<?php 

include '../koneksi.php';
session_start();
$id             = $_SESSION['id'];
$password_lama  = $_POST['password_lama'];
$password_baru  = $_POST['password'];

// Cek password lama
$query = mysqli_query($koneksi, "SELECT user_password_hash FROM user WHERE user_id = '$id'");
$data = mysqli_fetch_assoc($query);
$hash = $data['user_password_hash'];

if (password_verify($password_lama, $hash)) {
    // Password lama valid, maka ganti password
    $hash_baru = password_hash($password_baru, PASSWORD_BCRYPT);
    mysqli_query($koneksi, "UPDATE user SET user_password_hash = '$hash_baru' WHERE user_id = '$id'") or die(mysqli_error($koneksi));
    header("location:index.php");
} else {
    // Password lama tidak valid
    header("location:gantipassword.php?alert=gagal");
}
?>