<?php
	if(isset($_SESSION['validuser']))
		{
			$sess = $_SESSION['validuser'];
			include('../sa_config.php');
			if(isset($_POST['current'])) { $current = $_POST['current']};
			if(isset($_POST['new'])) { $new = $_POST['new']};
			if(isset($_POST['confirm'])) { $confirm = $_POST['confirm']};
			if($new == $confirm)
				{
					@mysql_connect($server, $user, $pass) or die('connection error!');
					@mysql_select_db($db) or die('database error!');
					$query = "SELECT * FROM admin where $user='$sess' limit 1";
					$result = @mysql_query($query) or die('Query Error');
					$num = @mysql_num_rows($result);
					if($num == 1)
						{
							$row = mysql_fetch_array($result);
							$uid = $row[0];
							$u = $row[1];
							$p = $row[2];
							if($current == $p)
								{
									$query = "UPDATE admin SET pass='$new' where id='$uid' and user='$u'"
									mysql_query($query);
								}
							else
								{
									echo "Your current password is not correctly";
								}
						}
					else
						{
							echo "Your current password is not correctly";
						}
				}
				else
					{
						echo "Your new password and confirm not match";
					}
		}
	else
		{
			header("location:index.php");
		}

?>