<html>
<body bgcolor="#000000" text="#FFFFFF">
<?php
require 'config.php';
$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);

require_once "sql_inject.php"; 
include_once('sql_check.php');
check_inject();

$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 


$login = stripslashes($_POST['login']);
$oldpwd = stripslashes($_POST['oldpwd']);
$newpwd = stripslashes($_POST['newpwd']);	

if ((eregi("[^a-zA-Z0-9_-]", $login)) || (eregi("[^a-zA-Z0-9_-]", $oldpwd)) || (eregi("[^a-zA-Z0-9_-]", $newpwd)) ) 
	{
	echo("SQL Injection Detected");
        exit();
	}

$sql_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'"); 
$username_check = mssql_num_rows($sql_username_check); 

$sql_pw_check = mssql_query("SELECT memb__pwd FROM MEMB_INFO WHERE memb__pwd='$oldpwd' and memb___id='$login'"); 
$pw_check = mssql_num_rows($sql_pw_check); 

if (empty($login) || empty($newpwd) || empty($oldpwd)) {
    echo "Error: Some fields were left blank. Please go back and try again.<br>";
}

elseif ($username_check <= 0){ 
        echo "Error: Your Login does not exist in our database. Please go back and try again.<br>"; }

elseif ($pw_check <= 0){ 
        echo "Error: Your Old Password does not exist in our database. Please go back and try again.<br>"; }

elseif ($oldpwd==$newpwd) {
    echo "Error: Your Old and New password are the same, so no change was comited.<br>";
}

else {	
$msquery = "UPDATE dbo.MEMB_INFO
SET memb__pwd = '$newpwd'
WHERE memb___id = '$login'
AND memb__pwd = '$oldpwd'";


$sqlinject->test($msquery); 
$msresults= mssql_query($msquery);
echo "<font size='1' face='verdana'>Senha mudada com sucesso! 
        succesfully. You can now play in our server. Your account is:<p>
        Login ID:<b> $login</b><br>
        Password:<b> $newpwd </b></font>";}
		?>
</body>
</html>