<?php
	session_start();
	$user = $_SESSION['username'];

	//connessione al database
	$host="localhost"; // host del database
	$uname="root"; // utente del db
	$psw=""; // password dell'utente sopra
	$nomedb="toolow"; // nome del db
	mysql_connect($host,$uname,$psw);
	mysql_select_db($nomedb);
	//user is logged in

	//check fields

	$oldpassword = $_POST['oldpassword'];
	$newpassword = $_POST['newpassword'];
	$repeatnewpassword = $_POST['repeatnewpassword'];
	//check pass against db

	if(isset($_POST['repeatnewpassword'])){

		$queryget = mysql_query("SELECT password FROM utenti WHERE username='$user'") or die("Query errata");
		$row = mysql_fetch_assoc($queryget);

		$oldpassworddb = $row['password'];

		//check pass
		if ($oldpassword==$oldpassworddb){
			//check twonew pass
			if ($newpassword==$repeatnewpassword)
			{
				//success
				//change pass in db

		        if (strlen($newpassword)>25||strlen($newpassword)<6){
					echo "La password deve essere tra 6 e 25 caratteri.";
				}else{
					$querychange = mysql_query("UPDATE utenti SET password='$newpassword' WHERE username='$user'");
					session_destroy();
					echo("La tua password è stata cambiata.<a href='index.php'>Torna</a> alla home");
		            $_SESSION['errorepassword']=0;
		            $errorepassword=$_SESSION['errorepassword'];
		            header("location:http://localhost/5binf/TooLow2/cambia_password.php");
				    die();
				}
			}else{
		   		$_SESSION['errorepassword']=1;
		       	header("location:http://localhost/5binf/TooLow2/cambia_password.php");
			}
		}else{
	      	$_SESSION['errorepassword']=1;
	        header("location:http://localhost/5binf/TooLow2/cambia_password.php");
	    }
	}
?>