<?php

// Change Password - Military

$_MSSQL[Host]               = "RECO-PC\SQLEXPRESS";
$_MSSQL[User]               = "sa";
$_MSSQL[Pass]               = "reco55";
$_MSSQL[DBNa]               = "GunzDB";

$r = mssql_connect($_MSSQL[Host], $_MSSQL[User], $_MSSQL[Pass]) or die("Cant connect to database");
mssql_select_db($_MSSQL[DBNa], $r) or die("Selection Failed");

if($_SESSION['username'] != "") {

} else {
<form method="post" action="index.php?page=changepass">
<table width="420">
    <tr>
        <td width="210" height="28" align="left">
            Username:
        </td>
        <td width="210" height="28" align="right">
            <input type="text" name="username">
        </td>
    </tr>
    <tr>
        <td width="210" height="28" align="left">
            Password:
        </td>
        <td width="210" height="28" align="right">
            <input type="password" name="curpass">
        </td>
    </tr>
    <tr>
        <td width="210" height="50" align="left">
            <input type="submit" name="submit" value="Login" style="height:35px; width:100px;">
        </td>
        <td width="210" height="50" align="right">
            <input type="reset" name="reset" value="Reset" style="height:35px; width:100px;">
        </td>
    </tr>
</table>
</form>
    }
}
 if(['page'] == "changepass") {

    $username = sql($_POST['username']);
    $curpass = sql($_POST['curpass']);
    $newpass = sql($_POST['newpass']);
    $newpass2 = sql($_POST['newpass2']);



    if(empty($username) OR empty($curpass) OR empty($newpass) OR empty($newpass2)) {
    die("Fill in all Fields!<br /> <a href='Index.php> Go Back</a>");
    return false;
    }

    $userpass = mssql_query("SELECT * FROM LOGIN WHERE UserID = '".$username."' AND Password = '".$curpass."'");
    if(mssql_num_rows($curpass) != 1) {
    die("Current password isnt correct!<br /> <a href='Index.php> Go Back</a>");
    return false;
    }

    if($newpass != $newpass2) {
    die("Passwords don't match!<br /> <a href='Index.php> Go Back</a>");
    return false;
    }

    $updatepass = mssql_query("UPDATE Login SET Password = '".$newpass."' WHERE UserID = '".$username."'");
    echo "Password changed successful!";
?>

<form method="post" action="index.php?page=chanepass">
<table width="420">
    <tr>
        <td width="210" height="28" align="left">
            Username:
        </td>
        <td width="210" height="28" align="right">
            <input type="text" name="username">
        </td>
    </tr>
    <tr>
        <td width="210" height="28" align="left">
            Current Password:
        </td>
        <td width="210" height="28" align="right">
            <input type="password" name="curpass">
        </td>
    </tr>
    <tr>
        <td width="210" height="28" align="left">
            New Password:
        </td>
        <td width="210" height="28" align="right">
            <input type="password" name="newpass">
        </td>
    </tr>
    <tr>
        <td width="210" height="28" align="left">
            New Password:
        </td>
        <td width="210" height="28" align="right">
            <input type="text" name="newpass2">
        </td>
    </tr>
    <tr>
        <td width="210" height="50" align="left">
            <input type="submit" name="submit" value="Change" style="height:35px; width:100px;">
        </td>
        <td width="210" height="50" align="right">
            <input type="reset" name="reset" value="Reset" style="height:35px; width:100px;">
        </td>
    </tr>
</table>
</form>