<?php

$con = mysql_connect("localhost","root");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

$username = $_POST['userid'];
$password = $_POST['cpword'];
$newpassword = $_POST['pword'];
$confirmnewpassword = $_POST['pword2'];

$result = mysql_query("SELECT username, pword FROM login WHERE username='$username'");

    if(!$result){
        echo "The username entered does not exist!";
    }
    else
        if($password != mysql_result($result, 0)){
            echo "Entered an incorrect password";
            }

    if($newpassword == $confirmnewpassword){
        $sql = mysql_query("UPDATE login SET pword = '$newpassword' WHERE username = '$username'");
    }

    if(!$sql){
        echo "Congratulations, password successfully changed!";
    }
    else{
        echo "New password and confirm password must be the same!";
    }

  ?>

<?php
    $host = "localhost";
    $database = "yourdatabase";
    $username_db = "root";
    $password_db = "databasepassword";
    $con = mysqli_connect($hostname, $username_db, $password_db, $database) or die(mysqli_error($con));

    $username = $_POST['userid'];
    $newpassword = $_POST['pword'];
    $confirmnewpassword = $_POST['pword2'];

    if($newpassword == $confirmnewpassword)
    {
        //password & password confirm match, do the update
        $query = sprintf("UPDATE login SET pword=%s WHERE username=%s",
                          mysql_real_escape_string($newpassword),
                          mysql_real_escape_string($username));
        $sql = mysqli_query($query, $con) or die(mysqli_error($con);
        if($sql)
        {
            echo "Congratulations, password successfully changed!";
        }
        else
        {
            //sql error or update didn't work?
            echo 'generic failure message';
        }
    }
    else
    {
        //new password and confirm password weren't the same.
        echo "New password and confirm password must be the same!";
    }

?>