How to make a change password PHP script work [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 8 years ago.
Improve this question
I am a simpleton with less than a cursory knowledge of programming. I have a family web site where we share photos, videos, files and other resources. The site has a simple login feature that begins a session, and I want to be able to provide people with the ability to change their password once logged in.
The database is in MySQL and is extremely simple with only; ID, username, and, password columns (not encrypted or hashed at all).
When it comes to PHP and MySQL I tend to research other people's examples and make them my own, and with the login script I found this very easy to do. However, I have tried and tried and tried to find a PHP snippet that fits with my site and will allow users to change their passwords and have unfortunately failed at every attempt.
I am hoping that someone can assist me in developing what I have already to make it work for my site, any help will be hugely appreciated!
My form simply asks for the logged in user to enter a new password, and then confirm the same password:
<form name="frmChange" role="form" class="form-signin" method="POST" action="changepword_script.php">
<div class="form-group">
<label for="InputPassword2">New Password</label>
<input type="password" class="form-control" id="InputPassword2" placeholder="New Password" name="newPassword">
<label for="InputPassword3">Confirm New Password</label>
<input type="password" class="form-control" id="InputPassword3" placeholder="Confirm Password" name="confirmPassword"> </div>
<button class="btn btn-lrg btn-default btn-block" type="submit" value="send">Change it</button>
</div>
</form>
And my php script (also very simple) just needs to check that the passwords match and then update the database if they do (I have removed the IP address of the database and replaced with zeros):
<?php
session_start();
if (!(isset($_SESSION['username']) && $_SESSION['username'] != ''))
{
header("location:login.php");
}
$dbcon = mysql_connect ('000.000.000.00', 'my_db_username', 'my_db_password')
$password1 = $_POST['newPassword'];
$password2 = $_POST['confirmPassword'];
$password1 = mysql_real_escape_string($password1);
$password2 = mysql_real_escape_string($password2);
if ($password1 <> $password2){ echo "Your passwords do not match.";}
{
echo "your passwords do not match";
}
if (mysql_query(UPDATE ebsmembers SET password='$password1' WHERE username='$session[username]'))
{
echo "You have successfully changed your password.";
}
mysql_close($dbcon);
header("location:login.php");
?>
Again, any help would be massively appreciated as I have really struggled with making this work!
Many thanks,
Paul

Answer 1

Tweaked a few things that where errors or didn't make sense to me. Also switched to mysqli_*.
<?php
session_start();
if (!(isset($_SESSION['username']) || $_SESSION['username'] == ''))
{
header("location:login.php");
}
$dbcon = mysqli_connect('000.000.000.00', 'my_db_username', 'my_db_password', 'my_db_name') or die(mysqli_error($dbcon));
$password1 = mysqli_real_escape_string($dbcon, $_POST['newPassword']);
$password2 = mysqli_real_escape_string($dbcon, $_POST['confirmPassword']);
$username = mysqli_real_escape_string($dbcon, $_SESSION['username']);
if ($password1 <> $password2)
{
echo "your passwords do not match";
}
else if (mysqli_query($dbcon, "UPDATE ebsmembers SET password='$password1' WHERE username='$username'"))
{
echo "You have successfully changed your password.";
}
else
{
mysqli_error($dbcon);
}
mysqli_close($dbcon);
?>

Answer 2

Your use of the session is wrong. In your SQL query, it should be:
UPDATE ebsmembers SET password = '$password1' WHERE username= '$_SESSION[username]'
Also your syntax is very bad. It's missing quotes in several places. You should start with the PHP basics again before making your changes.

Answer 3

Query should be quoted:
if (mysql_query("UPDATE ebsmembers SET password='$password1' WHERE username='$_SESSION[username]'"))
Don't use mysql, it's deprecated. Use mysqli or PDO instead:
The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead
Don't store passwords in plain text. Use bcrypt encryption with password_hash() and password_verify() functions:
How do you use bcrypt for hashing passwords in PHP?

Answer 4

$password1 = $_POST['newPassword'];
$password2 = $_POST['confirmPassword'];
must be
$password1 = $_POST['InputPassword2'];
$password2 = $_POST['InputPassword3'];

Answer 5

you can use update statement for this purpose, create a same form with:
username(name=$name)
existing password(password=$pw1)
new password
submit
First select the current user name using sql select statement:
$my_qry ="select * from table_name where name= $name";
for updation use the statement:
$query = mysql_query("UPDATE table_name SET password='".$pw1."' WHERE name='".$name."'");
if(!$query)
{
mysql_error();
echo "hello";
}
use if else conditions for this, if the first select query is true then only the update query with work