changePassword.php

<?php
  session_start();
  if(isset($_SESSION["login"]) && $_SESSION["login"]=="ok"){
    $username=$_SESSION["username"];
    $password=$_SESSION["password"];
    $connessione=mysqli_connect("localhost","root","");
    $ris=mysqli_query($connessione, "use OpenTraffic");
    $ris=mysqli_query($connessione, "select * from utenti where username='".$username."' && password='".$password."'");
    $riga=mysqli_fetch_array($ris);
    $permessi=$riga["permessi"];
    mysqli_close($connessione);
  }
  else
      header("location: login.php");
  $esiste1=false;
  $esiste2=false;
  if(isset($_POST["oldPassword"]))
    if(!empty($_POST["oldPassword"])){
      $oldpass=md5($_POST["oldPassword"]);
      echo $oldpass;
      $esiste1=true;
    }
    else
      echo "errore</br>";
  else
    echo "non esiste";

  if(isset($_POST["newPassword"]))
    if(!empty($_POST["newPassword"])){
      $newpass=md5($_POST["newPassword"]);
      echo $newpass;
      $esiste2=true;
    }
    else
      echo "errore</br>";

  if($esiste1 && $esiste2){
    if($oldpass==$password){
      $connessione=mysqli_connect("localhost","root","");
      $ris=mysqli_query($connessione, "use OpenTraffic");
      $ris=mysqli_query($connessione, "update utenti set password='".$newpass."' where username=".$username." && password='".$oldpass."'");
      mysqli_close($connessione);
      $_SESSION["password"]=$newpass;
      if($permessi!='admin')
        header("location: feedback.php");
      else
        header("location: gestioneSito.php");

    }
    else{
      if($permessi!='admin')
        header("location: feedback.php");
      else
        header("location: gestioneSito.php");
    }
  }
  else{
    if($permessi!='admin'){
        echo $newpass;
        echo "</br>".$oldpass;
        header("location: login.php");
    }
    else
      header("location: gestioneSito.php");
    echo "password diverse ";

  }

?>