تغيير الباسورد

[maxmon]

<?php
StrUserID='$username' AND password='$password'");if (isset($_GET['act']) AND $_GET['act'] == "changepass")
{

function anti_injection($sql) {
$sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|'|\"|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
$sql = trim($sql);
$sql = strip_tags($sql);
$sql = addslashes($sql);
return $sql;
}

$regdate = date("Y-m-d H:i:s");
$newpass=md5($_POST['newpass']);
$newpass2=anti_injection($_POST['newpass']);
$password=anti_injection($_POST['password2']);
$username=anti_injection($_POST['username2']);

if (!$_POST['username2'] )
{
echo "<script>alert('player name is empty');location.href='pass.php';</script>";
die();
}
else
if (!$_POST['password2'] )
{
echo "<script>alert('E-Mail is empty');location.href='pass.php';</script>";
die();
}
else
if (!$_POST['newpass'] )
{
echo "<script>alert('New Password is empty');location.href='pass.php';</script>";
die();
}
$query = odbc_exec($connect, "SELECT StrUserID FROM TB_User WHERE StrUserID='$username' AND StrUserID='$password'");

$checkusername = odbc_num_rows($query);
if(($checkusername != 0) and $checkpassword != 0)
{
odbc_exec($connect,"UPDATE TB_User SET password='$newpass' WHERE StrUserID='$username''")or die("Can't connect the MSSQL server.");

echo "<script>alert('Login Pass has been changed! \\nNew Password: $newpass2');location.href='pass.php';</script>";
} else
echo "<script>alert('Wrong Player Name/Email entered!');location.href='pass.php';</script>";
die();
}
?>

دلواتى جه ph بتاع تغيير الباسورد اضيفو ازاى بئه فى الموقع ؟