change password without current password field in php - php

Question

In the Below code i have Current password, new password and repeat new password fields but i don't want current password field to change password.
Note : I want only new password and repeat new password in the form.
<?php
session_start();
$user = $_SESSION['username'];
if (isset($_SESSION['username']))
{
//user is logged in
if (isset($_POST['submit']))
{
//start changing password
//check fields
$oldpassword = md5($_POST['oldpassword']);
$newpassword = md5($_POST['newpassword']);
$repeatnewpassword = md5($_POST['repeatnewpassword']);
//check password against db
include_once "connect_to_mysql.php";
$queryget = mysql_query("SELECT password FROM members WHERE username='$user'") or die ("change password failed");
$row = mysql_fetch_assoc($queryget);
$oldpassworddb = $row['password'];
//check passwords
if ($oldpassword==$oldpassworddb)
{
//check two new passwords
if ($newpassword==$repeatnewpassword)
{
//successs
//change password in db
$querychange = mysql_query("UPDATE members SET password='$newpassword' WHERE username='$user'");
session_destroy();
die("Your password has been changed. <a href='login.php'> Login Again</a>");
}
else
die("New password doesn't match!");
}else
die("Old password doesn't match!");
}
else
{
echo"
<form action='change_password.php' method='POST'>
Old Password: <input type='text' name='oldpassword'><p>
New Password: <input type='password' name='newpassword'><p>
Repeat New Password: <input type='password' name='repeatnewpassword'><p>
<input type='submit' name ='submit' value='submit'>
</form>
";
}
}else
die ("You must be logged in to change your password");
?>

Answer 1

Try with this code:
<?php
session_start();
$user = $_SESSION['username'];
if (isset($_SESSION['username']))
{
//user is logged in
if (isset($_POST['submit']))
{
//start changing password
//check fields
$newpassword = md5($_POST['newpassword']);
$repeatnewpassword = md5($_POST['repeatnewpassword']);
//check password against db
include_once "connect_to_mysql.php";
$queryget = mysql_query("SELECT password FROM members WHERE username='$user'") or die ("change password failed");
$row = mysql_fetch_assoc($queryget);
//check two new passwords
if ($newpassword==$repeatnewpassword)
{
//successs
//change password in db
$querychange = mysql_query("UPDATE members SET password='$newpassword' WHERE username='$user'");
session_destroy();
die("Your password has been changed. <a href='login.php'> Login Again</a>");
}
else {
die("New password doesn't match!");
}
else
{
echo"
<form action='change_password.php' method='POST'>
Old Password: <input type='text' name='oldpassword'><p>
New Password: <input type='password' name='newpassword'><p>
Repeat New Password: <input type='password' name='repeatnewpassword'><p>
<input type='submit' name ='submit' value='submit'>
</form>
";
}
}else
die ("You must be logged in to change your password");
?>

Answer 2

Remove old password field from your form as well remove if condition which checks your old password in database with old password to form
here is code you may need
<?php
session_start();
$user = $_SESSION['username'];
if (isset($_SESSION['username']))
{
//user is logged in
if (isset($_POST['submit']))
{
//start changing password
//check fields
$newpassword = md5($_POST['newpassword']);
$repeatnewpassword = md5($_POST['repeatnewpassword']);
//check password against db
include_once "connect_to_mysql.php";
$queryget = mysql_query("SELECT password FROM members WHERE username='$user'") or die ("change password failed");
$row = mysql_fetch_assoc($queryget);
$oldpassworddb = $row['password'];
//check two new passwords
if ($newpassword==$repeatnewpassword)
{
//successs
//change password in db
$querychange = mysql_query("UPDATE members SET password='$newpassword' WHERE username='$user'");
session_destroy();
die("Your password has been changed. <a href='login.php'> Login Again</a>");
}
else
die("New password doesn't match!");
}
else
{
echo"
<form action='change_password.php' method='POST'>
New Password: <input type='password' name='newpassword'><p>
Repeat New Password: <input type='password' name='repeatnewpassword'><p>
<input type='submit' name ='submit' value='submit'>
</form>
";
}
}else
die ("You must be logged in to change your password");
?>