Password Matching Problem in php

[Rajat]

Hi to All,
I make the change password.php Page.In this page I make two things one is password->textbox & Confirm password->textbox.But My problem is that password is not matching to each other I uses the function for the validate password & confirm password fields:

<script type="text/javascript">
function validate(form)
 {
     var e = form.elements, m = '';
    if(e['password'].value != e['confirm'].value) 
    {
       m += '- Your password and confirmation password do not match.\n';
     }
     if(m)
    {
      alert('The following error(s) occurred:\n\n' + m);
      return false;
     }
  return true;
}
</script>

and the form code is:

<?
if(!isset($_POST['submit']))
{
?>   
	<?
		$id=$_REQUEST['i'];
        	$sql="SELECT * FROM tbl_member where memberid='$id'";		
			$query = mysql_query($sql) or die(mysql_error());
			$member_result=mysql_fetch_array($query);
	?> 
<td colspan="6" class="mncntbgr2">
<form name="frm_chgpwd" method="post" action=""   
onsubmit="return validate(this);">
<table cellpadding="4" cellspacing="0" border="0" width="500" class="reg">
<input type="hidden" name="id" size="27" value="<?=$_REQUEST['i']?>">
<tr>
<td colspan="2" align="center" class="cap">Change your Password</td>
</tr>

<tr><td>&nbsp;</td></tr>
								 
<tr>
<td class="lftpad">New Password</td><td>
<input type="password" id="password" name="password" class="input">
</td>
 </tr>
     								
<tr>
<td class="lftpad">Confirm Password</td><td>
 <input type="password" id="confirm" name="confirm"  class="input">
 </td>
 </tr>
     <tr><td>&nbsp;</td></tr>
<tr>
<td colspan="2" align="center">
<div align="center"><input type="submit" name="submit" value="UPDATE">&nbsp;&nbsp;<input type="reset" value="RESET"></div>
</td>
</tr>
 </table>
</form>
</td>
<?php
}
?>

and this all over the code but I make sense you that when I make click on the update button then It make the updation not checking the field is empty as well as not saying password is incorrect (If I fill incorrect).It just Update in the database.On thing more I tell you that I take only the password field in the table not confirm field in the database.Please make me help..reply any soon... :-)

[Nile]

Well first of all I, I wouldn't use REQUEST, maybe use POST. Second of all, on your query when your including variables. Its always smart to put there: { }. Then you only want to return one, so I added a limit.
So:

            $sql="SELECT * FROM `tbl_member` WHERE `memberid`={$id} LIMIT 0,1";