<?php
if (isset($_POST['existing_password']))
{
 $cpass = WMMcrypt($_POST['existing_password'],$_SESSION['WMM_username']);
 $query = "SELECT * FROM wmm_members WHERE their_password=:cpass AND their_username='".$_SESSION['WMM_username']."' ";
 $dbc = dbc::instance();
 $result = $dbc->prepare($query);
 $result->bindParam(':cpass', $cpass, PDO::PARAM_STR);
 $rows = $dbc->executeGetRows($result); 
 if (count($rows)>0)//password was correct
 {
  $their_id = $rows[0]["id"];
  $cpass = WMMcrypt($_POST['new_password'],$_SESSION['WMM_username']);
  $result = $dbc->prepare("update wmm_members set their_password=:cpass where id='$their_id'");
  $result->bindParam(':cpass', $cpass, PDO::PARAM_STR);
  $result = $dbc->execute($result);
  $feedback = new feedbackBox(); 
  $feedback->setShow("Password changed.", "NOTICE",0,"member");
  include("main_menu.html");
  include("footer.html");
  exit;
 }
 else
 {
  $feedback = new feedbackBox(); 
  $feedback->setShow("The existing password provided was incorrect<br><br>CHANGES NOT SAVED!", "ERROR",0,"member");
 }
}
include("password_change.html");
?>