<?php
session_start();
        // where is your config file stored?
	include ("config.php");
//echo $_POST['oldpass'];
	if($_POST['oldpass']!=""&&$_POST['newpass']!="")
	{
		
			$oldpass = htmlspecialchars(trim($_POST['oldpass']));
			$newpass = htmlspecialchars(trim($_POST['newpass']));
			$ans='select password from tbl_user where user_name="'.$_SESSION['u_name'].'"';
			$res = mysql_query($ans);
			$inf = mysql_fetch_array($res);
			
			if($inf[0]==$_POST['oldpass'])
			{
			   $updateq='UPDATE tbl_user SET password = "'.$_POST['newpass'].'" WHERE user_name="'.$_SESSION['u_name'].'"';
			   //echo $updateq;
			   mysql_query($updateq) or die(mysql_error());
			   echo "yes"; //Password Changed
			}
			else
			{
				   echo "no";
			}
	}
	else
	{
		   echo "no";
	}
//		echo "no"; //New Employee student details
//		//now set the session from here if needed
//		//$_SESSION['u_name']=$user_name; 
//		//$addClient  = "INSERT INTO staff(EmployeeId,Name,Department,TeleNo,Gender,BusNumber,StopName) VALUES ('$Employee_ID','$Name','$Department','$Telephone_No','$Gender','$Bus_No','$Boarding_Point')";
//    mysql_query($addClient) or die(mysql_error());
//	}
	
	//print_r($_SESSION);


?>