<!--#include file="connection.asp"-->
<%
if session("userid") = "" then
	Response.Redirect "login.htm"
end if
%>

<%
dim xoldpass,xnewpass,xconfirmpass
xoldpass = request("oldpass")
xnewpass = request("newpass")
xconfirmpass = request("confirmpass")


if xnewpass <> xconfirmpass then
	Response.Redirect "changepassword.asp?flag=2"
end if

if len(xnewpass) <= 0 or len(xconfirmpass) <= 0 then
	Response.Redirect "changepassword.asp?flag=3"
end if

if instr(1,xoldpass,"'") > 0 then
	xoldpass = replace(xoldpass,"'","''")
end if
if instr(1,xnewpass,"'") > 0 then
	xnewpass = replace(xnewpass,"'","''")
end if
if instr(1,xconfirmpass,"'") > 0 then
	xconfirmpass = replace(xconfirmpass,"'","''")
end if


conn.open = connstring
set rs = Server.CreateObject("adodb.recordset")
rs.open "Select * from users where userid = '" & session("userid") & "' and isactive = true",conn

if not rs.EOF then
	if xoldpass = rs.Fields("pass") then
		set rs1 = Server.CreateObject("adodb.recordset")
		rs1.Open "update users set pass = '" & xnewpass & "' where userid = '" & session("userid") & "'" ,conn
		Response.Redirect "main.asp?flag=pass"
	else
		Response.Redirect "changepassword.asp?flag=1"
	end if
end if
 

%>