<?php

    echo '<h1 class="p_space">' . $lang['change_password'] . '</h1>';

    if($_SERVER['REQUEST_METHOD'] != 'POST') {

	echo '<form id="password" name="password" method="post" action="">
	<p><input type="password" name="old_password" class="textfields" required size="40"> <span class="blue_span">' . $lang['current_password'] . '</span>
    <br><small>' . $lang['confirm_curr_pass'] . '</small></p>
    <p><input type="password" name="password" class="textfields" required size="40"> ' . $lang['new_password'] . '</p>
    <p><input type="password" name="password_check" class="textfields" required size="40"> ' . $lang['repeat_passwort'] . '</p>
    <p><input type="submit" name="submit" value="' . $lang['change_curr_pass'] . '" alt="' . $lang['change_curr_pass'] . '" class="buttons"></p>
    </form>';

	}else{

    $check_pw = "SELECT
                     id,
                     password
                 FROM
                     members
                 WHERE
                     id = " . (int)$_SESSION['id'];

    $verified_pw = mysql_query($check_pw) OR die(mysql_error());

    $check_row = mysql_fetch_assoc($verified_pw);

	$errors = array();

	if(isset($_POST['password'])) {
	if(trim($_POST['password']) == "") {
	$errors[] = $lang['enter_a_password'];
	}

	if($_POST['password'] != $_POST['password_check']) {
	$errors[] = $lang['repetition_does_not_match'];
	}

		}else{
		$errors[] = $lang['enter_a_password'];
		}

    if(isset($_POST['old_password'])) {
    if(trim($_POST['old_password']) == "") {
    $errors[] = $lang['invalid_curr_pass'];
    }

    if($check_row['password'] != sha1($_POST['old_password'])) {
    $errors[] = $lang['invalid_curr_pass'];
    }

        }else{
        $errors[] = $lang['invalid_curr_pass'];
        }

	if(!empty($errors)) {

	echo '<p class="false">' . $lang['not_filled_in_all_fields'] . ' - <a href="javascript:history.back();" class="false_link">' . $lang['back'] . '</a></p>';
	echo '<ul>';

	foreach($errors as $key => $value) {
	echo '<li>&#8226; ' . $value . '</li>';
	}
	echo '</ul>';

	}else{

	$pass = "UPDATE
				members
			 SET
				password = '" . sha1($_POST['password']) . "'
			 WHERE
				id = " . (int)$_SESSION['id'];

	mysql_query($pass) OR die(mysql_error());

    if(mysql_affected_rows() == 1) {

    echo '<p class="success">' . $lang['success_pw_change'] . '!</p>';

	   }else{

	   echo '<p class="false">' . $lang['couldnot_pw_change'] . '</p>';
        }
    }
    }

?>