Stuck on PHP query - php

Question

I've created a page that allows users to change their password and email. All of it works but for some reason when I just want to change my email I also get the field Current Password is incorrect. The email itself changes in the database but this shows up, I've obviously validated that it shwos up but I am unsure of how to get around to write a new query that will ignore the previous queries if only the email is changed.
My code:
<title>Honda |</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
<link href='http://fonts.googleapis.com/css?family=Julius+Sans+One' rel='stylesheet' type='text/css'>
<link href="../css/style.css" rel="stylesheet" type="text/css" media="all" />
<?php
session_start();
$username = $_SESSION['sess_user'];
echo '<div class="search1"><h2>'.$username.'</h2><div class="search12"><h2>Home</h2></p></div></div>';
if (isset($_SESSION['sess_user']))
{
//user is logged in
if (isset($_POST['submit']))
{
//start changing password
//check fields
$oldpassword = md5($_POST['oldpassword']);
$newpassword = md5($_POST['newpassword']);
$email = $_POST['email'];
$repeatnewpassword = md5($_POST['repeatnewpassword']);
//check password against db
include('../includes/config.php');
$queryget = mysql_query("SELECT password FROM login WHERE username='$username'") or die ("change password failed");
$row = mysql_fetch_assoc($queryget);
$oldpassworddb = $row['password'];
//check passwords
if ($oldpassword==$oldpassworddb)
{
if (isset($_POST['repeatnewpassword']) AND isset($_POST['newpassword']) AND $_POST['newpassword'] != '') {
if ($newpassword==$repeatnewpassword)
{
$querychange = mysql_query("UPDATE login SET password='$newpassword' WHERE username='$username'");
echo "<div class='successmate'><br><br><br><br><hr>Password has been changed!</hr></div><div class='successmate'><br><hr><br><h2><p><a href='index2.php'><br><br></a></p></h2></div>";
}
else {echo "<div class='results'>new password(s) dont match</div><div class='successmate'><br><br><h2><p><a href='changepassword.php'>try again?</a></p></h2></div>";}
}
}
else {echo "<div class='results'>current password doesnt match</div><div class='successmate'><h2><p><a href='changepassword.php'><br><br>Try again?</a></p></h2></div>";}
if (isset($_POST['email']) AND $_POST['email'] != '') {
$querychange = mysql_query("UPDATE login SET email='$email' WHERE username='$username'");
echo "<div class='successmate'><br><br><br><br><hr>Your email has been changed</hr></div><div class='successmate'><br><hr><br><h2><p><a href='index2.php'><br><br></a></p></h2></div>";
}}
else
{
echo"
<form class='search1' action='changepassword.php' method='POST'>
<label>Current Password:</label> <input type='password' id='password' name='oldpassword'><p>
<label>New Password:</label> <input type='password' id='password' name='newpassword'><p>
<label>Repeat New Password:</label> <input type='password' name='repeatnewpassword'><p>
<label>Email:</label> <input type='email' name='email'><p>
<input type='submit' name='submit' class='submit' value='submit'><br><br><br>
<h2><p><a href='index2.php'>Back</a></p></h2>
</form>
";
}}
else
die ("You must be logged in to change your password");
?>
<img src="../images/main.jpg">

Answer 1

You're checking that the post values are set for the password (which they always will be, because that form element will always be submitted). Instead of simplychecking if those vaues are set, make sure thay're not empty. use empty() Also, when making comparisons don't use the word "AND" use the and operator "&&".
if (!empty($_POST['repeatnewpassword']) && !empty($_POST['newpassword'])) {
if ($newpassword==$repeatnewpassword)
{
$querychange = mysql_query("UPDATE login SET password='$newpassword' WHERE username='$username'");
echo "<div class='successmate'><br><br><br><br><hr>Password has been changed!</hr></div><div class='successmate'><br><hr><br><h2><p><a href='index2.php'><br><br></a></p></h2></div>";
}
else {echo "<div class='results'>new password(s) dont match</div><div class='successmate'><br><br><h2><p><a href='changepassword.php'>try again?</a></p></h2></div>";}
}
I'm looking at the wrong chunk of code. The above advice is good advice, but your problem is here:
If the password fields are empty then these will never be the same, so if ($oldpassword==$oldpassworddb) will always evaluate false.
Try
if ($oldpassword==$oldpassworddb && !empty($_POST['oldpassword']))

Answer 2

Your query is probably spitting out an array. Try doing print_r($row) and examining the output. I have a feeling you're getting an associative array here and need to access the old password differently. Put the print_r after this line:
$row = mysql_fetch_assoc($queryget);
The answer is probably $row[0]['password'];
Also, don't use MD5 for hashing, use Scrypt or something like that with salt and maybe pepper.