<?php
session_start();
include '../config.php'; // naik satu folder ke config.php

if (isset($_POST['ganti'])) {
    $username = $_SESSION['username'];
    $lama = md5($_POST['lama']);
    $baru = md5($_POST['baru']);

    $cek = mysqli_query($koneksi, "SELECT * FROM tbl_user WHERE username='$username' AND pass='$lama'");
    if (mysqli_num_rows($cek) > 0) {
        mysqli_query($koneksi, "UPDATE tbl_user SET pass='$baru' WHERE username='$username'");
        echo "<script>alert('Password berhasil diganti');</script>";
    } else {
        echo "<script>alert('Password lama salah');</script>";
    }
}
?>

<!-- FORM -->
<h3>Ganti Password</h3>
<form method="post">
  <input type="password" name="lama" placeholder="Password lama" required><br><br>
  <input type="password" name="baru" placeholder="Password baru" required><br><br>
  <input type="submit" name="ganti" value="Ganti Password">
</form>
