<?php
	session_start();
  if(isset($_SESSION['valid_user']))
    {
      $sess = $_SESSION['vali_duser'];
      include('../sa_config.php');
      if(isset($_POST['current'])) { $current = $_POST['current'];}
      if(isset($_POST['new'])) { $new = $_POST['new'];}
      if(isset($_POST['confirm'])) { $confirm = $_POST['confirm'];}

      if($new == $confirm)
        {
          @mysql_connect($server, $user, $pass) or die('connection error!');
          @mysql_select_db($db) or die('database error!');
          $query = "SELECT * FROM admin where user='$sess' limit 1";
          $result = @mysql_query($query) or die('Query Error');
          $num = @mysql_num_rows($result);
          if($num == 1)
            {
              $row = mysql_fetch_array($result);
              $uid = $row[0];
              $u = $row[1];
              $p = $row[2];
              if($current == $p)
                {
                  $query = "UPDATE admin SET pass='$new' where id='$uid' and user='$u'";
                  mysql_query($query);
                }
              else
                {
                  echo "Your current password is not correctly";
                  echo $sess;
                  echo $current;
                }
            }
          else
            {
              echo "Your current password is not correctly";
            }
        }
        else
          {
            echo "Your new password and confirm not match";
          }
    }
  else
    {
      header("location:index.php");
    }

?>