Check and change Password...help?

[moonbrat]

This is giving me a headache...

I have my "update on the fly" form working...BUT my change password code of it--which I rewrote a gazillion times ><.

The following code is giving me:

The password you supplied does not match the password entered in the system. If you have lost your password, please use the lost password link to email a new password.

But the password I entered to check the current password is correct, but it results in the error above.

function check_password( $username, $attempt ) {
$query = "SELECT * FROM `$table` WHERE `username` = '$username' AND " .
      "`oldpw` = '$attempt'";
   $result = mysql_query( $query );
   if( mysql_num_rows( $result ) > 0 )
      return true;
   else
      return false;
}
      // check password
   if( !( check_password( $_POST['username'],
      $_POST['oldpw'] ) ) )
      $message .= '<b>The password you supplied does not match the password entered in the system. If you have lost your password, please use the lost password link to email a new password.</b><br />';

   // check validate password
   if( $_POST['new_pw'] != $_POST['new_pw2'] )
      $message .= '<b>Password validation error. Please check if you have ' .
         'entered the new passwords correctly.</b><br />';

   if( $message != '' ) {
      die( $message );
      }

Any ideas? I'll be a happy girl if I can get this working!

[NogDog]

Is "oldpw" actually the name of the column in the database? (Seems a bit odd to me.)

Also, are the passwords encrypted in any way in the DB (e.g.: via md5() in PHP or the PASSWORD() function in MySQL)?

PS: you might want to debug that query by using this pattern:

$result = mysql_query( $query ) or die("Query failed ($query) ".mysql_error());

[moonbrat]

oh sorry that was pw as the column name...

anyways I put in the $result error line and it returned:

Query failed (SELECT * FROM WHERE username = 'Myname' AND pw = 'Mypass') You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE username = 'Myname' AND pw = 'Mypass'' at line 1

(I haven't md5'd or sha1'd it at the moment, because I'm making sure the password codes works! Myname and Mypass have been edited by me, as it spat out my actual username and password)

which is this line:

function check_password( $username, $attempt ) {
$query = "SELECT * FROM $table WHERE `username` = '$username' AND " .
      "`pw` = '$attempt'";
 $result = mysql_query( $query ) or die("Query failed ($query) ".mysql_error());
   if( mysql_num_rows( $result ) > 0 )
      return true;
   else
      return false;
}

I did have it as $table but then it kept saying wrong table name, which was a "huh?" to me, because $table in my dbconnection file is like this: $table = my_table, so i didn't have to write my_table everywhere.

So, I guess that's the line giving me problems...any ideas how to fix it?

[moonbrat]

A friend told me to try this script:

<?php
function check_current_pw( $username,$oldpw ) 
{ 
   $result = mysql_query( "SELECT username,pw FROM $table WHERE username = '$username' AND pw = '$oldpw'" ); 
   if( mysql_num_rows( $result ) != 1 )
   {
      return false;
   }  

   else {
          return true;
        }        

} 

   if( !( check_current_pw( $_POST['username'],$_POST['oldpw'] ) ) ) 
   { 
      $msg = "<center>The password you entered does not match the password entered in the system.".
             "If you have lost your password, please use the lost password link to have a new". 
             "password emailed to you</center>\n"; 

   $status="NOTOK";
   } 

   elseif( $_POST['new_pw'] != $_POST['new_pw2'] ) 
   { 
   $msg .= "<center>Password validation error.\n".
             "Please check if you have entered the new passwords correctly.</center>\n"; 
   $status= "NOTOK";
   } 

   elseif ( strlen($_POST['new_pw'] ) < 3 or strlen($_POST['new_pw'] ) > 10 ) 
   { 
   $msg .= "<center>Password must be more than 3 to 10 characters in length</center>\n"; 
   $status= "NOTOK";
   } 

   else { 
         if (mysql_query("UPDATE $table SET pw = '$new_pw' WHERE username='$username' AND pw='$oldpw' LIMIT=1"))
         {
          $msg .= "Updates complete";
         } 
         else {
                $msg .= "Updates failed";
              }
        }

   if( $msg != '' ) { 
      die( $msg ); 
      }  

?> 

But it returns:

The password you entered does not match the password entered in the system. If you have lost your password, please use the lost password link to have a new password emailed to you.

I've tried many many scripts, rewrote my code many times and nothing gets rid of that error T_T where am I going wrong?

[DeadlySin3]

I don't know how much help this is going to be but i'm going to toss out a suggestion or two in a moment.

