<?php
session_start();

/**
 * @author freddy
 * @copyright 2009
 */



require('dbconnect.php'); 

$username = $_SESSION['username'];
$password = $_POST['password'];
$newpassword = $_POST['newpass'];
$confirmnewpassword = $_POST['cnewpass'];

$result = mysql_query("SELECT password FROM bm WHERE username='$username'");

$data = mysql_fetch_array($result, MYSQL_ASSOC);

if($password != $data['password']) 
{ 
echo "You entered an incorrect password. <a href=changepass.php>Try Again</a> or <a href=index.php>Quit</a>"; 
} 
else 
if($newpassword == $confirmnewpassword) {
    $sql = mysql_query("UPDATE bm SET `password`='$newpassword' where `username`='$username'"); 
     echo ".Changes completed"; 
    }
else
{ 
echo "The new password and confirm new password fields must be the same. <a href=changepass.php>Try Again</a> or <a href=index.php>Quit</a>"; 
}  

?>
<a href="index.php">Click here to continue...</a>