<?php
	session_start();
	include"../../connect/db.php"; 
?>
<?php
	csrf_verify();

	$chap = $_SESSION['chap'];

	if( isset($_POST['oldpword']) ){

		$oldpword = mysqli_real_escape_string($con,$_POST['oldpword']);

		$sql = mysqli_query($con,"SELECT pword FROM users WHERE email = '$chap' ");

		$row = mysqli_fetch_assoc($sql);

		if( $oldpword == $row['pword'] ){
			echo "password correct";
		}
		else{
			echo "password incorrect";
		}
	}
	else if( isset($_POST['newpword'])){

		$newpword = mysqli_real_escape_string($con,$_POST['newpword']);

		$sql = mysqli_query($con,"UPDATE users SET pword = '$newpword' WHERE email = '$chap' ");

		if( $sql ){
			echo "success";
		}
		else{
			echo "error";
		}
	}
?> 