Untitled

<?php 
    require "connect_to_database.php";

    $password =    md5($_POST['password']);
    $new_password =  $_POST['new_password'];
    $confirm_password = $_POST['confirm_password'];
    $admin_user = $_POST['admin_user'];
    
    $sql = "SELECT * FROM tbl_admincreds WHERE admin_user = '$admin_user' AND admin_password = '$password' ";
    $result = $conn->query($sql);
 
    if($result->num_rows == 0){
        echo "<script>alert('Password do not match in our database!')</script>";
        echo "<script>history.back()</script>";
    }else if($result->num_rows > 0){
        if($new_password != $confirm_password){
            echo "<script>alert('New password and confirm password do not match!')</script>";
            echo "<script>history.back()</script>";
        }else{
            $new_password = md5($new_password);
            $sql1 = "UPDATE tbl_user SET admin_password = '$new_password' WHERE admin_user = '$admin_user'";
            $conn->query($sql1);
            echo "<script>alert('Password change successfully!')</script>";
            echo "<script>history.back()</script>";
        }
    }
?>