Password Changing

[White_Lily]

Hi, I have written some code that once the form prior to this page is completed and submitted should update the users password.

 

Problem im having is that everytime i submit the form for testing, it comes up with a blank page, which is usually a Internal Server Error 500.

 

However i cannot see where the code has gone wrong! Any help appreciated.

 

                            <div class="form_form">
                                <?php
                                
                                    $old    =    $_POST["old"];
                                    $new    =    $_POST["new"];
                                    $conf    =    $_POST["conf"];
                                    
                                    if(!$user && !$pass)
                                    {
                                        echo "You need to be logged in to change any passwords.";
                                    }
                                    else
                                    {
                                        $sql = "SELECT * FROM members WHERE password = '$old'";
                                        $res = mysql_query($sql);
                                        
                                        $row    =    mysql_fetch_assoc($res);
                                        
                                        if($old != $row["password"])
                                        {
                                            die "The old password you provided did not match the database, go back and try again.";
                                        }
                                        
                                        if($new != $conf)
                                        {
                                            die "The new passwords you entered did not match each other, go back and try again.";
                                        }
                                        
                                        $sql = "UPDATE members SET password = '$new' WHERE password = '$old'";
                                        $res = mysql_query($sql);
                                        
                                        if(!$res)
                                        {
                                            die "Could not update your password. Error: ".mysql_error();
                                        }
                                        else
                                        {
                                            echo "You password has been changed.";
                                        }
                                    }
                                    
                                ?>
                            </div>

 

[White_Lily]

Forget this - I managed to find a different way to do it.

[Christian F.]

Even though you have found a different way, I just wanted to point out the actual problem above. Or at least the most obvious one, in case there are more.

After pasting the code into my editor, every line with die got a nice red line under it, due to the missing parentheses. So add those around the parameter, and you should see an improvement.

 

BTW: I also recommend turning on all error reporting in your development environment, as it would have told you about this straight away.