Hi All,
I have a "Change Password" script I am battling a bit with. At first I could not get the update to recognise the correct user and now that I have that sorted and the update does insert the new hash value for the correct user I cannot login with the new password nor does the script echo any of the errors associated with incorrect passwords etc if I deliberately leave them out, place incorrect ones etc. In fact if I just leave all the text boxes blank and click submit the var-dump still shows a new hash password being created (but of course then the db does not get updated as the username is blank). I have kept the old hash password and if I insert that manually into the db then I can login. I have searched for something about this on the various forums but am now up the creek.
Is there anyone here that can show where I am going wrong? I am still learning php etc so have adapted a script I was given and changed the general layout etc..Hope someeone can jsut point out where I am going wrong so I can understand what it is I am doing wrong...many thanks..
<?php
include '../dbfunctions.php';
$link = dbConnect();
session_start();
$stid = $_GET['staffref'];
echo $stid;
$staffs = dbGetRows("staff", "id = '".$stid."'");
$staff = mysql_fetch_array($staffs, MYSQL_ASSOC);
echo $staff['username'];
echo $staff['password'];
if (isset($_POST['submit'])) {
$username = $_POST['username'];
$oldpassword = $_POST['oldpassword'];
$newpassword = $_POST['newpassword'];
$confirmnewpassword = $_POST['confirmnewpassword'];
}
if ($staff) {
// Check if Old password is the correct
if ($oldpassword != $password){
echo "Your old password is incorrect!";
}
}
//Check if New password if blank
if (!$newpassword){
echo "The New Password field was not filled!";
}
// Check if New password is confirmed
if ($newpassword != $confirmpassword){
echo "The \"New Password\" and \"Confirm New Password\" fields do not match, please re-enter!";
}
else
// If everything is ok, modify the record
$query = sprintf("UPDATE staff SET password = '%s' WHERE username = '".$_POST['username']."'",md5(mysql_real_escape_string($newpassword).$salt),mysql_real_escape_string($username)
);
var_dump($query);
mysql_query($query) or die('Error : ' . mysql_error());
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Password Administration</title>
<link href="../bb.css" rel="stylesheet" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body bgcolor="#FFF4DC">
<table width="60%" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td width="32"><img src="../images/admin_03.gif"></td>
<td width="0*" bgcolor="#FFFFFF" background="../images/admin_04.gif" style="background-repeat: repeat-x;"> </td>
<td width="35"><img src="../images/admin_07.gif" width="32" height="33"></td>
</tr>
<tr>
<td bgcolor="#FFFFFF" background="../images/admin_15.gif" style="background-repeat: repeat-y;"></td>
<td bgcolor="#FFFFFF"><table width="100%" border="0" cellspacing="0" cellpadding="0" style="margin-left: 10px; margin-right: 10px">
<tr> <td>
<a href="javascript:;" onClick="window.close(); opener.location.reload(true)">[CLOSE WINDOW]</a><br> <br>
</td>
<td><b><font size="3">CHANGE PASSWORD</font></b><br>
<br>
<form name="form1" method="post" action="changepassword.php">
<table width="321" border="0" bgcolor="#FAFAFA" cellspacing="5" cellpadding="0" style="border: 1px solid #BBBBBB;">
<tr>
<td><b>Username:</b></td>
<td><input type="text" name="username" ></td>
</tr>
<tr>
<td width="154"><b>Old Password:</b></td>
<td width="167"><input type="password" name="oldpassword"></td>
</tr>
<tr>
<td><b>New Password</b></td>
<td><input type="password" name="newpassword"> </td>
</tr>
<tr>
<td><b>New Password Again</b></td>
<td><input type="password" name="confirmnewpassword"></td>
</tr>
<tr>
<td> </td>
<td align="right"> <input type="submit" name="Submit" value="Submit"> </td>
</tr>
</table>
</form>
</td>
</tr>
</table></td>
<td bgcolor="#FFFFFF" align="right" background="../images/admin_14.gif" style="background-position: right; background-repeat: repeat-y;"></td>
</tr>
<tr>
<td><img src="../images/admin_21.gif" width="32" height="33"></td>
<td bgcolor="#FFFFFF" background="../images/admin_23.gif" style="background-position: bottom; background-repeat: repeat-x;"></td>
<td><img src="../images/admin_20.gif" width="32" height="33"></td>
</tr>
</table>
<br>
<br>
<br>
<br>
</body>
</html>