Originally posted by jp4priest

okay here is the final script ive come up with. I will be reading way more into sql and php. just for the time being can you get this so only the user logged in can change their own password?

    

<?php

$host="******"; // Host name 

$username="*****"; // Mysql username 

$password="*****"; // Mysql password 

$db_name="****"; // Database name 

$tbl_name="members"; // Table name

 

// Connect to server and select databse.

mysql_connect("$host", "$username", "$password")or die("cannot connect"); 

mysql_select_db("$db_name")or die("cannot select DB");



//take the username and prevent SQL injections 

$username = mysql_real_escape_string($username); 



//variables for new/old passess

$newpass = $_POST['newpass'];

$confirmpass = $_POST['confirmpass'];



//this is the password that will be changed!

$finalpass = sha1(md5(sha1(sha1($newpass))));



//sure proof denies unless has cookie

$count = 0;



//Checks for the cookie, or deny access

if (isset($_COOKIE["mycookie"])) {

  $count = 1;

  } else {

  $count = 0;

  }



  //select id from table

$select = mysql_query("SELECT id FROM $tbl_name WHERE username = '.$username.' ");



//start session

session_start();

$_SESSION['id'] = $select['id']; //store the resulting id as a session variable



// If result matched $myusername and $mypassword, table row must be 1 row



// sets cookie if cookie is found



  if ($count==1) { 

	setcookie('mycookie', 'Test mycookie', time()+3600*24);

	echo "You may only change your password!";

//display all users

$display = mysql_query("SELECT * FROM members ORDER BY ID");

	

//begin the query 

$sql = mysql_query("SELECT * FROM $tbl_name WHERE username = '".$username."' LIMIT 1");



//If password is set then check if correct

if (isset($_POST['password']))

 

{ 

//Prevent SQL injections 

$username = mysql_real_escape_string($_POST['username']); 

 

// UPDATE NEW PASSWORD with the same encryption as the database

$password = sha1(md5(sha1(sha1(mysql_real_escape_string($_POST['password']))))); 



//Check to see if username exists 

$sql = ("SELECT * FROM $tbl_name WHERE password = '".$password."' ");

$result = mysql_query($sql);



if (mysql_num_rows($result) < 1) {

	echo "That is not your current password";

	} else {

		if ($confirmpass==$newpass) {

		session_start();

		$querynew = mysql_query("UPDATE $tbl_name SET password = '".$finalpass."' WHERE username = '".$username."' LIMIT 1"); // run the update query  

		echo "Password changed!";

		} else {

		echo "Passwords Do not match!";

		}

	}

} else {

 echo "Change your password";

}



echo "

<a href='https://www.nextgenupdate.com/forums/'>Go Back</a>

<center>

<table>

<form action='change.php' method='post'>

<tr><td>Your Username:</td><td><input name='username' type='text' /></tr></td><br />

<tr><td>Current Password:</td><td><input name='password' type='text' /></tr></td><br />

<tr><td>New Password:</td><td><input name='newpass' type='text' /></td></tr><br />

<tr><td>Confirm Password:</td><td><input name='confirmpass' type='text' /></td></tr><br />

<tr><td><input type='submit' value='Change Password' /></td></tr>

</table>

</form>

</center>

";



//html for display all users

echo "<center><table border='1'>

<tr>

<th>UserName</th>

<th>ID</th>

</tr>";



while($row = mysql_fetch_array($display))

  {

  echo "<tr>";

  echo "<td>" . $row['username'] . "</td>";

  echo "<td>" . $row['id'] . "</td>";

  echo "</tr>";

  }

echo "</table></center>";





		} else {

		echo "You do not have permissions on this page!";

		}

?>

so that works, but you have to enter the user's name and changes their password. could I set it up like this?

$loggedinuser = ($_REQUEST['$username']);

then

    

if $username==$loggedinuser

{

password changed!

}

else

{

Cannot change another users password!

}

that's probably wrong, but the only way I think of the way.

my login system doesn't use sessions it queries the database, and if the username & password from the form are equal to the one queried in the database it allows access. now this is very hard on my point of view without the use of sessions. so is there any other way around this??

1. Check if the user is logged in. If the user is NOT logged in, redirect them to a log-in form. Otherwise, continue with the script...
   
2. Show the password change form
   
3. On the submission of the password change form, run a query UPDATE the user's table and SET the password field to the new password only WHERE the user's ID (stored in a database) matches the user's ID (stored in a session), LIMIT this to only 1 update
   
4. Lastly, notify the user of a successful change
   

    <?php

session_start();



// checks if either the username or user_id values are NOT set

if (!isset($_SESSION['username']) || !isset($_SESSION['user_id']))

{

    header('Location: login_form.php'; // redirect to login form

    die(); // kill the script

}

else

{

    // the following query will verify whether or not the username is also legitimate

    $query = mysql_query('SELECT username FROM users WHERE user_id = ' . mysql_real_escape_string($_SESSION['user_id']));

    if (mysql_num_rows($query) > 1 || mysql_num_rows($query) <= 0) // check if more than one, or less than one user exists

    {

        die('There has been an error, please return to the log in form';

    }

    else

    {

        $result = mysql_fetch_assoc($query);

        if ($result['username'] != $_SESSION['username']) // check if the usernames match

        {

            die('There has been an error, please return to the log in form';

        }

    }

}

?>

    <html>

    <head>

        <title>Change Your Password</title>

    </head>

    <body>

        <form action="changepassword.php" method="post">

            <label for="originalpassword">Current password:</label><input type="password" id="orginalpassword" name="originalpassword" />

            <br />

            <label for="newpassword">New password:</label><input type="password" id="newpassword" name="newpassword" />

            <br />

            <label for="confirmpassword">Confirm password:</label><input type="password" id="confirmpassword" name="confirmpassword" />

            <br />

            <input type="submit" name="submit" value="Change Password" />

        </form>

    </body>

</html>

    <?php

session_start();



// first confirm whether or not the two passwords match

if ($_POST['newpassword'] != $_POST['confirmpassword'])

{

    echo 'The passwords you entered don\'t match! Go back and try again!<meta http-equiv="refresh" content="3; url=newpasswordform.php">';

    die();

}



// next, determine if the old password is correct

// note that you'll also need to apply whatever hashing functions you used to store the password originally, apply those functions in the line of code below:

$old_password = mysql_real_escape_string($_POST['originalpassword']);



// we'll then proceed to query the database, we'll select the password field from the users table where the user_id (stored in the session variable) matches

$query = mysql_query("SELECT password FROM users WHERE user_id=$_SESSION['user_id']");



// fetch the results of the query as an associative array:

$result = mysql_fetch_assoc($query);



// after that, compare the two passwords:

if ($old_password != $result['password'])

{

    echo 'Your original password was incorrect! Go back and try again!<meta http-equiv="refresh" content="3; url=newpasswordform.php" />';

    die();

}



// finally, we'll get to the point of actually making the change

// first, we'll prepare our new password, again, be sure to apply all proper hashing functions to the line of code below:

$new_password = mysql_real_escape_string($_POST['newpassword']);



// second, we will query: we update the users table to set the password equal to the new password, we'll only do this where the user_ids match, and we'll limit this to one update

$query = mysql_query("UPDATE users SET password='" . $new_password . "' WHERE user_id = " . $_SESSION['user_id'] . " LIMIT 1");



if ($query) // if the update is a success

{

    echo 'Password successfully updated! You\'re now being redirected back to the index page!<meta http-equiv="refresh" content="3; url=index.php" />';

}

else // if the update fails

{

    echo 'Failed to update!';

}

?>