Can anyone help me in Changing Email address in CP?

$account_id = stripslashes($_SESSION['user']);
$error = 0;

function valid2($word)
{
  $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@._";
  for($i=0;$i<strlen($word);$i++)
  {
    $ch = substr($word,$i,1);
  $nol = substr_count($chars,$ch);
  if($nol==0)
  {
    return true;
  }
  }
  return false;
}

$oldemail = $_POST['oldemail'];
$newemail = $_POST['newemail'];
$kodepribadi = $_POST['kodepribadi'];

if(valid2($oldemail))
{
                    echo("<script>alert('[E-Mail]Special Characters is Not Allowed'); location='javascript:history.back()'</script>");

}else if(valid2($newemail))
{
                      echo('<script language="Javascript">alert("[E-Mail]Special Characters is Not 

Allowed");location="javascript:history.back()" </script>');

}else if(valid2($kodepribadi))
{
                      echo('<script language="Javascript">alert("[NewPincode ReConfrim]Special Characters is Not 

Allowed");location="javascript:history.back()" </script>');

}else if(strlen($kodepribadi)>13)
{
                      echo('<script language="Javascript">alert("[New PinCode Reconfirm]Please Provide Only 13 Characters to Change 

PinCode");location="javascript:history.back()" </script>');

}else{
if($_POST['action']=='changeemail') {

   $error = 2;

   require("config.php");
   $account_id = stripslashes($_SESSION['user']);
   $kodepribadi = $_POST['kodepribadi'];
   $oldemail = $_POST['oldemail'];
   $newemail = $_POST['newemail'];



$oldemail = $_POST['oldemail'];
$oldemail = str_replace("'","",$oldemail);
$oldemail = str_replace(";","",$oldemail);
$oldemail = str_replace("!","",$oldemail);
$oldemail = str_replace("#","",$oldemail);
$oldemail = str_replace("$","",$oldemail);
$oldemail = str_replace("%","",$oldemail);
$oldemail = str_replace("^","",$oldemail);
$oldemail = str_replace("&","",$oldemail);
$oldemail = str_replace("*","",$oldemail);
$oldemail = str_replace("(","",$oldemail);
$oldemail = str_replace(")","",$oldemail);
$oldemail = str_replace(",","",$oldemail);
$oldemail = str_replace('"',"",$oldemail);
$oldemail = str_replace("=","",$oldemail);


$newemail = $_POST['newemail'];
$newemail = str_replace("'","",$newemail);
$newemail = str_replace(";","",$newemail);
$newemail = str_replace("!","",$newemail);
$newemail = str_replace("#","",$newemail);
$newemail = str_replace("$","",$newemail);
$newemail = str_replace("%","",$newemail);
$newemail = str_replace("^","",$newemail);
$newemail = str_replace("&","",$newemail);
$newemail = str_replace("*","",$newemail);
$newemail = str_replace("(","",$newemail);
$newemail = str_replace(")","",$newemail);
$newemail = str_replace(",","",$newemail);
$newemail = str_replace('"',"",$newemail);
$newemail = str_replace("=","",$newemail);











   echo "<div align=center>";

   $result = mssql_query ("SELECT UserName, UserPass, UserPass2, UserEmail, UserNum, UserPoint FROM UserInfo WHERE UserName = 

'$account_id' ");
   $rows=mssql_fetch_assoc($result); 
   extract($rows);

   $sandi = ($UserPass2);
   $emaillama = ($UserEmail);


if ($sandi==NULL) {
         echo '<script language="JavaScript">
      alert("Please Enter your Pincode");
      </script>';
      $error = 1;
   }

if ($oldemail==NULL) {
         echo '<script language="JavaScript">
      alert("Please Enter your E-Mail");
      </script>';
      $error = 1;
   }
if ($newemail==NULL) {
         echo '<script language="JavaScript">
      alert("Please Enter your Re-Typed New E-Mail");
      </script>';
      $error = 1;
   }

   if ($sandi!=$kodepribadi) {
         echo '<script language="JavaScript">
      alert("Typed PinCode is Incorrect");
      </script>';
      $error = 1;
   }

   if ($emaillama!=$oldemail) {
         echo '<script language="JavaScript">
      alert("Typed E-Mail is Incorrect");
      </script>';
      $error = 1;
   }

   if ((strlen($newemail)<4 ||strlen($newemail)>1000) && $newemail!="") {
         echo '<script language="JavaScript">
      alert("Type your New E-Mail Address");
      </script>';
      $error = 1;
   }

   echo "</div>";

}

if($error<2) {
   echo '<br><br><center><div style="width:546px; margin:0 0 0 10px; padding:10px; border:1px solid #484848; background:#0099CC; 

color:white; text-align:center; line-height:18px">
   Change E-Mail System.</div><br>      </tr>
   
   <form name="changeemail" action="" method="post" onsubmit="return checkform()" autocomplete="off">
      <table cellspacing=2 border=0 cellpadding=1 align=center>
         <tr>
            <td width=135 align=right>
               <font size=2> PinCode :  
            </td>
            <td>
               <div align=left>
                  <input type=password maxlength=13 name=kodepribadi tabindex="4" class="form_pay" 

style="width:150px;" />
               </div>
            </td>
         </tr>
         <tr>
            <td align=right>
               <font size=2> Old E-Mail Address :  
            </td>
            <td>
               <div align=right>
                  <input type=text maxlength=50 name=oldemail tabindex="4"  class="form_pay2" 

style="width:231px;" />
               </div>
            </td>
         </tr>
         <tr>
            <td align=right>
               <font size=2> New E-Mail Address :  
            </td>
            <td>
               <div align=right>
                  <input type=text maxlength=50 name=newemail tabindex="4"  class="form_pay2" 

style="width:231px;" />
               </div>
            </td>
         </tr>
      </table>
      <div align=center>
         <BR>
         <input type=hidden name=action value="changeemail">
         <input type=submit name=submit value="Submit" tabindex="5" class="btn2" 

style="font-size:12px;height:24px;width:70px;">
      </div>
   </form>
   
   
   ';
}

if($error==2) {

require("config.php");
$account_id = stripslashes($_SESSION['user']);
$newemail = ($newemail);

mssql_query("UPDATE RanUser.dbo.UserInfo SET UserEmail = '$newemail' WHERE UserName = '$account_id' ");

   echo '<script language="JavaScript">
      alert("Successfully Change E-Mail. Thank you.");
      </script>';
      $error = 1; quickrefresh('index.php');

}
}


?>