Mysql update not changing values in data table? Query not made? - php

Question

I am very new to mysql and am attempting to replace one value in a column with another. Right now I have 2 inputs and can echo the text value of these inputs here as well as the username of the person logged in:
<?php
session_start();
include("../php/Session.class.php");
$sess = new Session();
$sess->Init();
$cookie = isset($_COOKIE["session"]);
if($cookie)
{
$cookie = $_COOKIE["session"];
$account = $sess->Verify($cookie);
}
$pass1=$_POST['passwordText']; //name of input
echo $pass1;
$pass=$_POST['oldPass']; //name of input
echo $pass;
echo $account['username'];
I then connect to my database and am trying to set the previous password to the value of $pass1 where the user's username is located.
$dbh = new mysqli("localhost","username","password","sqlserver");
$checkforpass = "SELECT password FROM accounts WHERE username='".$account['username']."'";
$checkforpass = $dbh->query($checkforpass); //make query
$checkforpass = $checkforpass->fetch_assoc(); //prepare sql
$checkforpass = $checkforpass['password'];
echo $checkforpass;
if($checkforpass==$pass)
{
echo 'they got the password!';
$change = "UPDATE accounts SET password=".$pass1." WHERE username='".$account['username']."'";
//$change = $dbh->query($change);
$dbh->query($change); //make query
$dbh->close();
//change password
}
I get no errors but when checking my local data base the value of password stays the same. What am I doing wrong here?

Answer 1

I think its not getting inserted/updated because you are not using single quotes around varchar in the query.
Your query should be :
$change = "UPDATE accounts SET password='".$pass1."' WHERE username='".$account['username']."'";
OR
$change = "UPDATE accounts SET password='$pass1' WHERE username='".$account['username']."'";