Change Password

<?php
session_start(); //allow sessions
   if ($logged[username])  //Check if logged in or now
   { 
 
switch($_GET['action']) { //makes links ?action=
 
default:
//form action and method
echo "<form method='POST' action='changepass.php?action=change'>";
//table with old pass, new pass and conferm pass
echo "
Old Password: 
    <input type='password' name='oldpass' size='35'>
 
New Password: 
<input type='password' name='newpass' size='35'>
 
Conform Password:
<input type='password' name='conpass' size='35'>
";
//Submit button
echo "<input type='submit' value='Change Password' name='update'></form>";
break;
case "change":
//posts the old password and md5s it
$oldpass = md5($_POST[oldpass]);
//posts the new password and md5s it
$newpass = md5($_POST[newpass]);
//posts the conformation password and md5s it
$conpass = md5($_POST[conpass]);
//get the users old info from the database
$info = mysql_query("SELECT * FROM `members` WHERE `username` = '$logged[username]'"); 
$info = mysql_fetch_array($info);
//if the old password matches the password in the database we continue
if($info[password] == $oldpass) {
//if the new password and conformation password are the same continue
if($newpass == $conpass) {
//Updates the new password into the database where username is logged in
$update = mysql_query("UPDATE `members` SET `password` = '$newpass' WHERE `username` = '$logged[username]'");
//displays message when updated
echo "Password Updated, You will need to relogin with your new password.";
//logs them out so they login with there new password
@session_destroy();
}else{
//error message is the new password and the conformation password do not match
echo "Your new password and conformation passwords do not match!";
}
}else{
//error message is the old password does not match their database password
echo "Your old password does not match the database password!";
}
break;
}
}else { 
//if the person is not logged in
echo("You are not logged in!"); 
} 
?>