-4

I have the following code to update my database (change a password). I know the method I'm using is a bit old school but the website is only being used as a test. I've copied the code from another website and have used it before to carry out INSERT query's (not UPDATE).

For some reason the database is not updating and I am receiving the following error message:

Array Warning: Cannot modify header information - headers already sent by (output started at /home/content/47/11368447/html/CCC/changepassword.php:64) in /home/content/47/11368447/html/CCC/changepassword.php on line 75 Redirecting to stafflist.php

I'm new to php and appreciate all the help I can get.

Here's the code:

// First we execute our common code to connection to the database and start the session 
require("common.php"); 

  $id = $_GET['id'];

// This if statement checks to determine whether the registration form has been submitted 
// If it has, then the registration code is run, otherwise the form is displayed 
if(!empty($_POST)) 
{  
    // Ensure that the user has entered a non-empty password 
    if(empty($_POST['password'])) 
    { 
        die("Please enter a password."); 
    } 

    // Ensure that the user has entered a non-empty username 
    if(empty($_POST['confirmpassword'])) 
    { 
        // Note that die() is generally a terrible way of handling user errors 
        // like this.  It is much better to display the error with the form 
        // and allow the user to correct their mistake.  However, that is an 
        // exercise for you to implement yourself. 
        die("Please confirm your password."); 
    } 

     if ($_POST['password'] == $_POST['confirmpassword']) {

    // An INSERT query is used to add new rows to a database table. 
    // Again, we are using special tokens (technically called parameters) to 
    // protect against SQL injection attacks. 
    $query = "UPDATE Staff SET password=:password, salt=:salt WHERE id=:id"; 

    // A salt is randomly generated here to protect again brute force attacks 
    // and rainbow table attacks.  The following statement generates a hex 
    // representation of an 8 byte salt.  Representing this in hex provides 
    // no additional security, but makes it easier for humans to read. 
    $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); 

    // This hashes the password with the salt so that it can be stored securely 
    // in your database.  The output of this next statement is a 64 byte hex 
    // string representing the 32 byte sha256 hash of the password.  The original 
    // password cannot be recovered from the hash. 
    $password = hash('sha256', $_POST['password'] . $salt); 

    // Next we hash the hash value 65536 more times.  The purpose of this is to 
    // protect against brute force attacks.  Now an attacker must compute the hash 65537 
    // times for each guess they make against a password, whereas if the password 
    // were hashed only once the attacker would have been able to make 65537 different  
    // guesses in the same amount of time instead of only one. 
    for($round = 0; $round < 65536; $round++) 
    { 
        $password = hash('sha256', $password . $salt); 
    }  

    try 
    { 
        // Execute the query to create the user 
        $stmt = $db->prepare($query); 
        $stmt->execute(array(
        ':password' => $password,
        ':salt' => $salt,
        ':id' => $id)); 
        echo $db->errorInfo();

    } 
    catch(PDOException $ex) 
    { 
        // Note: On a production website, you should not output $ex->getMessage(). 
        // It may provide an attacker with helpful information about your code.  
        die("Failed to run query: " . $ex->getMessage()); 
    } 

    // This redirects the user back to the login page after they register 
    header("Location: stafflist.php");

     // Calling die or exit after performing a redirect using the header function 
    // is critical.  The rest of your PHP script will continue to execute and 
    // will be sent to the user if you do not die or exit. 
    die("Redirecting to stafflist.php"); 

}

die("Passwords do not match.");  
}

Thanks, Joe

JoeMorgan
  • 135
  • 1
  • 12
  • 1
    This was asked N times, see *Related* column -------------------------------> – brasofilo Sep 24 '13 at 11:48
  • Not sure if you're meant to reference the pdo variables in the `execute()` *with* the colons prepended. I think you only need to do so in the query. – Novocaine Sep 24 '13 at 11:51

3 Answers3

1

This error means you are outputting something before working with the headers or session class.

Double check your code for space characters or other output to make sure you don't echo anything before this line:

header("Location: stafflist.php");
Sergey Telshevsky
  • 12,077
  • 6
  • 55
  • 78
0

I think one of your die() is getting triggered before the control reaches the line header("Location: stafflist.php");

And most likely, the die() is writing out something to the response. You can't set header values after some response has been written out.

Litmus
  • 10,558
  • 6
  • 29
  • 44
0

Verify that you are using either ANSI encoding or UTF-8 without BOM, as using UTF-8 (with BOM) will send characters at the very beginning of your file, which will mess up your header.

Birb
  • 866
  • 10
  • 23