<?php
	@session_start();
	//======================================
	include('lib/config.php');
	//======================================
	
	$user_old_password = isset($_POST['user_old_password'])?md5($_POST['user_old_password']):'';
	$user_new_password = isset($_POST['user_new_password'])?$_POST['user_new_password']:'';
	$user_confirm_password = isset($_POST['user_confirm_password'])?$_POST['user_confirm_password']:''; 	

	if( isset($user_new_password) && $user_new_password!='' )
	{
	    $updated_password = md5($user_new_password);
		
		$selQuery = "SELECT * FROM ".DB_PRE."users WHERE user_password = '$user_old_password' AND user_id = '$_SESSION[userID]'";
		$userInfo = $con->getSingleRow($selQuery);		

		if(isset($userInfo['user_id']) && $userInfo['user_id'] !='')
		{
			$upadate_qry = "UPDATE ".TBL_USERS." SET user_password = '$updated_password' WHERE user_id = '$_SESSION[userID]' ";
			$errNo = $con->updateRecords($upadate_qry, __FILE__,__LINE__);
			
			$msg = 'Password changed successfully.';
			
			redirectPage('settings.php',$msg);
			exit();
		}
		else
		{	
			$msg = 'Invalid or incorrect old password.';
			
			redirectPage('settings.php',$msg);
			exit();
		}
	}
	else
	{
		$msg = 'Missing info: please enter all mandatory fields';
		
		redirectPage('settings.php',$msg);
		exit();
	}
?>