<?php
include('database.php');
session_start();


if(isset($_POST['submit']))
{
	$password = mysqli_real_escape_string($connection, $_POST['password']);
	$newpassword = mysqli_real_escape_string($connection,  $_POST['newpassword']);
	$id =  mysqli_real_escape_string($connection, $_POST['id']);
	if ($stmt = $connection->prepare('SELECT password FROM users WHERE id =?')){
	$stmt->bind_param('i', $_POST['id']);
	$stmt->execute();
	// Store the result so we can check if the account exists in the database.
	$stmt->store_result();
	}
	if($stmt->num_rows > 0) {
	$stmt->bind_result($oldpassword);
	$stmt->fetch();
	if ($_POST['password'] == $oldpassword)
	{
	
    $query ="UPDATE users SET password='$newpassword' WHERE id='$id'";
    $query_run = mysqli_query($connection, $query);
    if($query_run)
    {
		$_SESSION['status'] = "<h5 style='padding:8px; background: #1a1849; border-radius: 10px; color: #fff; text-align: center;'>PASSWORD UPDATED SUCCESSFULLY</5>";
		header('location:../settings.php');
	}
    else
    {
		$_SESSION['status'] = "<h5 style='padding:8px; background: #fe8b8e; border-radius: 10px; color: #fff; text-align: center;'>error.. password not updated</h5>";
		header('location:../settings.php');
	}		
}else {
	$_SESSION['status'] = "<h5 style='padding:8px; background: #fe8b8e; border-radius: 10px; color: #fff; text-align: center;'>INCORRECT CURRENT PASSWORD</h5>";
	header('location:../settings.php');	
}
}else{
	$_SESSION['status'] = "<h5 style='padding:8px; background: #fe8b8e; border-radius: 10px; color: #fff; text-align: center;'>error.. password not updated</h5>";
	header('location:../settings.php');	
}
}
else{
	$_SESSION['status'] = "<h5 style='padding:8px; background: #fe8b8e; border-radius: 10px; color: #fff; text-align: center;'>error.. password not updated</h5>";
	header('location:../settings.php');	
}

?>