I've checked my logs and tried to throw an error to find out what might be wrong but I'm not sure

<?php 

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

require ("classes/Register.php");
require ("classes/Database.php");

if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
	$getPassword = new Validation();
	
	$activecode = isset($_GET['reset']) ? $_GET['reset'] : '';
	$password = $repassword = "";
	$password = "";
	$post = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);
	$password = $post['password'];
	$repassword = $post['repassword'];
	$errors = array();

	$fields = array(
	'password' => array(        
		'validate' => 'validatePassword',
		'message' => 'Password must be least 8 chars, at least one upper, one lower and one number and a special character',
		'value' => $password
	)
	);

	if(!Validation::validateRepeatPassword($password, $repassword)) 
	{ 
		$errors[] = ["name" => "repassword", "error" => "Passwords must match"]; 
	}
	
	foreach($fields as $key => $value) 
	{
		$validation_result = $getPassword->{$value['validate']}($value['value']);
    	if(!$validation_result) 
		{
    		$errors[] = ['name' => $key, 'error' => $value['message']];
		}
	}

 if(empty($errors))  
    {

		try
		{
			$db = new Database;
		    $setPassword = "
			UPDATE users SET password = :password
			FROM users as u
			INNER JOIN passwordHash AS p
			p.userId = u.userId
			WHERE p.userId = :activecode
			";  
		    $stmt = $db->prepare($setPassword);  
		    $stmt->bindValue(':password', $password);   
		    $stmt->bindValue(':activecode', $activecode);   
		    $stmt->execute();  
		    return (bool) $stmt->rowCount();  
			$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
			if(!$results = $stmt->fetch())  
			{  
				//  id did not match  
				$errors[] = ["name" => "password", "error" => "Password update failed"];  
			}  
			else   
			{  
				$success = ["message" => "Password has been updated"];	
				/*delete here */
			}
		}
			catch (PDOException $e) {
echo 'Connection failed: ' . $e->getMessage();
}
		}
	}
	
header('Content-Type: application/json');
if (empty($errors))
{
	echo json_encode($success);
}
else
{
	echo json_encode(["errors" => $errors]);
}			

(Added [code]...[/code] tags ~ Mod.)

    First: please use [code]...[/code] tags around your code blocks here.

    Second: what do you think is wrong: what is it doing that is not as expected? Have you inspected the resulting values from various function/method calls to make sure they're what they should be? Try things like this to add some inspections into your logs for now:

    	error_log("*** POST:\n".var_export($_POST,1));
    	$post = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);
    	$password = $post['password'];
    	$repassword = $post['repassword'];
    	error_log("*** password: '$password'\n*** repassword: '$repassword'");
    

    (Obviously not something you want to log on the live system, so just do this for debugging. 😉 )

      oh [ code ] not [ php ]

      I'm trying to update the password via url (I'll eventually check the hashed url I generated)

      Hm just copy and paste that or paste it over something?

      My error log was empty

      Well that's a new toy to play with but...

      [05-Feb-2019 16:03:41 UTC] *** POST:
      array (
        'password' => 'Test1234567#',
        'repassword' => 'Test1234567#',
      )
      [05-Feb-2019 16:03:41 UTC] *** password: 'Test1234567#'
      *** repassword: 'Test1234567#'
      [05-Feb-2019 16:03:53 UTC] *** POST:
      array (
        'password' => 'Test1234567#',
        'repassword' => 'Test1234567#',
      )
      [05-Feb-2019 16:03:53 UTC] *** password: 'Test1234567#'
      *** repassword: 'Test1234567#'
      
      

        That was just an example of how you might inspect what is coming in from the form, with the middle 3 lines being where you set $password and $repassword. If that's no logging, then maybe you need to look at your test in this line:

        error_log("*** Request Method: {$_SERVER['REQUEST_METHOD']}");
        if ($_SERVER['REQUEST_METHOD'] == 'POST')
        {
        
          [05-Feb-2019 16:03:41 UTC] *** password: 'Test1234567#'
          *** repassword: 'Test1234567#'
          [05-Feb-2019 16:03:53 UTC] *** POST:
          array (
            'password' => 'Test1234567#',
            'repassword' => 'Test1234567#',
          )
          [05-Feb-2019 16:03:53 UTC] *** password: 'Test1234567#'
          *** repassword: 'Test1234567#'
          [05-Feb-2019 16:15:10 UTC] *** Request Method: POST
          [05-Feb-2019 16:16:22 UTC] *** Request Method: POST
          
          

            Good: so now you know you're getting the expected request method and the passwords from the form. Just keep applying the same sort of inspection logic until you find where something is not set to what you expect, then figure out why. 🙂

              I've narrowed it down to bad SQL I think,

              UPDATE 
                   users
              SET 
                   `password` = 'password12#' 
              WHERE
                   userId = (SELECT `hash`, `userId` FROM passwordHash WHERE userId = `hash`)
              
              #1241 - Operand should contain 1 column(s)
              

                You want to test userID against just the userID from the sub-query, not hash and userID. And I doubt you want to select where the userid is equal to the hash column?

                WHERE
                    userId = (SELECT `userId` FROM passwordHash WHERE userId = :something_here_for_user_id)
                

                  Well I have two tables, one has the hash in it with the userId and the other has the password and userId, joining the two id's is the aim but I think my way of doing it initially seems wrong. I mean only adding the hash to the url

                    Write a Reply...