changing user password in mysql, check old password matches and make new password compulsory?

Question

can someone please help, i have this change password script that allows a user to change their password.

at the moment it lets the user change their password despite what they put in the old password box. can someone please show me how i can get it to check that the old password matches with that stored in 'ptb_users.password' ?

Also it currently lets a user set their password to nothing, is there a way i can make the enw password and confirm password fields compulsory?

Thanks.

<?php
require_once("session.php"); 
require_once("functions.php");
require('_config/connection.php');
?>
<?php 

session_start();

include '_config/connection.php'; 


$password = md5($_POST['password']);
$newpassword = md5($_POST['newpassword']);

$result = mysql_query("SELECT password FROM ptb_users WHERE id=".$_SESSION['user_id']." AND password = '".$password."'");
if(!$result) 
{ 
echo "The username you entered does not exist or old password didn't match"; 
} 
else
{
     $sql=mysql_query("UPDATE ptb_users SET password='$newpassword' WHERE id=".$_SESSION['user_id'].""); 
}
if($sql) 
{ 
    echo "Thank You. Your Password has been successfully changed."; 
}
?>

MD5 is *broken* for hashing passwords. Please use a more secure password-hashing function. — Waleed Khan, Feb 09 '13 at 01:57

score 0 · Answer 1 · answered Feb 09 '13 at 04:28

0

For retrieving passwords and checking the match against query, you may use the answer suggested by @hexacyanide.

To get the password field from mysql to update password you need to change

mysql_query("UPDATE ptb_users SET password='$newpassword'
to
mysql_query("UPDATE ptb_users SET password='".$newpassword."'

answered Feb 09 '13 at 04:28

Javier Brooklyn

624
3
9
25

thanks but updating the password is working fine, it just wont check the old password, and im not sure how to do this. – Dave Smith Feb 09 '13 at 04:32
Try `echo`ing the variables $password, and $oldpassword = $result['password']; and check how they differ. Or does $result['password'] give a blank value? – Javier Brooklyn Feb 09 '13 at 04:36
Else the last variable to look for errors would be your - $_SESSION['user_id'] – Javier Brooklyn Feb 09 '13 at 04:39

changing user password in mysql, check old password matches and make new password compulsory?

1 Answers1