Create Change Password Page - php

Question

I have created a change password page where the 1st is condition if ($newpassword == 0) is working properly but else part is not working if I omit the 1st if condition the other conditions are working properly but with every refresh password field also taking blank save in DB table. The code is given below for help. Thank you in advance.
<?php
include('session.php');
include('config.php');
//error_reporting(0);
$error = ''; // Variable To Store Error Message
$newpassword = $_POST['npassword'];
$confirmnewpassword = $_POST['cpassword'];
if ($newpassword == 0) {
$error = "Set a New Password!";
} else {
if ($newpassword == $confirmnewpassword) {
$sql = mysqli_query($con, "UPDATE t_login SET password='$newpassword'");
} else if ($sql) {
$error = "Congratulations You have successfully changed your password!";
} else {
$error = "New Password and Confirm Password do not match. Try again!";
}
}
?>

Answer 1

As i've commented your conditons are wrong.
if ($newpassword == $confirmnewpassword) { //If you enter here you can t reach other conditions
$sql = mysqli_query($con, "UPDATE t_login SET password='$newpassword'");
} else if ($sql) {
$error = "Congratulations You have successfully changed your password!";
} else {
$error = "New Password and Confirm Password do not match. Try again!";
}
You should do that
if ($newpassword == $confirmnewpassword) {
//HERE THERE IS AN SQL INJECTION
$sql = mysqli_query($con, "UPDATE t_login SET password='$newpassword'");
if ($sql) {
$error = "Congratulations You have successfully changed your password!";
} else {
$error = "Mysql query error !";
}
} else {
$error = "New Password and Confirm Password do not match. Try again!";
}
You should use prepared statement or at least escape parameters because if your user type a ' inside his password your code will fail !
EDIT I ve forgot to tell that your query change the password for every records in your table, maybe you forgot to use a WHERE.
Hope this helps

Answer 2

Most of these comments don't directly have much to do with your question, but some remarks:
<?php
include('session.php');
include('config.php');
//error_reporting(0);
Please uncomment this, to get some valuable warnings!
$error = ''; // Variable To Store Error Message
$newpassword = $_POST['npassword'];
$confirmnewpassword = $_POST['cpassword'];
As you do not know if these are set, I would check (also to avoid a warning) if it actually exists, so something like $newpassword = $_POST['npassword'] ?? '';
if ($newpassword == 0) {
You are checking if it is "sort of" (the double is does type juggling for you) equal to 0. That's quite vague. I would check if it is a valid password or not, for instance !== ''. This wil work really well with previous tip.
$error = "Set a New Password!";
} else {
if ($newpassword == $confirmnewpassword) {
You can safely use === here.
$sql = mysqli_query($con, "UPDATE t_login SET password='$newpassword'");
You probably want a WHERE statement in here, because this updates all rows in your table.
} else if ($sql) {
As you defined the $sql in your if above, and this is in an else, it will never be true(ish) here. This is the major bug in the code
$error = "Congratulations You have successfully changed your password!";
} else {
$error = "New Password and Confirm Password do not match. Try again!";
}
}
?>
If you don't mix HTML and php, please omit the end-php tag.