change password script

[nikomou]

hey, I have the following code which seems to update the password, even if the old password is incorect, how can I fix this for extra security? Thanks


<?php
require_once "user.php";


echo ("<div class=\"padding\">");
echo ("Hello <strong>$USACCName</strong>, Welcome to your account page!<br>");
echo ("Here you'll be able to view all your reviews and recieve special offers from participating partners!");
echo ("</div>");



$con = mysql_connect("localhost", "xxx_xxx", "xxx") or die(mysql_error());
$db = mysql_select_db("xxx_xxx", $con);


if(!$_POST['submit']){
echo("<div class=\"reviewcss\">
<form method=\"post\" class=\"cssform\" action=\"account.html\">

<p>
<label for=\"currentpassword\">Current Password</label>
<input type=\"password\" name=\"oldpassword\">
</p>

<p>
<label for=\"password\">New Password</label>
<input type=\"password\" name=\"password\">
</p>

<p>
<label for=\"password\">Confirm</label>
<input type=\"password\" name=\"passconf\">
</p>

<div style=\"margin-left: 150px;\">
<input type=\"submit\" name=\"submit\" value=\"Update\">
</div>
</form>
");
} else {
echo("<div class=\"reviewcss\">");
$oldpassword = $_POST['oldpassword'];
$password = $_POST['password'];
$confirm = $_POST['passconf'];

$errors = array();

if(!$password){
$errors[] = "Your New Password has not been defined!";
}

if($password){
if(!$confirm){
$errors[] = "Confirmation password has not been defined!";
}
}

if($password && $confirm){
if($password != $confirm){
$errors[] = "Your Passwords do not match!";
}
}

if(count($errors) > 0){
foreach($errors AS $error){
echo $error . "<br>\n";
}
}else {
$sql4 = "UPDATE users SET password='".md5($password)."' WHERE id='$USACCID' AND password='".md5($oldpassword)."'";

$res4 = mysql_query($sql4) or die(mysql_error());
echo "You have successfully updated your password.</strong><br>";
}
echo("<br><br></div>");
}

?>

[diltony]

Actually, you need the line of code that will compare the old password submitted with the one currently in the database, so u need a line like this: i am writing offhand, so correct any small mistake u see here:

$results=mysql_query("select password from users where password='$oldpassword' ");
$rows=mysql_fetch_array($results);

if($rows['password']!=$oldpassword){
$errors[] = "Your old password is in-correct!";
}

[nikomou]

thanks! works great! just had to change 1 thing!


if($rows['password']!=md5($oldpassword)){