<?php include("session_controller.php"); ?>
<?php
$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "form1")) {
  $updateSQL = sprintf("UPDATE `admin` SET password=%s WHERE s_no=%s",
                       GetSQLValueString($_POST['password'], "text"),
                       GetSQLValueString($_POST['s_no'], "int"));

  mysqli_select_db($conn, $database_conn);
  $Result1 = mysqli_query($conn, $updateSQL) or die(mysqli_error($conn));

  $updateGoTo = "index.php?status=Password+has+been+successfully+changed.+Login+again+with+your+new+password";
  if (isset($_SERVER['QUERY_STRING'])) {
    $updateGoTo .= (strpos($updateGoTo, '?')) ? "&" : "?";
    $updateGoTo .= $_SERVER['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $updateGoTo));
}

$colname_Recordset1 = "-1";
if (isset($_GET['role'])) {
  $colname_Recordset1 = $_GET['role'];
}
mysqli_select_db($conn, $database_conn);
$query_Recordset1 = sprintf("SELECT * FROM `admin` WHERE `role` = %s", GetSQLValueString($colname_Recordset1, "text"));
$Recordset1 = mysqli_query($conn, $query_Recordset1) or die(mysqli_error($conn));
$row_Recordset1 = mysqli_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysqli_num_rows($Recordset1);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Change Password</title>
<link href="style.css" rel="stylesheet"  type="text/css"/>
<script>
function check_confirmation(){
if(document.form1.password.value == document.form1.confirm_password.value){
	return true;		
}
else{
	alert("PASSWORDS DO NOT MATCH\nPLS ENSURE THAT THEY MATCH FIRST!");
	return false;
}
}

</script>

</head>

<body>
<?php include("links.php");?>
<p></p>
<div class="container">
<form action="<?php echo $editFormAction; ?>" method="post" name="form1" class="form-group">
  <p><div align="center"><h4>Change your password&nbsp;</h4></div></p>
  <table align="center">
    <tr valign="baseline">
      <td width="138" height="53" align="right" nowrap="nowrap">New Password:</td>
      <td width="311"><div align="left"><input class="form-control" type="password" name="password" value="<?php echo htmlentities($row_Recordset1['password'], ENT_COMPAT, 'utf-8'); ?>"  /></div></td>
    </tr>
     <tr valign="baseline">
      <td height="53" align="right" nowrap="nowrap">Confirm Password:</td>
      <td><div align="left"><input class="form-control" type="password" name="confirm_password" value="<?php echo htmlentities($row_Recordset1['password'], ENT_COMPAT, 'utf-8'); ?>" /></div></td>
    </tr>
    <tr valign="baseline">
      <td height="81" align="right" nowrap="nowrap">&nbsp;</td>
      <td><input style="width:auto;" class="form-control btn btn-primary" type="submit" value="Update Password" onclick="return check_confirmation();"/> &nbsp; &nbsp;
     <a href="users.php"> <button  style="width:auto;" class="form-control btn btn-danger" value="cancel"/> Cancel </button></a> </td>
    </tr>
  </table>
  <input type="hidden" name="MM_update" value="form1" /> 
  <input type="hidden" name="s_no" value="<?php echo $row_Recordset1['s_no']; ?>" />
</form>
<p>&nbsp;</p>
</div>
</body>
</html>
<?php
mysqli_free_result($Recordset1);
?>
