I've prettied up the code a bit (so it's easier to read) and found a few things:
$newpw2 = mysqli_real_escape_string($dbc, trim($_POST['newpw2']))
is missing a semicolon.
I changed the if(empty() || empty()) if(!empty() || !empty()) to: if(empty() || empty()) else {} because it logically makes more sense. I also added an elseif() to that to check that $newpw1 and $newpw2 were the same (something you were missing).
I stored the result of the update statement in a variable and checked it's contents prior to the header() call, rather than just assuming that it succeeded.
Finally I added a check to see if the headers were already sent prior to sending the header() to redirect. If they were, then we write a meta tag refresh, otherwise we use header.
My guess is that you've got something wrong in a query somewhere which is causing a failure but not a complete die() condition (e.g. the query is run; however, the query itself fails for a reason like syntax or something).
The only other thing I'd suggest is instead of updating based on member email, I'd pull back the member ID from the original select you run to see if the user is valid, and use that in the update. E.g. "select member_id FROm whitealbumreg.members..." then "Update members SET whatever=whatever WHERE member_id={$member_id}". That way you know you're limited to 1 row, and it's 100% the correct row.
<?php
require_once('startsession.php');
require_once('connect.php');
$member_id = $_SESSION['member_id'];
$member_name = $_SESSION['member_name'];
// Ensure fields are filled out.
if (isset($_POST['submit']))
{
$dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME)
or die('Error connecting to MySQL server');
$member_email = mysqli_real_escape_string($dbc, trim($_POST['member_email']));
$member_password = mysqli_real_escape_string($dbc, trim($_POST['member_password']));
$newpw1 = mysqli_real_escape_string($dbc, trim($_POST['newpw1']));
$newpw2 = mysqli_real_escape_string($dbc, trim($_POST['newpw2']));
if (empty($member_email) || empty($member_password))
{
/* We know $member_name is blank*/
echo '<h2><font color="red">Oops! You forgot to include your current password.</font></h2><br />';
}
elseif (strcmp($newpw1, $newpw2) !== 0)
{
/* We know $newpw1 is not the same as $newpw2 */
echo '<h2><font color="red">Oops! Your new passwords don\'t match.</font></h2><br />';
}
else (!empty($member_email) || !empty($member_password))
{
$query = "SELECT member_email, member_password
FROM whitealbumreg.members
WHERE member_email='{$_POST[member_email]}'
AND member_password=SHA1('{$_POST[member_password]}')";
$result = mysqli_query($dbc, $query);
$num_rows = mysqli_num_rows($result);
if ($num_rows == 1)
{
$query2 = "UPDATE members
SET member_password=SHA1('{$_POST[newpw1]}')
WHERE member_email = '{$_POST[member_email]}'
LIMIT 1";
mysqli_query($dbc, $query2)
or die('Error querying database.');
if(mysqli_affected_rows($dbc) > 0)
{
//When Successful do this:
$home_url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . 'index.php';
if(!headers_sent())
{
header('Location: ' . $home_url);
exit;
}
else
{
echo '<meta http-equiv="refresh" content="10;'.$home_url.'" />';
}
}
else
{
echo '<h2><font color="red">We had some trouble changing your password. Please try again.</font></h2><br />';
}
}
else
{
if ($num_rows < 1)
{
echo ('<h3><font color="red">It looks like we can\'t find a match for your password. Please try again.</font></h3>');
}
}
}
}
?>
The only other thing to look out for is echo statements or white-space in your required files (startsession.php and connect.php).
