change/update password error

efimmike

Ihave been trying to update the password of my db unfortunately i have this error (" Parse error: parse error in C:\wamp\www\Mysites\mainfolder\changepassword.php on line 41") which is 'else'

Also, there re no changes in my db eventhough everything works out well with the register.php page.

Finally, my db date does not change no matter how entries i make, it displays 0000-00-00.

Thanks

<?php
session_start ();

$user = $_SESSION['username'];

if($user)
  {
  // user is logged in

  if ($_POST['submit']) // check if user has submitted changepassword form.

  {
  $oldpassword = ($_POST['oldpassword']);
  $newpassword = ($_POST['newpassword']);
  $repeatnewpassword = ($_POST['repeatnewpassword']);

  $connect_db = mysql_connect("localhost","root","********") or die ("Could not connect to db");
  mysql_select_db("phplogin") or die ("Could not connect to phologin");

  $queryget = mysql_query ("SELECT password FROM users WHERE username ='$user' ") or die ("Query did not work");
  $rows = mysql_fetch_assoc ($queryget);

  $oldpassworddb = $row['password'];

  if ($oldpassword == $oldpassworddb)

  {
    if ($newpassword == $newrepeatpassword)

$querychange = mysql_query ("
   UPDATE users SET password='$newpassword' WHERE username='$user'
   ");
   session_destroy () ;
   die (" Your password has been updated. < a href = 'ndex.php' > Return </a> to the main page");


{
echo ("You have successfully changed your password");
}
 else
    die ("New password does not match!");


  }
  else die ("Oldpassword does not match "); 

  }
  else

  echo"

 <table  border='0'>
<tr>
<form action='changepassword.php' method='POST' >
<td>
<table width='108%' border='0' cellpadding='3' cellspacing='1' bgcolor='#FFFFFF'>

<tr>


  <td width='111'>Old Password:</td>
    <td width='6'>:</td>
<td width='267'><input type='text'  name='oldpassword'></td>
</tr>
<tr>
<td>New password:</td>
<td>:</td>
<td><input type='password' name='newpassword' ></td>
</tr>
<tr>
<td>Repeat Password:</td>
<td>:</td>
<td><input type='password' name='repeatnewpassword' ></td>
</tr>

<tr>
<td><input type='submit' name='submit' value='Change Password'></td>
</tr>
</table>
</td>

</form> 

</tr>
</table>

 ";
  }
  else
   die("You must be logged in to change your password!");
?>

bradgrafelman

One problem I see is here:

    if ($newpassword == $newrepeatpassword) 

$querychange = mysql_query (" 
   UPDATE users SET password='$newpassword' WHERE username='$user' 
   "); 
   session_destroy () ; 
   die (" Your password has been updated. < a href = 'ndex.php' > Return </a> to the main page"); 


{

You have a bunch of code before the opening '{' for the if() statement. If that code is to be executed inside the if() statement, then move it inside of the {}'s.

EDIT: Also, you should never place user-supplied data directly into a SQL query. Instead, it must be first sanitized with a function such as [man]mysql_real_escape_string/man.