tags:

views:

50

answers:

2

I have link change password in my home page..NOw i am telling you what i am doing...

  • First of all i creating a html form named edit_profile.php in which i have three textboxes old password,new password,confirm password.I have attcahed this page as a link to home page for changing password.
  • Next page i have designed named edit_profile1.php in which i am comaparing if new password and confirm passwords are equal or not
  • Then i making a query to search data with password = old password

But this page is not working.Now i am giving you the code both files and in last i will tell you what type error i am facing..

edit_profile.php
<?php
session_start();
?>

<html>
<body bgcolor="pink">
<table cellpadding="10" cellspacing="6" align="center" width="500">
<form name="form" action="edit_profile1.php" method="POST" >
<tr>
<td><b><i>Your Username</i></b></td>
<td><input type="text" name="username" id="username" size="30" maxlength="30" value="<?php echo $_SESSION['employee']['username']; ?>" disabled="disabled"></td>
</tr>

<tr>
<td><b><i>Old Password</i></b></td>
<td><input type="password" name="opassword" id="opassword" size="30" maxlength="30" value="" ></td>
</tr>


<tr>
<td><b><i>New Password</i></b></td>
<td><input type="password" name="npassword" id="npassword" size="30" maxlength="30" value="" ></td>
</tr>


<tr>
<td><b><i>Confirm Password</i></b></td>
<td><input type="password" name="cpassword" id="cpassword" size="30" maxlength="30" value="" ></td>
</tr>


<tr>
<td align="center" colspan="100"> <input type="submit" name="submit" value="Change Password"></td>
</tr>

</table>    
</body>
</html>

Next Page

Next page is for edit_profile1.php
<?php
session_start();
if(isset($_POST['opassword']) && ($_POST['npassword'])) 
{
    $con=mysql_connect("localhost","root","");
    if(!$con)
    {
       die('Could Not Connect:'.mysql_error());
        } 

    mysql_select_db("tcs",$con);
    $a=$_POST['opassword'];   //old password value
    $b=$_POST['npassword'];   //new password value
    $c=$_POST['cpassword'];

 if ($b==$c)  //checking if both new passowrd and c.password are equal or not
    {   

    $pwd=hash('sha1',$b);  //new value is assigned to pwd variable  
    $usr=$_SESSION['employee']['username'];  //this varaible have value of username
    $query="select * from employee where Username='{$usr}' and Password='{$a}'";  
    $result=mysql_query($query,$con);
    $count = mysql_num_rows($result);

           if ($count == 1)
          {
                $sql="update employee set Password='$pwd'";
        $deepak=mysql_query($sql,$con);

        if($deepak)
        {
            echo "Updation Successfull";
        }
        else
        {
        echo "Updation Not Possible.Some Error is there";
        }
      }
    else
    {
    echo "There is some problem in macthing the old password with database password";
    }


   }            

   else
    {
    echo "Both Passwords are Not equal";
    }

}
else
{
echo 'Error! Passwords were not sent!';
}

?>

<html>
<body bgcolor="orange">
<h4 style="position: relative;"><a href="home_page.php" style="position: absolute; left: 0;">Home Page</a></h4>
</body>
</html>

Error:

Every time i try to execute my programe the error is Thhere is some problem in macthing the old password with database password

Now i am not getting where i am falling wrong.In database i have only one user row.Plz tell me what is error

A: 

Your script seems vulnerable to mysql-injection!

Apply mysql_real_escape_string to every value you insert in your SQL-Query!

It may be possible that your comparison doesn't work because there are extra spaces in the values your retrieve from the form. Try:

$a=trim($_POST['opassword']);   //old password value
$b=trim($_POST['npassword']);   //new password value
$c=trim($_POST['cpassword']);

Also:

if(isset($_POST['opassword']) && ($_POST['npassword'])) 

will not work.

You have to use:

isset($_POST['opassword']) && isset($_POST['npassword'])
lamas
+1  A: 

Shouldn't

$query="select * from employee where Username='{$usr}' and Password='{$c}'";  

be

$a = hash('sha1', $a); // added after conversation in comments
$query="select * from employee where Username='{$usr}' and Password='{$a}'";  

instead? ($a instead of $c..)

kb
i tried it .I am sorry i write it by mistake but it is also not working
Deepak Narwal
(and as @lamas above pointed out, you should escape all your data. read up on http://en.wikipedia.org/wiki/SQL_injection)
kb
you need to hash $a as well, do a $a = hash('sha1',$a); before the query, your code above is comparing cleartext $a with encrypted password in database.
kb
thanks sir actaully i was misisng this hashing of $a.Thanks a lot
Deepak Narwal