In php: change password is not updating in database

Question

I have a task for registration form where I want to change the password. There are no errors, it is changing when I am doing variable dump (var_dump). Also, it is showing changed password on front-end but not updating in database. I have tried a lot to update in database but what am I doing wrong? I think query problem. Can anybody point in the right direction to solve my query problem? Thanks in advance...

<?php
require_once ( "./connect.php" );
if ( !empty ( $_POST ['submit'] ) ) {  
    $current_password = md5 ( $_POST [ 'current_password' ] );
    $new_password = md5 ( $_POST [ 'new_password' ] );
    $confirm_password = md5 ( $_POST [ 'confirm_password' ] );
    $sql = ( "SELECT `password` FROM `user` WHERE `username` = '$confirm_password' " ) or die ( "Query didn't work" );
    $result = $db->query($sql);
    $current_password = $result [ 'password' ];
    if ( $current_password == $current_password ) {
        if ( $new_password == $confirm_password ) {             
            $sql = ( "update `user` SET `password`='{$confirm_password}' WHERE user_id = $_COOKIE[id]" );
            echo 'success!'; 
        } else {
            echo 'New passwords doesn t match!';
        }
    }
} else {
    echo 'Current password doesn t match';
}
?>
<form action = "" method = "POST">
Current-Password: <input type = "password" name = "current_password" value = ""/><br><br>
New-Password: <input type = "password" name = "new_password" value = ""/><br><br>
Confirm-Password: <input type = "password" name = "confirm_password" value = ""/><br><br>
<input type="submit" name="submit" value="change password"/>
</form>

// connect.php file
<?php
$db = new mysqli("localhost", "root", "", "registration");
if($db->connect_error){
exit("cannot connect to database");
}
?>

`password` = '$confirm_password' ? instead of `username` = '$confirm_password' in `WHERE` clause because your username will and should not be equal to your password — guradio, Oct 23 '18 at 06:53
A tip. don't use md5 [https://security.stackexchange.com/questions/19906/is-md5-considered-insecure](https://security.stackexchange.com/questions/19906/is-md5-considered-insecure) — Sfili_81, Oct 23 '18 at 06:55
Have a read of [How to use password_hash](https://stackoverflow.com/questions/30279321/how-to-use-password-hash) — Nigel Ren, Oct 23 '18 at 06:56
`if ( $current_password == $current_password ) {` this doesnt check anything And you dont execute your update statement add `$result = $db->query($sql);` before `echo 'success!';` line — Jacek Rosłan, Oct 23 '18 at 06:57
my advice is that you delete this "code", read up on php security practices and re-write based on that — Rotimi, Oct 23 '18 at 07:10
I agree with @Akintunde-Rotimi there are so many error each user can spot them. I suggest the same thing — guradio, Oct 23 '18 at 07:14

score 0 · Accepted Answer · answered Oct 23 '18 at 06:58

0

Run the query after $sql

$sql = ( "update `user` SET `password`='{$confirm_password}' WHERE user_id = $_COOKIE[id]" );
$db->query($sql); //this is missing that why no data update

answered Oct 23 '18 at 06:58

Bhargav Chudasama

6,928
5
21
39

score 0 · Answer 2 · answered Oct 23 '18 at 07:20

Hi please check this

<?php
require_once ( "./connect.php" );
if ( !empty ( $_POST ['submit'] ) ) {
    $current_password = md5 ( $_POST [ 'current_password' ] );
    $new_password = md5 ( $_POST [ 'new_password' ] );
    $confirm_password = md5 ( $_POST [ 'confirm_password' ] );
    $sql = ( "SELECT `password` FROM `user` WHERE `username` = 'shan' " ) or die ( "Query didn't work" );
    $result = $db->query($sql);

    if ($result->num_rows > 0) {
    // output data of each row
     while($row = $result->fetch_assoc()) {
        $current_password1 = $row["password"];
     }
    }
    if ( $current_password == $current_password1 ) {
        if ( $new_password == $confirm_password ) {
            $sql = ( "update `user` SET `password`='{$confirm_password}' WHERE user_id = 1" );
            $result = $db->query($sql);
            echo 'success!';
        } else {
            echo 'New passwords doesn t match!';
        }
    }
} else {
    echo 'Current password doesn t match';
}
?>
<form action = "" method = "POST">
Current-Password: <input type = "password" name = "current_password" value = ""/><br><br>
New-Password: <input type = "password" name = "new_password" value = ""/><br><br>
Confirm-Password: <input type = "password" name = "confirm_password" value = ""/><br><br>
<input type="submit" name="submit" value="change password"/>
</form>

Some correction are made in your code are following:

make correction in username (currently your using password as username).
use while loop to fetch password form query result.
compare entered current password with db password (use different variables for both).
set cookie before use else accept user id from user (you're using $_COOKIE['user_id'].
execute update query on db.

In php: change password is not updating in database

2 Answers2