Password renewal system

Question

My point is that I’m trying to make a password reset system.

[ Current password ] [ New password ] [ Swap ]

Good codes below

Settings.php

<?php

 require_once('assets/system/core.php');

     if (isset($_POST['password'])) {

    $password = mysqli_query($db, "SELECT * FROM users WHERE password = 'password'");

    if ($password->num_rows > 0) {
            while($row = $password->fetch_assoc()) {
                $userid = $row["id"];
            }
        }
    elseif(mysqli_num_rows($password) == 0)
    {
        echo '<div id="alert-error">Senha está incorreta!</div>';
        $passerror = true;
    }
}

     if (isset($_POST['npassword'])) {

    $npassword = mysqli_query($db, "UPDATE users SET password='".$_POST['npassword']."' WHERE username='".$_SESSION['loginuser']."'");

    {
        echo '<div id="alert-green">Você foi registrado corretamente!</div>';
    }
}

    echo '
    <div class="wrapper-me">
        <div class="right-content" style="margin-left: 5px">
            <div id="box" style="min-height: 400px;  max-height: 1200px;">
                <div id="blue-title" style="background: #27ae60; border: 1px solid #27ae60">
                    <h1 id="title-config">Alterar minha senha</h1>
                    <i style="color:#e0e0e0;" class="ion-edit"></i>
                </div>
                <div id="content-config" style="height: auto;">
                    <form action="" method="post" autocomplete="off">
                    <input type
                      <input type="password" name="password" placeholder="Senha atual" class="button-contn1"/>
                       <input type="password" name="npassword" placeholder="Nova senha" class="button-contn1"/>
                      <input type="submit" value="Continuar" class="button-contn">
                    </form>
                    </div> '


    ?>

He’s changing the password. But he’s not kind of confirming if the current password actually appears in the database.

Please, if anyone could help me, I’d appreciate it.

Answer 1

Good morning, I see some very wrong points in what you did. The worst is that this way it was programmed if there are 2 equal passwords will give problem.

I believe it should work as follows, I will post here the code and you adapt if necessary.

We assume that the person is logged in and you recorded their id in a session or in case you forced them to enter the login somewhere as well.

php form.

<div class="wrapper-me">
    <div class="right-content" style="margin-left: 5px">
        <div id="box" style="min-height: 400px;  max-height: 1200px;">
            <div id="blue-title" style="background: #27ae60; border: 1px solid #27ae60">
                <h1 id="title-config">Alterar minha senha</h1>
                <i style="color:#e0e0e0;" class="ion-edit"></i>
            </div>
            <div id="content-config" style="height: auto;">
                <form action="valida.php" method="post" autocomplete="off">
                    <input type
                    <input type="password" name="password" placeholder="Senha atual" class="button-contn1"/>
                    <input type="password" name="npassword" placeholder="Nova senha" class="button-contn1"/>
                    <input type="submit" value="Continuar" class="button-contn">
                </form>
            </div>
        </div>
    </div>
</div>

valida.php

<?php

if(!empty($_POST['npassword']) && !empty($_POST['password'])){
    $sql= mysqli_query($db, "UPDATE users SET password='".md5($_POST['npassword'])."' WHERE username='".$_SESSION['loginuser']."' AND password='".md5($_POST['password'])."'");
    mysqli_query($db,$sql);
    if(mysqli_affected_rows($db)>0){
        echo "Senha alterada";
    } else {
        echo "Sua senha atual não coincide!";
    }
} else {
    echo "Ambos campos de senha devem estar preenchidos";
}

?>

any questions just let me know ^^

Answer 2

Friend, your logic had some problems, but I tried to make the most of what you used to avoid confusing you, the code got even uglier but the intention is you understand, if you understand the improved one.

The code is following this cycle below:

• Check that the fields are not empty
• Encrypts passwords that came via POST in MD5
• Grabs the database user with the entered data
• Checks if the old password is not the same as the current one
• Update the user with the new password and print the success on the screen

Below is the commented code

<?php

require_once('assets/system/core.php');

// Verifica se não está vazio os campos senha atual e nova senha
if (!empty($_POST['npassword']) && !empty($_POST['password'])) {

    $pass = md5($_POST['password']);   // nova senha
    $npass = md5($_POST['npassword']);   // senha atual

    // Estou usando esse login user que você salvou na session.
    $npassword = mysqli_query($db, "SELECT * FROM users WHERE password = '$npass' and username = '".$_SESSION['loginuser']."'");

    // Verifica se ele achou algum usuario com o valor salvo na session loginuser e a senha digitada por ele
    if (mysqli_num_rows($npassword) > 0) {
        // verifica se a senha atual não é igual a antiga
        if ($pass != $npass ) {
            // caso o update ocorra corretamente ele printa o sucesso! (Recomendo usar um ID caso esse username não for uma chave primaria - PK)
            if ($password = mysqli_query($db, "UPDATE users SET password='".$_POST['npassword']."' WHERE username='".$_SESSION['loginuser']."'")) {
                echo '<div id="alert-green">Senha alterada com sucesso!</div>';
            }
            else {
                  echo '<div id="alert-error">Algum prolema foi encontrado e sua senha não foi alterada!</div>';
            }
        }
        else {
             echo '<div id="alert-error">Senha atual é igual a senha antiga!</div>';
        }


    }
    else {
        echo '<div id="alert-error">Senha atual está incorreta!</div>';
        $passerror = true;
    }
}

// Printa o form quando ele não for enviado 

echo '
<div class="wrapper-me">
    <div class="right-content" style="margin-left: 5px">
        <div id="box" style="min-height: 400px;  max-height: 1200px;">
            <div id="blue-title" style="background: #27ae60; border: 1px solid #27ae60">
                <h1 id="title-config">Alterar minha senha</h1>
                <i style="color:#e0e0e0;" class="ion-edit"></i>
            </div>
            <div id="content-config" style="height: auto;">
                <form action="" method="post" autocomplete="off">
                    <input type
                    <input type="password" name="password" placeholder="Senha atual" class="button-contn1"/>
                    <input type="password" name="npassword" placeholder="Nova senha" class="button-contn1"/>
                    <input type="submit" value="Continuar" class="button-contn">
                </form>
            </div>
        </div>
    </div>
</div> '
?>

Any doubt, tamo ai!!

@Edit

Code changed to transform passwords into md5.