Mini Kabibi Habibi

<?php
	require_once '../conn.php';
	
	$old_pass = md5($_POST['old_pass']);
	$new_pass = $_POST['new_pass'];
	$confirm_pass = $_POST['confirm_pass'];
	$username_ao = $_POST['username_ao'];
	
	$query = mysqli_query($conn, "SELECT * FROM `accounts` WHERE `password` = '$old_pass' && `username` = '$username_ao'") or die(mysqli_error());
	$rows = mysqli_num_rows($query);
	
	if($rows > 0){
		if($new_pass === $confirm_pass){
			$encrypt_pass = md5($new_pass);
			mysqli_query($conn, "UPDATE `accounts` SET `password` = '$encrypt_pass' WHERE `username` = '$username_ao'") or die(mysqli_error());
			echo "success";
		}else{
			echo "error2";
		}
	}else{
		echo "error1";
	}
?>