Member Avatar for iyk

I have the below codes working for only the first user. The challenge here is; only the first user can change password, new users can't.

Error Messaage "Old password is wrong"

I am hoping that someone can assist me in correcting what I have already done to make it work.

<?php   
error_reporting(E_ERROR | E_PARSE);
session_start();
$ac = $_SESSION['account_number'];

$link=mysqli_connect('localhost','root','');
  if(!$link)
    {
      die('Connection failed: '.mysql_error());
    }
     mysqli_select_db($link,'login_portal');
  $row=mysqli_query($link, "select user_name from Login where account_number = '$ac' ");
  $row1=mysqli_fetch_array($row);
  ?>
<!DOCTYPE html>
<html>
<head>
<title>Change Password</title>
<link href="styles.css" rel="stylesheet" type="text/css">
</head>
<body>
  <table align="center" cellpadding="0" cellspacing="1" class="graybox">
      <tbody>

<td width="800" valign="top" class="contentArea">
    <table width="100%" border="0" cellspacing="0" cellpadding="20">
        <tbody><tr>
          <td>
<p>&nbsp;</p>
  <form action="chang_pass_script.php" method="post">
    <table border="0" cellpadding="5" cellspacing="1" class="entryTable">
      <tbody>
        <tr>
        <td width="160" height="30" class="label"><font size="2">User Name</font></td>
        <td height="30" class="content">    
      <input type="text" size="40" name="username" value="<? echo $row1['user_name'];?>">
    </td>
      </tr>
      <tr>
        <td width="160" height="30" class="label"><font size="2">Number
          <input type="text" size="40" name="account" value="<? echo $ac;?>" readonly ></td>
      </tr>
      <tr>
        <td width="160" height="30" class="label"><font size="2">Current Password</font></td>
        <td height="30" class="content">
    <span> 
              <input name="oldPass" type="password"  size="30" required><br>
    </span>
    </td>
      </tr>
      <tr>
        <td width="160" height="30" class="label"><font size="2">New Password</font></td>
        <td height="30" class="content">
    <span> 
              <input name="nPass" type="password"  size="30" required><br>
    </span>
    </td>
      </tr>

    <tr>
        <td width="160" height="30" class="label"><font size="2">Confirm New Password</font></td>
        <td height="30" class="content">
    <span> 
              <input name="cPass" type="password" size="30" required><br>
      </span>
    </td>
      </tr>
      <tr>
        <td height="30">&nbsp;</td>
        <td height="30"><input type="Submit" name="Submit" value="CHANGE PASSWORD"></td>
      </tr>
    </tbody></table>
  </form>
  </td>
        </tr>
        </tbody></table>
  </td>
  </tr>
  <tr>
    </tr>
</tbody></table>
  </body>
</html>
<?php
  //session_destroy();
?>

Chang_pass_script.php

<?php
$link=mysqli_connect('localhost','root','');
  if(!$link)
    {
      die('Connection failed: '.mysql_error());
    }
     mysqli_select_db($link,'login_portal');

 if(isset($_POST['Submit']))
    {
    $ac = $_POST['account'];

    $old_pass=$_POST['oldPass'];

    $new_pass=$_POST['nPass'];

    $re_pass=$_POST['cPass'];

    $chg_pwd=mysqli_query($link, "select account_number,password from Login");

    $chg_pwd1=mysqli_fetch_array($chg_pwd);

    $data_pwd=$chg_pwd1['password'];

    $data_ac = $chg_pwd1['account_number'];

    if($data_pwd==$old_pass){

    if($new_pass==$re_pass){

      $update_pwd=mysqli_query($link, "update Login set password='$new_pass' where account_number='$data_ac'");

      echo "<script>alert('Update Sucessfully'); window.location='dashboard.php'</script>";
    }
    else{
      echo "<script>alert('Your new and Retype Password is not match'); window.location='chang_pass.php'</script>";
    }
    }
    else
    {
    echo "<script>alert('Your old password is wrong'); window.location='chang_pass.php'</script>";
    }}
?>
  • 2 Contributors
  • 1 Reply
  • 247 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by hericles

Dani AI

Generated

— the behavior you see is exactly what flagged: the change script reads the password of the first row returned from the table, so it will only ever validate (and update) that first account. The fix is to query and update the specific, authenticated account on the server side (do not trust a read-only form field), validate inputs, and use prepared statements and proper password handling.

Key steps to fix and harden your flow:

  • Use session_start() in the change script and take the account number from $_SESSION, not from the form.
  • SELECT the password WHERE account_number = ? (prepared statement) so you retrieve only the current user.
  • Use password_verify()/password_hash() instead of plaintext; if your DB currently stores plaintext, verify it and re-hash on next successful login/change.
  • Use a prepared UPDATE WHERE account_number = ? and check affected rows.
  • Stop suppressing warnings during development (enable full error reporting) and log DB errors for debugging.
  • Remove the client-editable account field (or ignore it on submit) and add CSRF protection and HTTPS for production.

Minimal example (outline) you can adapt:

<?php
session_start();
if (empty($_SESSION['account_number'])) exit('Session expired');

$ac = $_SESSION['account_number'];
if ($_SERVER['REQUEST_METHOD'] !== 'POST') exit;

$old = $_POST['oldPass'] ?? '';
$new = $_POST['nPass'] ?? '';
$confirm = $_POST['cPass'] ?? '';
if ($new !== $confirm) { /* error: new mismatch */ }

$mysqli = new mysqli('localhost','root','','login_portal');
$stmt = $mysqli->prepare('SELECT password FROM Login WHERE account_number = ? LIMIT 1');
$stmt->bind_param('s',$ac);
$stmt->execute();
$stmt->bind_result($hash);
if ($stmt->fetch()) {
  if (password_verify($old,$hash) || $old === $hash) {
    $newhash = password_hash($new,PASSWORD_DEFAULT);
    $up = $mysqli->prepare('UPDATE Login SET password = ? WHERE account_number = ?');
    $up->bind_param('ss',$newhash,$ac);
    $up->execute();
    // success
  } else { /* old wrong */ }
} else { /* account not found */ }

Notes: ensure the password column can hold a hash (VARCHAR(255)), test with a new user after the above changes, and migrate plaintext passwords carefully (rehash on next successful authentication). This addresses the immediate bug and moves you toward safer password handling.

Member Avatar for hericles

I don't see whre you're selecting the old password for the user, other than this:
$chg_pwd=mysqli_query($link, "select account_number,password from Login");

And that doesn't get the details for the particular user which makes me think you're just retrieving the first user each time.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.