Can someone tell me what I have wrong in this password change code?
I have these on 2 different pages...might that be the problem?
//passwordchange.php is first
<?php
echo "<form action='passwordchk.php' method=post><input type=hidden name=todo value=change-password>
<table border='0' cellspacing='0' cellpadding='0' align=center>
<tr bgcolor='#f1f1f1' > <td colspan='2' align='center'><font face='verdana, arial, helvetica' size='2' align='center'> <b>Change Password</b> </font></td> </tr>
<tr bgcolor='#ffffff' > <td ><font face='verdana, arial, helvetica' size='2' align='center'> New Password
</font></td> <td align='center'><font face='verdana, arial, helvetica' size='2' >
<input type ='password' class='bginput' name='password' ></font></td></tr>
<tr bgcolor='#f1f1f1' > <td ><font face='verdana, arial, helvetica' size='2' align='center'> Re-enter New Password
</font></td> <td align='center'><font face='verdana, arial, helvetica' size='2' >
<input type ='password' class='bginput' name='password2' ></font></td></tr>
<tr bgcolor='#ffffff' > <td colspan=2 align=center><input type=submit value='Change Password'><input type=reset value=Reset></font></td></tr>
";
echo "</table>";
echo "<center><font face='Verdana' size='2' ><br>Click <a href=logout.php>here to logout for better security</font></center>";
?>
//passwordchk.php is below
<?
if(isset($todo) and $todo=="change-password"){
$password=mysql_real_escape_string($password);
$status = "OK";
$msg="";
if ( strlen($password) < 3 or strlen($password) > 8 ){
$msg=$msg."Password must be more than 3 char legth and maximum 8 char lenght<BR>";
$status= "NOTOK";}
if ( $password <> $password2 ){
$msg=$msg."Both passwords are not matching<BR>";
$status= "NOTOK";}
if($status<>"OK"){
echo "<font face='Verdana' size='2' color=red>$msg</font><br><center><input type='button' value='Retry' onClick='history.go(-1)'></center>";
}else{
if(mysql_query("update Contact set Password='$password' where ContactID='$session[ContactID]'")){
echo "<font face='Verdana' size='2' ><center>Thanks <br> Your password changed successfully. Please keep changing your password for better security</font></center>";
}
}
}
echo "<center><font face='Verdana' size='2' ><br><br>Click <a href=logout.php>here to logout</a> | <a href=change-password.php>Change Password</a><br></center></font>";
?>