Member Avatar for sidra 100

can any1 tell me wats wrong in my code i cannt change my password using this code

<?php
$con=mysql_connect("localhost","root","");
 
	mysql_select_db("pras2");
if (!$con)

  {

  die('Could not connect: ' . mysql_error());

  }

   

$username = $_POST['username']; 

$password = $_POST['password'];

$newpassword = $_POST['newpassword'];

$confirmnewpassword = $_POST['confirmnewpassword'];

 

$result = mysql_query("SELECT password FROM customer WHERE username='$username'");

 

    if(!$result){

        echo "The username entered does not exist!";

    }

    else

        if($password != mysql_result($result, 0)){

            echo "Entered an incorrect password";

            }

     

    if($newpassword == $confirmnewpassword){

        $sql = mysql_query("UPDATE customer SET password = '$newpassword' WHERE username = '$username'");      

    }

     

    if(!$sql){

        echo "Congratulations, password successfully changed!";

   }

    else{

        echo "New password and confirm password must be the same!";

    }

     

  ?>
  • 3 Contributors
  • 2 Replies
  • 115 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by mikulucky

Dani AI

Generated

— correctly spotted two immediate issues in the original script (control-flow/bracing and the inverted success test). Beyond those fixes, the code has bigger problems that will either prevent it from working on modern PHP or leave it insecure: it uses deprecated mysql_* calls, it treats stored passwords as plain text, and it tests the query result incorrectly (mysql_query returns false only on SQL error; an empty result set is still a resource). 's quick reply is noted, but the safest route is a small rewrite with modern APIs and password hashing.

Key fixes and checklist

  • Replace mysql_* with PDO or mysqli and use prepared statements to avoid SQL injection.
  • Store passwords with password_hash and verify with password_verify rather than comparing plaintext.
  • For SELECT, fetch a row and test existence (do not rely on the boolean return of mysql_query).
  • Only declare success when the UPDATE affects a row (check affected rows).
  • Use error_reporting(E_ALL) and display errors during development, but disable in production.
  • Ensure the password column can hold hashes (VARCHAR(255)) and use UTF-8 for the connection.

Example (PDO + password hashing)

<?php
$pdo = new PDO('mysql:host=localhost;dbname=pras2;charset=utf8mb4', 'root', '', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
]);

$username = trim($_POST['username'] ?? '');
$current = $_POST['password'] ?? '';
$new = $_POST['newpassword'] ?? '';
$confirm = $_POST['confirmnewpassword'] ?? '';

if ($new !== $confirm) { echo "New passwords do not match."; exit; }

$stmt = $pdo->prepare('SELECT password FROM customer WHERE username = ? LIMIT 1');
$stmt->execute([$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user || !password_verify($current, $user['password'])) { echo "Invalid username or password."; exit; }

$hash = password_hash($new, PASSWORD_DEFAULT);
$update = $pdo->prepare('UPDATE customer SET password = ? WHERE username = ?');
$update->execute([$hash, $username]);

echo $update->rowCount() ? "Password successfully changed." : "No change made.";
?>

Notes and references: use PHP's password functions (password_hash) and prepared statements (PDO prepared statements). For an existing site with plaintext passwords, plan a careful migration (rehash on next login or perform a controlled bulk migration).

Recommended Answers

All 2 Replies

Member Avatar for simplypixie

What exactly is the problem? For example do any of your errors display or does it appear to go trhough but doesn't actually update?
There are actually 2 errors in your code that I can see

else

        if($password != mysql_result($result, 0)){

            echo "Entered an incorrect password";

            }

You are missing the surrounding parenthesis for your else statement

else {

        if($password != mysql_result($result, 0)){

            echo "Entered an incorrect password";

            } }

Then you are saying if not $sql the success, should be the other way around

if($sql){

        echo "Congratulations, password successfully changed!";

   }
Member Avatar for mikulucky

be me to it :D

Edited by mikulucky because: Question was answered already.
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.