<?Php
/*
* @author Istvan Franko
* @copyright 2014
*/

session_start();

if (!isset($_SESSION['cart'])) 
{
  $_SESSION['cart']=array(); 
}

if (!isset($_SESSION['loggedin'])) 
{
  $_SESSION['loggedin'] = '0'; 
}
?>

<html>

<head>
<title>Natty Notebooks Inc.</title>
<link rel="stylesheet" type="text/css" href="css/style.css" />
</head>

<body>

<div id="container">

	<div id="header">
	<! header picture in css >
	</div>
	
	<div id="navigation">
		<?php include 'navigation-bar.php'; ?>
	</div>
	
<div id="aside">
	<!--Link for navigation-->
	<a href="product-list.php"><p style="text-align:center">Back to list</a></p>	

	<fieldset style="width:85%"><legend>HELP</legend>
	<p>If you want to change your password you are in the right place.</p> 
	</fieldset><br>
</div>


<div id="content">

<?php


// define variables and set to empty values
$OldPassErr = $NewPassErr = $ConfPassErr = "";
$OldPass = $NewPass = $ConfPass = "";

if ($_SERVER["REQUEST_METHOD"] == "POST")
{

	$validations = 0; //reference variable for validations
	
	$Pass = test_input($_POST["Pass"]);
	
	//input validation
	if (empty($_POST["OldPass"]))
		{
		$OldPassErr = "(Old Password is required)";
		$validations++;
		}
	else
		{$OldPass = test_input($_POST["OldPass"]);}
	
	if (empty($_POST["NewPass"]))
		{
		$NewPassErr = "(New Password is required)";
		$validations++;
		}
	else
		{$NewPass = test_input($_POST["NewPass"]);}
	
	if (empty($_POST["ConfPass"]))
		{
		$ConfPassErr = "(Password Confirmation is required)";
		$validations++;
		}
	else
		{$ConfPass = test_input($_POST["ConfPass"]);}
	
	//Password checking	
	if ($OldPass != "" AND $NewPass != "" AND $ConfPass != "")
	{
		if ($OldPass != $Pass)
		{
			echo "<h2>Incorrect old password</h2>";
			$validations++;
		}
		
		if ($NewPass != $ConfPass)
		{
			echo "<h2>Your Password and Confirm didn't match</h2>";
			$validations++;	
		}
		
		
		
		if ($validations > 0)
		{	
			echo "<h2>PLEASE TRY AGAIN.....<br><hr></h2>";;
		}
		else
		{
			$con = mysql_connect("localhost","*****","*****");
			if (!$con)
			{
				die('Could not connect: ' . mysql_error());
			}


			mysql_select_db("university", $con);
			
			$userid = $_SESSION['loggedin'];
			
			$sql="UPDATE users SET Pass='$NewPass' WHERE UserID='$userid' ";

			if (!mysql_query($sql,$con))
			{
				die ('Error: ' . mysql_error());
			}
			
			echo "<h2>Your password has updated in the database.</h2>";

			//close the connection to the database.
			mysql_close($con);
		}
	}
}	


function test_input($data)
{
   $data = trim($data);
   $data = stripslashes($data);
   $data = htmlspecialchars($data);
   return $data;
}


$con = mysql_connect("localhost","*****","*****");
if (!$con)
{
	die('Could not connect: ' . mysql_error());
}

mysql_select_db("university", $con);

//get user details from database
$userid = $_SESSION['loggedin'];

$query=mysql_query("SELECT * FROM users WHERE UserID='$userid'");
$row=mysql_fetch_object($query);
echo mysql_error();

//get the value of each column and add to local variables
$FullName = $row->FullName;
$Email = $row->Email;
$Phone = $row->Phone;
$Pass = $row->Pass;

//close the connection to the database.
mysql_close($con);


?>


<br><fieldset style="width:70%"><legend>PASSWORD CHANGE</legend>

<!--password change form-->
<br><form  method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">

<input type="hidden" name="Pass" value="<?php echo $Pass;?>">

Old password: 	<span class="error">*</span><span class="error"> <?php echo $OldPassErr;?> </span><br>
				<input type="password" name="OldPass" size="20"><br><br>
				
New password: 	<span class="error">*</span><span class="error"> <?php echo $NewPassErr;?> </span><br>
				<input type="password" name="NewPass" size="20"><br><br>
				
Password confirmation: 	<span class="error">*</span><span class="error"> <?php echo $ConfPassErr;?> </span><br>
						<input type="password" name="ConfPass" size="20"><br><br>
						
<input type="submit" value="Update">






</fieldset>
<br>

</div>

<div id="footer">
<p align="center">Copyright &#169; Istvan Franko, 2014</p>
</div>
	

</div>
</body>
</html>