let user change their own password? - php

Question

I am just starting to learn php and sql so please go easy on me, i know i'm going to be wrong in certain places. I am trying to allow a user to login and be able to change their password. I have made an attempt of a script which i believe should work, but i guess i'm doing something wrong as it will just link to the php function page and not change the password at all. Here's my script:
HTML form:
<form method="POST" action="includes/changepassword.php">
<p><input type="password" name="oldpasswd" id="oldpasswd" maxlength="30" placeholder="Old Password"></p>
<p><input type="password" name="newpsswd1" id="newpsswd1" maxlength="30" placeholder="New Password"></p>
<p><input type="password" name="newpsswd2" id="newpsswd2"maxlength="30" placeholder="Confirm Password"></p>
<input type="submit" name="submit" id="submit" value="change password">
changepassword.php file:
<?php
require_once("session.php");
require_once("functions.php");
require('_config/connection.php');
function changepassword ($oldpasswd, $newpasswd1, $newpasswd2) {
/*
* RETURNS
* 0 - if password changed
* 1 - if new passwords are not equal
* 2 - if user authentification problems
*/
$oldpasswd = ($_POST['oldpasswd']);
$newpasswd1 = ($_POST['newpasswd1']);
$newpasswd1 = ($_POST['newpasswd2']);
if ($newpasswd1 != $newpasswd2) {
return 1;
}
//check user logged in changes OWN passwd
$sql = "SELECT password FROM ptb_users WHERE id = ".$_SESSION['user_id'];
$result = mysql_query($sql)or die('User not found: ' . mysql_error());
if (md5($oldpasswd)==$result) {
//Encrypt $emailpassword in MD5 format for the database
$md5_np=md5($newpasswd1);
// Make a safe query
$query = sprintf("UPDATE `ptb_users` SET `password` = '%s'
WHERE `id` = ".$_SESSION['user_id'],
mysql_real_escape_string($md5_np));
mysql_query($query)or die('Could not update password: ' . mysql_error());
return 0;
} else {
return 2;
}
}
?>
What have I done wrong?

Answer 1

it will just link to the php function page and not change the password at all
You told the HTML form to do exactly that: <form method="POST" action="includes/changepassword.php">. But on the other hand, you never call your function.

Answer 2

You need to call the function in order to process the change password. Add this to the bottom of your file just before the ?>
echo changepassword($_POST['oldpasswd'], $_POST['newpasswd1'], $_POST['newpasswd2']);
You can also remove the $_POST assignments within the function as you're passing those in as parameters.

Answer 3

As poke mentioned you will need to call the function in order to update the password.
I think I found another problem in the following code:
//check user logged in changes OWN passwd
$sql = "SELECT password FROM ptb_users WHERE id = ".$_SESSION['user_id'];
$result = mysql_query($sql)or die('User not found: ' . mysql_error());
if (md5($oldpasswd)==$result) {
You are directly using the result of the mysql_query() function which actually returns as a resource and not a value.
You will need to update your code to this:
//check user logged in changes OWN passwd
$sql = "SELECT password FROM ptb_users WHERE id = ".$_SESSION['user_id'];
$result = mysql_query($sql)or die('User not found: ' . mysql_error());
$row=mysql_fetch_assoc($result);
if (md5($oldpasswd)==$row['password']) {
See this function- mysql_fetch_assoc().

Answer 4

Look for a tutorial about form handling, after a bit of searching if stumbled over this form tutorial, it looks easy to understand. You will see, that most forms call themself.
formchangepassword.html
<form action="formchangepassword.html" method="post">
At the begin of the form there is usually some code, that decides if the form was called with post (after pressing a button), or if it was called with get. In this code you can call the function you wrote in your CHANGEPASSWORD.PHP file. This file is just a library, it contains functions, you can call this function but they do not run themselfes, they have to be called.
<?php
require_once("CHANGEPASSWORD.PHP");
if(count($_POST) > 0)
{
// button was clicked, do what is necessary
changepassword(...);
...
}
?>
<form action="formchangepassword.html" method="post">
...
</form>

Answer 5

The name of your form fields doesn't match what's listed in changepassword.php . You are missing an "a" in what should be "newpasswd1" and "newpasswd2" -- name=newpsswd1 should be newpasswd1 and so on.
Also you have "newpasswd1" listed twice
$oldpasswd = ($_POST['oldpasswd']);
$newpasswd**1** = ($_POST['newpasswd1']);
$newpasswd**1** = ($_POST['newpasswd2']);
...I think you probably meant this...
$oldpasswd = ($_POST['oldpasswd']);
$newpasswd**1** = ($_POST['newpasswd1']);
$newpasswd**2** = ($_POST['newpasswd2']);
I also incorporated the changes suggested by Pastor Bones and Abhishek Bhatia and it works fine now. (Also I a close form tag to the HTML)
Here's what the whole thing should look (as modified for my site):
HTML FORM
<form method="POST" action="changepassword.php">
<p><input type="password" name="oldpasswd" id="oldpasswd" maxlength="30" placeholder="Old Password"></p>
<p><input type="password" name="newpasswd1" id="newpasswd1" maxlength="30" placeholder="New Password"></p>
<p><input type="password" name="newpasswd2" id="newpasswd2"maxlength="30" placeholder="Confirm Password"></p>
<input type="submit" name="submit" id="submit" value="change password">
</form>
changepassword.php
function changepassword ($oldpasswd, $newpasswd1, $newpasswd2)
{
$oldpasswd = ($_POST['oldpasswd']);
$newpasswd1 = ($_POST['newpasswd1']);
$newpasswd2 = ($_POST['newpasswd2']);
if ($newpasswd1 != $newpasswd2)
{
return 1;
}
$sql = "SELECT Password FROM users WHERE UserID = ".$_SESSION['UserId'];
$result = mysql_query($sql)or die('User not found: ' . mysql_error());
$row=mysql_fetch_assoc($result);
if (md5($oldpasswd)==$row['Password'])
{
$md5_np=md5($newpasswd1);
$query = sprintf("UPDATE `users` SET `Password` = '%s' WHERE `UserID` ".$_SESSION['UserId'],mysql_real_escape_string($md5_np));
mysql_query($query)or die('Could not update password: ' . mysql_error());
return 0;
}
else
{
return 2;
}
}
echo changepassword($_POST['oldpasswd'], $_POST['newpasswd1'], $_POST['newpasswd2']);