<?php
session_start();
include '../../connect.php';
if (!isset($_SESSION['user'])) {
        header("location:../..loginfailed.html");
    }
    else {
        $now = time(); // Checking the time now when home page starts.
}
        if ($now > $_SESSION['expire']) {
            session_destroy();
            header("location:../../loginfailed.html");
        }
       
$username= $_SESSION['user'];		  
	
//get form info.
$result3 = mysqli_query($con, "SELECT * FROM customers where username='$username' ");
while($row3 = mysqli_fetch_array($result3))
{ 
$name=$row3['name'];
$pass=$row3['password'];  
}
//check if password field is empty
$p = $_POST['pass'];
$p2 = $_POST['pass2'];
if ($p == "" || $p2=="") {
	echo '<script type="text/javascript"> 
alert (" Error Message: Password field cannot be empty");
window.location = "index.php";
</script>';
		}
// Check for a new password and match against the confirmed password:
	if ($p !== $p2) {
echo '<script type="text/javascript"> 
alert (" Error Message: Password Mismatch: Ensure both passwords are same");
</script>';
		}
//check against database to see if new pass and old pass  r d same
if ($p == $pass) {
	echo '<script type="text/javascript"> 
alert (" Error Message: Password Error: Ensure new password is not same with old");
window.location = "index.php";
</script>';
		
	}else { // If everything's OK.

		// Make the query.
		$sql1= "UPDATE customers SET password= '$p' WHERE username= '$username'";
		$update1 = mysqli_query($con, $sql1);
				
		if (!$update1){            
echo '<script type="text/javascript"> 
alert (" Your password was not changed. Make sure your new password is different than the current password. Contact the system administrator if you think an error occurred");
window.location = "index.php";
</script>';
}

else {
echo '<script type="text/javascript"> 
alert ("Password Change: Successful. You will be redirected to the login page.");
window.location="../../index.php";
</script>';	

}
			
		
			}
		
					
					
mysqli_close($con);
		?>