<?php

					$new = md5($_POST['newpass']);
					$sql = mysql_query("SELECT password FROM users WHERE username = '".$_SESSION['user']['username']."'");
					if(isset($_POST['submit']))
					{
						if (empty($_POST['prevpass']) || empty($_POST['newpass']))
						{
							echo '<div class="animated shake">
									<div class="message error">Please fill in all fields.</div>
								</div>';
						}
						else
						{
						if(mysql_fetch_assoc($sql) === md5($_POST["oldpass"])  ){
							mysql_query("UPDATE users SET password = '".$new."' WHERE id = '".$_SESSION['user']['id']."'") or die(mysql_error());
							echo '<div class="animated shake">
									<div class="message success"><b>Thank you!</b> Your suggestions has been submitted and is awaiting to be reviewed by staff!</div>
								</div>';
						}else{
							echo '<div class="animated shake">
									<div class="message error">Your old password wasnt correct.</div>
								</div>';
							}
						}
					}
				?>