Bad Update Data in PHP PDO - php

Question

Well, I'm working around with PHP with PDO extension as the database driver.
I'm working on a 'changing password' scenario where things is pretty messed up for me :(
We (some Stackoverflow helpers, Kudos!) have managed to verify the password with the current password, but it doesn't update the data, as I think.
Here is the encountering scenario:
You are changing your password from quora to stackoverflow. We know that if you change the password, you cannot use the old password, but in my situation, you can use the old password but not the new one, making the new one obselete.
Here is an snippet of my code:
$option = ['cost' => 12];
$password = password_hash($_currentpassword, PASSWORD_BCRYPT, $option);
$selectpasswordsql = "SELECT `password` FROM `auth` WHERE username=?";
$selectpasswordstmt = $conn->prepare($selectpasswordsql);
$selectpasswordstmt->execute(array($_SESSION['account']['username']));
$selectpasswordresults = $selectpasswordstmt->fetch(PDO::FETCH_ASSOC);
$databasepass = $selectpasswordresults['password'];
if(password_verify($_currentpassword,$databasepass)){
if(empty($passmsgs)){
$updatepasssql = "UPDATE `auth` SET
`password`=?
WHERE username=?
";
$updatepassstmt = $conn->prepare($updatepasssql);
$updatepassstmt->execute(array(password_hash($password, $_SESSION['account']['username']));
if($updatepassstmt){
array_push($passmsgs, 'Successfully updating your password!');
} else {
array_push($passmsgs, 'There was a problem executing your command!');
}
}
} else {
array_push($passmsgs, 'Your current password is wrong!');
}

Answer 1

First of all, please be sure that you can see errors by including following lines to top of your page.
error_reporting(E_ALL);
ini_set("display_errors", 1);
Your following code has both logic and syntax errors.
$updatepassstmt->execute(array(password_hash($password, $_SESSION['account']['username']));
if($updatepassstmt){
You try to re-hash $password value that is hashed of $_currentpassword. (please clearly define new password variable.)
you haven't closed password_hash() function properly. ($_SESSION['account']['username'] passed as a second parameter.)
you don't check execute() result which returns bool. you need to check it or you'll always get success message as $updatepassstmt will be PDOStatement object on successfull prepare() calls.
I suggest you to convert your code logic like this:
...
$updatepassstmt = $conn->prepare($updatepasssql);
$new_hashed_password = password_hash($_POST['new_password'], PASSWORD_BCRYPT, $option); // replace $_POST['new_password'] with the correct one.
$result = $updatepassstmt->execute($new_hashed_password, $_SESSION['account']['username']);
if ($result){
...etc...