HB/pages/options_validation.php

<?php
session_start();

$id = $_SESSION['id'];
require('../connectBDD.php');
$x = mysql_query("SELECT * FROM user WHERE id='".$id."'");
$donnees = mysql_fetch_array($x);

$pseudo = $donnees['pseudo'];
$mail = $donnees['mail'];
$mdp = $donnees['mdp'];

if (isset($_POST['ancien_mdp']) && isset($_POST['nouveau_mdp']) && isset($_POST['nouveau_mdp2']) && $_POST['nouveau_mdp']!="" && $_POST['nouveau_mdp2']!="" && $_POST['ancien_mdp'] !='' ) {
	if(sha1(strtoupper($pseudo).':'.$_POST['ancien_mdp']) == $mdp) {
		if  ($_POST['nouveau_mdp'] == $_POST['nouveau_mdp2']) {
			$password = htmlspecialchars($_POST['nouveau_mdp']);
			$password = sha1(strtoupper($pseudo).':'.$password);
			mysql_query("UPDATE `user` SET mdp='$password' WHERE ID='$id'");
			$okmdp = true;
			header('Location: options.php?ok=2');
			exit;
		}
		else {
			header('Location: options.php?erreur=2');
			exit;
		}
	}
	else {
		header('Location: options.php?erreur=3');
		exit;
	}
}
if (isset($_POST['nouveau_mail']) && $_POST['nouveau_mail']!='')
{
    if (preg_match("#^[a-z0-9._-]+@[a-z0-9._-]{2,}\.[a-z]{2,4}$#", $_POST['nouveau_mail']))
    {
		$result = mysql_query("SELECT mail FROM user WHERE mail='".$_POST["nouveau_mail"]."'");
		if(mysql_num_rows($result)>=1) header('Location: options.php?erreur=1');
		else {
			$mail=htmlspecialchars($_POST['nouveau_mail']);
			mysql_query("UPDATE `user` SET mail='".$mail."' WHERE ID='".$id."'");
			if (isset($okmdp)) header('Location: options.php?ok=3');
			else header('Location: options.php?ok=1');
			exit;
		}
    }
    else {
		header('Location: options.php?erreur=4');
		exit;
	}
}
mysql_close();
header('Location: options.php');
?>