PHP - Update password page - php

Question

I'm attempting to create a page whereby users are able to change their password, but having trouble with my sql statment, can someone tell me where i'm going wrong? here's the code;
<?php
session_start();
include_once("home_start.php");
require_once("functions.php");
require_once("db_connect.php");
$submit = trim($_POST['submit']);
$username = trim($_POST['username']);
$password = trim($_POST['password']);
$newpassword = trim($_POST['newpassword']);
$repeatnewpassword = trim($_POST['repeatnewpassword']);
if ($username && $password){
session_start();
require_once("db_connect.php");
mysqli_select_db($db_server, $db_database) or die("Couldn't find db");
$username = clean_string($db_server, $username);
$password = clean_string($db_server, $password);
$pass = $_POST[‘password’];
$salt = "$salt1$string$salt2";
$hashpass = md5($pass . $salt);
$query = "SELECT * FROM users WHERE username='$username'";
$result = mysqli_query($db_server, $query);
if($row = mysqli_fetch_array($result)){
$db_username = $row['username'];
$db_password = $row['password'];
if($username==$db_username && salt($password)==$db_password){
$_SESSION['username']=$username;
$_SESSION['logged']="logged";
$querychange = mysql_query("UPDATE users SET password='$newpassword' WHERE
username='$username'") or die(mysql_error());
} else {
$message = "<h1>Incorrect password!</h1>";
}
mysqli_free_result($result);
require_once("db_close.php");
} else {
$message = "<h1>Please enter a valid username/password</h1>";
}
//home_start/end only required if submitting to a separate page
//include_once("home_start.php");
echo $message;
}
?>
<h1>Change Password</h1>
<form id="register" action='password.php' method='POST'>
Username: <input type='text' name='username'><br />
Current Password: <input type='password' name='password'><br />
New Password: <input type='password' name='newpassword'><br />
Repeat New Password: <input type='password' name='repeatnewpassword'><br />
<input type='submit' name='submit' value='Login'> <br />
</form>
<?php include_once("home_close.php"); ?>

Answer 1

When you are comparing the password for verification, I found that you have used salt over your given password. Which means you have already a salted(or encrypted) password in db.
salt($password)==$db_password
But when you are storing the new password in to db, I didn't see you encrypt(or salt) on it.
UPDATE users SET password='$newpassword'...
So, when you are doing login using the new password, you'll never get it matched!