action ganti password

<?php
include 'config.php';
$username=$_REQUEST['username'];
$lama=$_REQUEST['lama'];
$baru=$_REQUEST['baru'];
$ulang=$_REQUEST['ulang'];

$cek=mysql_query("select * from tb_pengawas where password='$lama' and username='$username'");
if(mysql_num_rows($cek)==3){
	if($baru==$ulang){
		$b = ($baru);
		mysql_query("update tb_pengawas set password='$b' where username='$username'");
		header("location:ganti_pass.php?pesan=oke");
	}else{
		header("location:ganti_pass.php?pesan=tdksama");
	}
}else{
	header("location:ganti_pass.php?pesan=gagal");
}

 ?>