Try this proper code for changing password
protected void Button1_Click(object sender, EventArgs e)
{
//first check user is logged in or session is expired
if (Session["user"] != null)
{
if (txtoldPassword.Text == txtNewPassword.Text)
{
Response.Write("<script>alert('your old passwod is same as new pass')</script>");
return;
}
else
{
string user = Session["user"].ToString();
SqlConnection conn = new SqlConnection("connectionString");
string q = "Update users set password='" + txtNewPassword.Text
+ "' where username='" + user + "' and password='" + txtoldPassword.Text + "'";
conn.Open();
SqlCommand comm = new SqlCommand(q, conn);
comm.ExecuteNonQuery();
Response.Write("<script>alert('password changed')</script>");
conn.Close();
}
}
else
{
//if not logged in
Response.Redirect("login.aspx");
}
}