HEX

File: /var/www/html/pages/credentials.php
<?php 
$rs_settings = mysqli_query($link,"select * from users where catalogid='$_SESSION[user_id]'");

if($_POST['doUpdate'] == 'Update')  
{

$rs_pwd = mysqli_query($link,"select pwd from users where catalogid='$_SESSION[user_id]'");
list($old) = mysqli_fetch_row($rs_pwd);

	if($old == md5($_POST['pwd_old']))
	{
	$newmd5 = md5(mysql_real_escape_string($_POST['pwd_new']));
	mysqli_query($link,"update users set pwd='$newmd5' where catalogid='$_SESSION[user_id]'");
	header("Location: ?mode=password&msg=Your new password is updated");
	} else
	{
	 header("Location: ?mode=password&msg=Your old password is invalid");
	}

}

if($_POST['doSave'] == 'Save')  
{

$_POST = filter($_POST);

mysqli_query($link,"UPDATE users SET
			`catalogname` = '$_POST[name]',
			`address` = '$_POST[address]',
			`tel` = '$_POST[tel]',
			`fax` = '$_POST[fax]',
			`website` = '$_POST[web]'
			 WHERE catalogid='$_SESSION[user_id]'
			") or die(mysql_error());

header("Location: ?mode=password&msg=Profile+Sucessfully+saved");
 }
?>
<table width="100%" border="0" cellspacing="0" cellpadding="5" class="main">
  <tr>
    <td valign="top">
      <div style="padding:10px;">
          <div class="wa">
            <div class="wb">
              <div class="wc">
                <div class="wd">
				
				<span id="buttoned"><strong>Change my Password  </strong> </span><br />
<br />
<br />
 
				
				 
        <p>If you want to change your password, please type your old and new password 
          to make changes.</p>
                  <form name="pform" id="pform" method="post" action="">
                    <table width="600" border="0" align="center" cellpadding="3" cellspacing="3" class="forms">
                      <tr>
                        <td width="31%" height="46">Old Password</td>
                        <td width="69%"><input name="pwd_old" type="password" class="bigsearch required"   id="pwd_old"></td>
                      </tr>
                      <tr>
                        <td height="73">New Password</td>
                        <td><input name="pwd_new" type="password" id="pwd_new" class="bigsearch required"  ></td>
                      </tr>
                    </table>
                    <p align="center">
                      <input name="doUpdate" type="submit" id="buttoned4" style="width:200px; padding:18px; margin:0px; border:0px"   value="Update">
                    </p>
                    <p>&nbsp; </p>
                  </form>
                  <p>&nbsp; </p>
                  <p>&nbsp;</p>
                </div>
              </div>
            </div>
          </div>
      </div>
      <p align="right">&nbsp; </p></td>
  </tr>
  <tr>
    <td>&nbsp;</td>
  </tr>
</table>