change-password.php

<?php
require_once 'includes/config.php';
require_once 'includes/db.php';
require_once 'includes/functions.php';

if (!is_logged_in()) {
    redirect(SITE_URL . '/index.php');
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    redirect(SITE_URL . '/profile.php');
}

$current_password = $_POST['current_password'];
$new_password = $_POST['new_password'];
$confirm_password = $_POST['confirm_password'];

// Validation
if (empty($current_password) || empty($new_password) || empty($confirm_password)) {
    redirect(SITE_URL . '/profile.php?error=empty_fields');
}

if ($new_password !== $confirm_password) {
    redirect(SITE_URL . '/profile.php?error=password_mismatch');
}

if (strlen($new_password) < 6) {
    redirect(SITE_URL . '/profile.php?error=password_short');
}

try {
    // Get current password hash
    $stmt = $pdo->prepare("SELECT password FROM users WHERE id = ?");
    $stmt->execute([$_SESSION['user_id']]);
    $user = $stmt->fetch();
    
    // Verify current password
    if (!password_verify($current_password, $user['password'])) {
        redirect(SITE_URL . '/profile.php?error=wrong_password');
    }
    
    // Update password
    $new_password_hash = password_hash($new_password, PASSWORD_DEFAULT);
    $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
    
    if ($stmt->execute([$new_password_hash, $_SESSION['user_id']])) {
        redirect(SITE_URL . '/profile.php?success=password');
    } else {
        redirect(SITE_URL . '/profile.php?error=update_failed');
    }
} catch (Exception $e) {
    redirect(SITE_URL . '/profile.php?error=system');
}
?>