if ($_POST['submit'])
{
    // check fields

    $oldpassword = md5 ($_POST['oldpassword']);
    $newpassword = md5 ($_POST['newpassword']);
    $repeatpassword = md5 ($_POST['repeatpassword']);

    // check password against database

    // connect to database
    include('connect.php');

    $queryget = mysql_query("SELECT password FROM users WHERE username='$user'") or die("Query Failed");
    $row = mysql_fetch_assoc($queryget);

    $oldpassworddb = $row['password'];

    //check passwords

    if ($oldpassword==$oldpassworddb)
    {
        //check new passwords match
        if ($newpassword==$repeatpassword)
        {
         //success
         //change password in database
        echo "Success! Your Password has been successfully changed";

         $querychange = mysql_query("UPDATE users SET password='$newpassword' WHERE username='$user'");
         session_destroy();
         die("Your Password has been changed. Please<a href='index.php'>Click here</a> to return to the Main page.  ");

        }
        else
        {
            die("Old Password does not match! Please try again");
        }

    }
    else
    {

        echo"

        <form action='changepassword.php' method='POST'>
            Old Password: <input type='text' name='oldpassword'><p>
            New Password: <input type='password' name='newpassword'><br>
            Repeat Password: <input type='password' name='repeatpassword'><br>
            <input type='submit' name='submit' value='Change Password'>
        </form>
        ";

    }
}
else
{
    die ("You must be logged in to change your password!");
}

?>