Check out this function definition with the consistent formatting:
function changePassword($username,$currentpassword,$newpassword,$newpassword2)
{
global $seed;
if (!valid_username($username) || !user_exists($username))
{
return false;
}
if (! valid_password($newpassword) || ($newpassword != $newpassword2))
{
return false;
}
//} Extra brace
// we get the current password from the database
$query = sprintf("SELECT ... FROM ... WHERE username= '%s' LIMIT 1",
mysql_escape_string($username));
$result = mysql_query($query);
$row= mysql_fetch_row($result);
// compare it with the password the user entered, if they don't match, we return false, he needs to enter the correct password.
if ($row[0] != sha1($currentpassword.$seed))
{
return false;
}
// now we update the password in the database
$query = sprintf("update ... set ... = '%s' where ... = '%s'",
mysql_escape_string(sha1($newpassword.$seed)), mysql_escape_string($username));
if (mysql_query($query))
{
return true;
}
else
{
return false;
}
return false;
}
See how much easier it is to tell where the closing braces are for each associated opening? This makes it much easier to tell when you miss one (or in this case add an extra). Also note that an update query returns true or false, so you could change the end of the function to be:
function changePassword($username,$currentpassword,$newpassword,$newpassword2)
{
global $seed;
if (!valid_username($username) || !user_exists($username))
{
return false;
}
if (! valid_password($newpassword) || ($newpassword != $newpassword2))
{
return false;
}
//} Extra brace
// we get the current password from the database
$query = sprintf("SELECT ... FROM ... WHERE username= '%s' LIMIT 1",
mysql_escape_string($username));
$result = mysql_query($query);
$row= mysql_fetch_row($result);
// compare it with the password the user entered, if they don't match, we return false, he needs to enter the correct password.
if ($row[0] != sha1($currentpassword.$seed))
{
return false;
}
// now we update the password in the database
$query = sprintf("update ... set ... = '%s' where ... = '%s'",
mysql_escape_string(sha1($newpassword.$seed)), mysql_escape_string($username));
return mysql_query($query);
}