jwalkerman jwalkerman - 1 year ago 67
PHP Question

can't update my password to db

after fetching the password from db to check the password if is matches, but still i can't update my db with the new password.

I will appreciate if someone could help me with this issue. Thanks.

here the html code:

<!DOCTYPE html>
<html lang="en">
<meta charset="UTF-8">
<link rel="stylesheet" type="text/css" href="../css/loginstyle.css" />
<link href="https://fonts.googleapis.com/css?family=Comfortaa" rel="stylesheet">

<?php if(!empty($message)): ?>
<p><?=$message ?></p>
<?php endif; ?>

<h2 class="page-header">Settings</h2>
<p>Please edit the information</p>

<form action="settings.php" method="post">

<input type="text" placeholder="Enter your email" name="email">
<input type="password" placeholder="Enter your current password" name="old_password">
<input type="password" placeholder="Enter your new password" name="new_password">
<input type="password" placeholder="Confirm password" name="confirm_password">

<input type="submit" name="submit" value="reset">


here the php code:


//start the session

require 'database.php';


if (isset($_POST['submit'])){

//check field
$oldpassword = $_POST['old_password'];
$newpassword = $_POST['new_password'];
$confirmpassword = $_POST['confirm_password'];

$message = '';

//query to get password
$query = $conn->prepare('SELECT password FROM users WHERE email = :email') or die("Query did'nt work");
$query->bindParam(':email', $_POST['email']);
$results = $query->fetch(PDO::FETCH_ASSOC);

$oldpassworddb = $results['password'];

//Check password
if(count($results) > 0 && password_verify($oldpassword, $results['password']))

//check two new password
//change password in database
//echo "Success";

//enter new user and database
$sql = ('UPDATE users SET password="$newpassword" WHERE email = :email');
$query = $conn->prepare($sql);

$query->bindParam(':email', $_POST['email']);
$newpassword = password_hash($newpassword, PASSWORD_BCRYPT);


die("Your password has been changed. <a href='index.php'>Return</a>to the main page.");

die("New password don't match");
die("old password doesn't match");



Answer Source

You never executed your prepared statement so the query would have never been run. You also didn't setup the :password parameter in your statement.

        // Setup :password as a parameter, don't place variable in your statements
        $sql = ('UPDATE users SET password=:password WHERE email = :email');
        $query = $conn->prepare($sql);

        $query->bindParam(':email', $_POST['email']);
        $newpassword = password_hash($newpassword, PASSWORD_BCRYPT);

        // Execute statement

Another thing that jumped out at me though is the order of your password hashing. Even though you bind $newpassword as a reference, it isn't very readable to have the hashing occur after the parameter binding. Keep readability in mind.

Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download