check hashed password and change it in php - php

Question

This is my code, i want to update the password with the given new password $new_password, validate it with $new_password2 and check if the current given password matches the $old_password.
<?php
if (isset($_POST['submit'])) {
//validations
$required_fields = array("username", "old_password", "password", "password2");
validate_presences($required_fields);
$fields_with_max_lengths = array("username" => 30);
validate_max_lengths($fields_with_max_lengths);
if(empty($errors)) {
//process the form
$id = $admin["id"];
$username = mysql_prep($_POST["username"]);
$new_password = password_encrypt($_POST["password"]);
$old_password = password_encrypt($_POST["old_password"]);
$new_password2 = password_encrypt($_POST["password2"]);
The two passwords you must give must be equal to each other to change the password. All three passwords are hashed. $new_password and $new_password2 are needed to validate the new password. The $old_password must also be updated with the $new_password. It must be changed if the id equals the one in the database and if the $old_password matches the current $old_password.
if ($new_password == $new_password2) {
//update
$query = "UPDATE admins SET ";
$query .= "username = '{$username}', ";
$query .= "password = '{$new_password}', ";
$query .= "old_password = '{$new_password}', ";
$query .= "password2 = '{$new_password}' ";
$query .= "WHERE id = {$id} ";
$query .= "AND old_password = '{$old_password}' ";
$query .= "LIMIT 1";
$result = mysqli_query($connection, $query);
if ($result && mysqli_affected_rows($connection) == 1) {
//success
$_SESSION["message"] = "Admin updated.";
redirect_to("manage_admins.php");
} else {
//failure
$_SESSION["message"] = "Admin update failed1";
}
} else {
$_SESSION["message"] = "Admin update failed2";
}
} else {
$_SESSION["message"] = "Admin update failed3";
}
} else {
}
?>

Answer 1

You may have meant password_hash instead of password_encrypt. Still, this would be the wrong usage. Look into password_verify. The basic idea is that you get the current hashed password for that user from the DB and then use password_verify to check the user entry against the stored hash.