Untitled

<?php
session_start();
include ('include/config.php');
if(isset($_POST['change_password'])) {

$oldpassword = md5($_POST['oldpassword']);
$newpassword = md5($_POST['newpassword']);
$newpassword2 = md5($_POST['newpassword2']);


$sql = "SELECT password FROM members WHERE username='$username' ";
$stmt = $dbconnect->prepare($sql);
$stmt->execute();
$row = $stmt->fetch(PDO::FETCH_ASSOC);
$oldpassworddb = $row['password'];

if ($oldpassword == $oldpassworddb)
{
if ($newpassword == $newpassword2)
{
$insert = "UPDATE members SET password=':newpassword' WHERE username='$username' ";
$count = $dbconnect->prepare($insert);
$count->execute(array(':newpassword' => $newpassword));
echo " Your password has succesfully changed.";
}
else
echo " Wrong Password. ";
}
}

?>
<html>
<head>
<title></title>
</head>
<body >
<form method="POST" action="" >
<table border="0">

<tr><td>Old Password </td><td><input type="text" name="oldpassword" size="20" /></td></tr>

<tr><td>New Password </td><td><input type="password" name="newpassword" size="20" /></td></tr>

<tr><td>Confirm New Password </td><td><input type="password" name="newpassword2" size="20" /></td></tr>

<tr><td></td><td><input type="submit" value="Change Password" name='change_password' /></td></tr>

</table>
</form>
</body>
</html>