10px;">Logout</a>
        <?php
        }
        ?>
                </li>
            </ul>
        </div>
    </div>
</div>


<div class="container">

    <div class="row-fluid">

        <div class="col-md-9">


  <h3><?php echo $u; ?></h3>
  <p>Is the viewer the page owner, logged in and verified? <b><?php echo $isOwner; ?></b></p>
  <p>Gender: <?php echo $sex; ?></p>
  <p>Country: <?php echo $country; ?></p>
  <p>User Level: <?php echo $userlevel; ?></p>
  <p>Join Date: <?php echo $joindate; ?></p>
  <p>Last Session: <?php echo $lastsession; ?></p>
  <p>Password: <?php echo $password; ?></p>
  <p>Password: <?php echo $_SESSION['userid'];?>
                <?php echo $_SESSION['username'];?>
                <?php echo $_SESSION['password']; ?></p>


  <?php
  // i need to make sure that $isOwner = "yes"; so only logged in users see the form and can change the password
  if (isset($_POST["submit"]) &&($isOwner == "yes") && ($user_ok == true)) {
    $password = md5($_POST["password"]);

    $sql = "UPDATE users SET `password`='$password' WHERE username='$u'";
  }
    if(isset($_SESSION['userid'])){session_regenerate_id();}
    $db_id = $_SESSION['userid'];
            $db_username = $_SESSION['username'];
            $db_pass_str = $password;
            setcookie("id", $db_id, strtotime( '+30 days' ), "/", "", "", TRUE);
            setcookie("user", $db_username, strtotime( '+30 days' ), "/", "", "", TRUE);
            setcookie("pass", $db_pass_str, strtotime( '+30 days' ), "/", "", "", TRUE);

    if (mysqli_query($db_conx, $sql)) {
    echo "Record updated successfully";
    $_SESSION['password'] = $password;
} else {
    echo "Error updating record: " . mysqli_error($db_conx);
}


  ?>

<h3>Create new password</h3>
  <form action="" method="post">
    <div>Current Password</div>
    <input type="text" class="form-control" id="password" name="password" >
    <input type="submit" name="submit" value="Submit">
    <p id="status" ></p>
  </form>


        </div>

    <div class="col-md-3">
        <div class="loginbox">
            <?php
                if ($isOwner === "yes") {?>
                <h3>Welcome <?php echo $u; ?>!</h3>

                <?php
                if ($isOwner == "yes") {?>

                <p>Last online: <?php echo $lastsession;?> </p>
                <br /><br />
                <?php
                }
                ?>
                <button class="btn btn-default" href="logout.php">Log Out</button>
                <?php
                }
                ?>

                </div>
            </div>
        </div>

</div>


<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script>
<script src="js/bootstrap.min.js"></script>
<script src="js/main.js"></script>
<script src="js/ajax.js"></script>

    </body>

<?php

include 'php_includes/footer.php';

?>
</html>