Users account management: changing password

[katuki]

Hey, I am trying to write a script to change a user's password. I am using phpDesigner 2008 and no errors occur. Could you please help me?

 

The code i've got is as follows:

 

<?php
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
include("config.php");
$tbl_name="tbl_users";
if($_POST[newpassword]==$_POST[newpassword2]){
$newpass=$_POST[newpassword];
$myusername=($_SESSION['myusername']);
$sqlid="SELECT id FROM $tbl_name WHERE user='$myusername'";
$id=mysql_query($sqlid);
$sql="UPDATE $tbl_name SET pass='$newpass' WHERE id='$id'";
$result=mysql_query($sql);
echo "Password changed successfully!";
while($rows=mysql_fetch_array($result));
}
else{
	echo "Passwords don't match";
	}
?>

[teynon]

You may have error reporting disabled and it's not telling you about the error in all of your post arrays.

 

IE $_POST[newpassword] should be $_POST['newpassword']. You have this occuring multiple times in your code.

[Kaboom]

Hey, I am trying to write a script to change a user's password. I am using phpDesigner 2008 and no errors occur. Could you please help me?

 

The code i've got is as follows:

 

<?php
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
include("config.php");
$tbl_name="tbl_users";
if($_POST[newpassword]==$_POST[newpassword2]){
$newpass=$_POST[newpassword];
$myusername=($_SESSION['myusername']);
$sqlid="SELECT id FROM $tbl_name WHERE user='$myusername'";
$id=mysql_query($sqlid);
$sql="UPDATE $tbl_name SET pass='$newpass' WHERE id='$id'";
$result=mysql_query($sql);
echo "Password changed successfully!";
while($rows=mysql_fetch_array($result));
}
else{
	echo "Passwords don't match";
	}
?>

 

Hmm ... well here is what I did on my site. I made profile.php then that has a place to change the pass words then when they click change it posts to pass.php which has this code:

 

<?php include "config.php"; include "func.php";

if (isset($_SESSION["user"][1], $_POST["pass"]))
{
$_POST["pass"]=clean($_POST["pass"]); $_POST["pass_"]=clean($_POST["pass_"]); $_POST["pass__"]=clean($_POST["pass__"]);
if ($_SESSION["user"][2]==md5($_POST["pass"]))
  if ($_POST["pass_"]!="")
   if ($_POST["pass_"]==$_POST["pass__"])
    if ($_SESSION["user"][1]!="guest")
    {
     pass($_SESSION["user"][0], md5($_POST["pass_"]));
     $_SESSION["user"][2]=$_POST["pass_"];
    }
    else msg($lang['guestPass']);
   else msg($lang['passNotMatch']);
  else msg($lang['passNull']);
else msg($lang['incorPass']);
}
else msg($lang['insufData']);
?>

 

And that changes it ... pass_ is current, pass__ and pass___ is the new and retype

[katuki]

that bit was actually working.

 

i've got this now:

 

mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
if($_POST['newpassword']==$_POST['newpassword2']){
$newpass=$_POST['newpassword'];
$myusername=($_SESSION['myusername']);
$sqlid="SELECT id FROM $tbl_name WHERE user='$myusername'";
$id=mysql_query($sqlid);
$sql="UPDATE $tbl_name SET pass='$newpass' WHERE id='$id'";
$result=mysql_query($sql);
echo $id;
echo "Password changed successfully!";
while($rows=mysql_fetch_array($result));
}
else{
	echo "Passwords don't match";
	}
?>

 

I added the line: echo $id; to show if the ID i was getting from the database was correct, and it echoes: Resource id #3

So I think the error is where I select the ID from the database.

[mikesta707]

notice on the code you posted you surrounded associative array keys with quotes (usually its single, but it doesn't matter much)

 

when you don't have what should be a string enclosed with quotes, PHP thinks its a global variable. However, if no such global exists, it assumes its a string.

 

what exactly happens when you run this page? no errors? any sql errors? anything at all? blank page?

 

and you get resource id#3 because when you do a sql query, it returns a mysql resource.

 

if you want to fetch the data that you returned you have to use one of the mysql_fetch_XXXX functions

 

 

[katuki]

So how can I do that?

[katuki]

any help?