pass

<?php




session_start();


$user = $_SESSION['username'];
$_SESSION['errorepassword']=0;
//connessione al database
$host="localhost"; // host del database
$uname="root"; // utente del db
$psw=""; // password dell'utente sopra
$nomedb="toolow"; // nome del db
mysql_connect($host,$uname,$psw);
mysql_select_db($nomedb);
//user is logged in

		//check fields

		$oldpassword = $_POST['oldpassword'];
		$newpassword = $_POST['newpassword'];
		$repeatnewpassword = $_POST['repeatnewpassword'];
		//check pass against db

		$queryget = mysql_query("SELECT password FROM utenti WHERE username='$user'") or die("Query errata");
		$row = mysql_fetch_assoc($queryget);

		$oldpassworddb = $row['password'];



		//check pass
		if ($oldpassword==$oldpassworddb)
		{

		//check twonew pass
		if ($newpassword==$repeatnewpassword)
		{
		//success
		//change pass in db

        if (strlen($newpassword)>25||strlen($newpassword)<6)
		  {
		  echo "La password deve essere tra 6 e 25 caratteri.";
		  }

		  else
		  {

				$querychange = mysql_query("UPDATE utenti SET password='$newpassword' WHERE username='$user'");
				session_destroy();
				echo("La tua password è stata cambiata.<a href='index.php'>Torna</a> alla home");
                $_SESSION['errorepassword']=0;
                $errorepassword=$_SESSION['errorepassword'];
                header("location:http://localhost/5binf/TooLow2/cambia_password.php");
		        die();
		  }
		}

           else{
              $_SESSION['errorepassword']=1;
              header("location:http://localhost/5binf/TooLow2/cambia_password.php");
           }
        }
		  else{
              $_SESSION['errorepassword']=1;
              header("location:http://localhost/5binf/TooLow2/cambia_password.php");
          }
?>