Prob.. in change pasword page

Question

i have a prob...in following code in which user when wants to change his password..he has to enter the username and old password..and then new password..then below query update the password....
my prob is that the password is changing but prob is that if i enter the old password wrong in the field..then also it updates the new password....
i.e user when eneter the old password...then also it changes the password...
i have to do that the usersname and password should be match with old password..then the password update has been done...else it shown error..
plz..where is the prob..in the below code...let me know...
<%          
try
String Username = request.getParameter("msno");
String OldPassword = request.getParameter("pass");
String NewPassword = request.getParameter("npass");
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
Connection con=DriverManager.getConnection("jdbc:odbc:pf","scott","ttlscott");
con.setAutoCommit(false);
PreparedStatement pstatement = con.prepareStatement(
"UPDATE login_mast SET password = ?  WHERE name=?");
pstatement.setString(1, NewPassword);
pstatement.setString(2, Username);
int rowCount = pstatement.executeUpdate();
con.setAutoCommit(false);
con.setAutoCommit(true);
PreparedStatement sql = con.prepareStatement("SELECT * FROM login_mast WHERE name = '" + Username + "' and password='"+NewPassword+"' ");
ResultSet results = sql.executeQuery();
if(results.next())     {%>
<% response.sendRedirect("chng_pass.html");
}else{
      response.sendRedirect("error.html");
catch (SQLException s)
out.println(s.getMessage());  
%>

Answer 1

PreparedStatement pstatement = con.prepareStatement(
"UPDATE login_mast SET password = ? WHERE name=?");The problem is here... where have you verified that the old password is correct?
Change the query:
UPDATE login_mast SET password = ? WHERE name = ? AND password = ?Set the old password as the third parameter.