<?php
$dbname = 'auth';// Database name
$host_name = 'localhost';// Host address
$db_username='root';// DB user
$db_pass='password';// DB Pass
function sha_password($user,$pass){
$user = strtoupper($user);
$pass = strtoupper($pass);

return SHA1($user.':'.$pass);
}
mysql_connect($host_name,$db_username,$db_pass)or die("Could not connect: " . mysql_error());
mysql_select_db($dbname);

$username=$_POST['user'];//user name
$password = sha_password($_POST['user'],$_POST['pass']);
$new_pass = sha_password($_POST['user'],$_POST['npass']);

//user check
$result = mysql_query("SELECT * FROM `account` WHERE `username` = '$username' AND `sha_pass_hash` = '$password'");
$Nresult = mysql_num_rows($result);

if (!$Nresult){
        die('wrong username or password');
}

//pass update
$suc=mysql_query("UPDATE `$dbname`.`account` SET `sha_pass_hash` = '$new_pass' WHERE `account`.`username` = '$username'"); mysql_query("UPDATE `account` SET `v`='0' AND `s`='0' WHERE username='$_POST[user]'");
echo 'success';

?>