Firstly, I need to add that I just got up after a night of being heavily intoxicated and my brain isn't cooperating with me 😕

Are the $username and $oldpw variables made up names specifically for your check_current_pw() function?

If not, you may need to make them global to the function by declaring them as such.

<?php

function check_current_pw( $username,$oldpw )
{

global $table;
global $username;
global $oldpw;

   $result = mysql_query( "SELECT username,pw FROM $table WHERE username = '$username' AND pw = '$oldpw'" );
   if( mysql_num_rows( $result ) != 1 )
   {
      return false;
   }  

   else {
          return true;
        }        

} 
?>

Couple of examples

<?php

### Variable Scope: Variables defined outside functions are not accessible from within a function by default.

$life = "Even at the worst of times, life is still pretty great.";

function meaningOfLife()
{
echo "The meaning of life is: $life";
}

### Now let's call the function

meaningOfLife();

### prints The meaning of life is: 

/*
 * Notes
 * 

The value of the variable $life is not printed. 
This is because the meaningOfLife() function has 
no access to the global $life variable; $life is 
empty when the function attempts to print it.
 On the whole, this is a good thing. We're saved 
from potential clashes between identically named 
variables, and a function can always demand an 
argument if it needs information from the outside world.

 *
 *
 */

?>

<?php

$life = "Even at the worst of times, life is still pretty great.";

function meaningOfLife()
{
global $life; ### note the global keyword here.
echo "The meaning of life is: $life";
}

### Now let's call the function

meaningOfLife();

### prints The meaning of life is: Even at the worst of times, life is still pretty great.

/*
* Notes
*

The function now refers to the global $life variable that 
was declared outside of the function, and therefore is printed.

You'll need to use the global statement for every function 
that wishes to access a particular global variable.

Caution is required while doing this, however. 
If we manipulate the contents of the variable within the function, 
$life will be changed for the script as a whole - possibly resulting in 
unexpected behaviour.

*
*
*/

?>

I hope this helps you out and if not, sorry .. my intentions were only to help :quiet:

[rincewind456]

I dont agree with DeadlySIn3 that you need to make the vars global, but you do need to pass the variable $table into the function (either the first one you posted or the second one like

<?php 
function check_current_pw( $username,$oldpw, $table )
{
	$result =  "SELECT username,pw FROM $table WHERE username = '$username' AND pw = '$oldpw'" ;
	if( mysql_num_rows( $result ) != 1 )
	{
		return false;
	}
	else {
		return true;
	}
}

if( !( check_current_pw( $_POST['username'],$_POST['oldpw'] ,$table) ) )
{
	$msg = "<center>The password you entered does not match the password entered in the system.".
	"If you have lost your password, please use the lost password link to have a new".
	"password emailed to you</center>\n";

$status="NOTOK";
}

elseif( $_POST['new_pw'] != $_POST['new_pw2'] )
{
	$msg .= "<center>Password validation error.\n".
	"Please check if you have entered the new passwords correctly.</center>\n";
	$status= "NOTOK";
}

elseif ( strlen($_POST['new_pw'] ) < 3 or strlen($_POST['new_pw'] ) > 10 )
{
	$msg .= "<center>Password must be more than 3 to 10 characters in length</center>\n";
	$status= "NOTOK";
}

else {
	if (mysql_query("UPDATE $table SET pw = '$new_pw' WHERE username='$username' AND pw='$oldpw' LIMIT=1"))
	{
		$msg .= "Updates complete";
	}
	else {
		$msg .= "Updates failed";
	}
}

if( $msg != '' ) {
	die( $msg );
}

?>

Also you should NOT be entering user input into your sql queries before they have been checked and sanitized.

[moonbrat]

$username and $oldpw aren't made up... username is a fieldname in my db and $oldpw is meant to be equal with pw filedname in my db. I called it oldpw for check the pw in the database then change it....if required.

as for checked and sanitised, that's what i'm trying to do, but it keeps spitting out the error of passwords not matching...and $table is actually named in my config.php file, i just got lazy and decided to put it there, so if i change my table name, i don't have to change it right through my script....

thanks for the tips though, i'll try them out tomorrow (it's 2am here) and let you know how it went...

[rincewind456]

and $table is actually named in my config.php file

Yes and that's not a problem, BUT you still have to pass the variable $table into the function, the $table inside the function is NOT the same as the $table outside it, you need to look at variable scope. If you look at Deadlysin3's snippets you will see that is what he is illustrating.