<html>
<head>
<title></title>
</head>
<BODY onload="document.Form1.reset(); document.Form1.Password.focus();">

<?php

function display_form($username)
{
echo <<< Begin
		<H2 align="center">Change Password</H2>
        	</center>
        	<p>
        	<CENTER>
        	<FORM ACTION="{$_SERVER['PHP_SELF']}" NAME="Form1" METHOD="POST">
        	<CENTER>

		<TABLE BGCOLOR="lightgrey" BORDER="1" BORDERCOLOR="gray">
            
		<tr><td colspan="2" align="center">Your username is <b>$username</b>.

		<TR>
        	<TD align="right"><B>Current Password:</B></TD>
        	<TD><INPUT NAME="Password" SIZE="50" type="password"></TD>
        	</TR>

		<TR>
        	<TD align="right"><B>New Password (at least 5 characters):</B></TD>
        	<TD><INPUT NAME="New_Password" SIZE="50" type="password"></TD>
       	</TR>
	
		<TR>
        	<TD align="right"><B>Retype New Password:</B></TD>
        	<TD><INPUT NAME="Retype_New_Password" SIZE="50" type="password"></TD>
       	</TR>

       	<input name='submitted' value='TRUE' type='hidden'>
		<input name="Username" size="30" type='hidden' value="$username">
       	 </TABLE>

		<p></p>

        	<TABLE>
        	<TR>
        	<TD align="center"><INPUT TYPE="submit" VALUE="Change Password">
       	 </TD>
       	 <TD align="center">
       	 <INPUT TYPE="reset" VALUE="RESET">
        	</TD>
        	</TR>
       	 </TABLE>

       	 </FORM>
Begin;
}

function change_password($username,$password,$new_password,$retype_new_password, &$errors)
{	
	$errors = array();
	
	if (strlen($new_password) < 5)
	{
		$errors[] = "The new password must have at least 5 characters.";
		return FALSE;
	}
	if ($new_password != $retype_new_password)
	{
		$errors[] = "The new passwords you entered are not the same.";
		return FALSE;
	}
	@$d = mysql_connect('localhost','database_username','database_password');
	if (!d)
	{
		echo "Sorry can't process your information at this time.<BR>";
		return FALSE;
	}
	@$select = mysql_select_db('alumni');
	if (!$select)
	{
		echo "Sorry can't process your information at this time.<BR>";
		return FALSE;
	}

	$q = "select count(*) from users where username='$username' and password=sha1('$password')";
	@$r = mysql_query($q);
	if (!$r)
	{
		echo "Sorry can't process your information at this time.<BR>";
		@mysql_close($d);
		return FALSE;
	}

	@$row = mysql_fetch_row($r);
	$k = $row[0];
	if ($k < 1)
	{
		$errors[] = "Check the current password.";
		return FALSE;
	}
	@mysql_free_result($r);
		
	$q = "update users set password=sha1('$new_password') where username='$username' and password=sha1('$password')";
	@$r = mysql_query($q);
	if (!$r)
	{
		echo "Sorry can't process your information at this time.<BR>";
		@mysql_close($d);
		return FALSE;
	}


	@mysql_close($d); 
	return TRUE;
}

$username = trim(stripslashes($_POST['Username'])); // Taken from form on the previous page
if (empty($username))
{
	exit("The username is empty. This page can be accessed only by logged in users.");
}

display_form($username);
		
if (isset($_POST['submitted']))
{	
	$username = trim(stripslashes($_POST['Username'])); // Taken from form on this page
	$password = trim(stripslashes($_POST['Password']));
	$new_password = trim(stripslashes($_POST['New_Password']));
	$retype_new_password = trim(stripslashes($_POST['Retype_New_Password']));
	$flag = change_password($username,$password,$new_password,$retype_new_password,$errors);
	if (!$flag)
	{
		foreach ($errors as $error)
			echo "$error<br>\n";
	}
	else
		echo "<h2 align='center'>Your password has been changed. Thank you.</h2>";
				
} // if (form submitted)

?>
</BODY></HTML>

