如何使更改密码的 PHP 脚本工作

How to make a change password PHP script work

提问by Pebbles

I am a simpleton with less than a cursory knowledge of programming. I have a family web site where we share photos, videos, files and other resources. The site has a simple login feature that begins a session, and I want to be able to provide people with the ability to change their password once logged in.

我是一个没有粗略的编程知识的傻瓜。我有一个家庭网站，我们可以在其中共享照片、视频、文件和其他资源。该站点有一个简单的登录功能，可以开始会话，我希望能够为人们提供登录后更改密码的功能。

The database is in MySQL and is extremely simple with only; ID, username, and, password columns (not encrypted or hashed at all).

数据库在MySQL中，非常简单，只有；ID、用户名和密码列（根本没有加密或散列）。

When it comes to PHP and MySQL I tend to research other people's examples and make them my own, and with the login script I found this very easy to do. However, I have tried and tried and tried to find a PHP snippet that fits with my site and will allow users to change their passwords and have unfortunately failed at every attempt.

当涉及到 PHP 和 MySQL 时，我倾向于研究其他人的示例并将它们制作成我自己的示例，并且使用登录脚本我发现这很容易做到。但是，我一直在尝试并尝试找到适合我的网站的 PHP 代码段，并允许用户更改他们的密码，但不幸的是，每次尝试都失败了。

I am hoping that someone can assist me in developing what I have already to make it work for my site, any help will be hugely appreciated!

我希望有人可以帮助我开发我已经拥有的内容以使其适用于我的网站，任何帮助将不胜感激！

My form simply asks for the logged in user to enter a new password, and then confirm the same password:

我的表单只是要求登录用户输入新密码，然后确认相同的密码：

    <form name="frmChange" role="form" class="form-signin" method="POST" action="changepword_script.php">

  <div class="form-group">

    <label for="InputPassword2">New Password</label>
    <input type="password" class="form-control" id="InputPassword2" placeholder="New Password" name="newPassword">
     <label for="InputPassword3">Confirm New Password</label>
    <input type="password" class="form-control" id="InputPassword3" placeholder="Confirm Password" name="confirmPassword">  </div>
   <button class="btn btn-lrg btn-default btn-block" type="submit" value="send">Change it</button>


      </div>


      </form>

And my php script (also very simple) just needs to check that the passwords match and then update the database if they do (I have removed the IP address of the database and replaced with zeros):

我的 php 脚本（也很简单）只需要检查密码是否匹配，然后更新数据库（我已经删除了数据库的 IP 地址并用零替换）：

<?php
session_start();

if (!(isset($_SESSION['username']) && $_SESSION['username'] != ''))
{
    header("location:login.php");
}

$dbcon = mysql_connect ('000.000.000.00', 'my_db_username', 'my_db_password')

$password1 = $_POST['newPassword'];
$password2 = $_POST['confirmPassword'];

$password1 = mysql_real_escape_string($password1);
$password2 = mysql_real_escape_string($password2);

if ($password1 <> $password2){ echo "Your passwords do not match.";}
{
    echo "your passwords do not match";
}
if (mysql_query(UPDATE ebsmembers SET password='$password1' WHERE username='$session[username]'))
{
    echo "You have successfully changed your password.";
}

mysql_close($dbcon);
header("location:login.php");

?>

Again, any help would be massively appreciated as I have really struggled with making this work!

再次，任何帮助将不胜感激，因为我真的在努力完成这项工作！

Many thanks, Paul

非常感谢，保罗

回答by bloodyKnuckles

Tweaked a few things that where errors or didn't make sense to me. Also switched to mysqli_*.

调整了一些错误或对我没有意义的事情。也切换到了mysqli_*。

<?php

session_start();

if (!(isset($_SESSION['username']) || $_SESSION['username'] == ''))
{
    header("location:login.php");
}

$dbcon = mysqli_connect('000.000.000.00', 'my_db_username', 'my_db_password', 'my_db_name') or die(mysqli_error($dbcon));

$password1 = mysqli_real_escape_string($dbcon, $_POST['newPassword']);
$password2 = mysqli_real_escape_string($dbcon, $_POST['confirmPassword']);
$username = mysqli_real_escape_string($dbcon, $_SESSION['username']);

if ($password1 <> $password2)
{
    echo "your passwords do not match";
}
else if (mysqli_query($dbcon, "UPDATE ebsmembers SET password='$password1' WHERE username='$username'"))
{
    echo "You have successfully changed your password.";
}
else
{
    mysqli_error($dbcon);
}
mysqli_close($dbcon);

?>

回答by RemyG

Your use of the session is wrong. In your SQL query, it should be:

您对会话的使用是错误的。在您的 SQL 查询中，它应该是：

UPDATE ebsmembers SET password = '$password1' WHERE username= '$_SESSION[username]'

Also your syntax is very bad. It's missing quotes in several places. You should start with the PHP basics again before making your changes.

你的语法也很糟糕。它在几个地方缺少引号。在进行更改之前，您应该再次从 PHP 基础开始。

回答by Gergo Erdosi

1. Query should be quoted:

   if (mysql_query("UPDATE ebsmembers SET password='$password1' WHERE username='$_SESSION[username]'"))
   

2. Don't use mysql, it's deprecated. Use mysqlior PDOinstead: The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead

3. Don't store passwords in plain text. Use bcrypt encryption with password_hash()and password_verify()functions: How do you use bcrypt for hashing passwords in PHP?

1. 查询应引用：

   if (mysql_query("UPDATE ebsmembers SET password='$password1' WHERE username='$_SESSION[username]'"))
   

2. 不要使用mysql，它已被弃用。使用mysqli或PDO替代： 不推荐使用 mysql 扩展并将在未来移除：使用 mysqli 或 PDO 替代

3. 不要以纯文本形式存储密码。使用 bcrypt 加密password_hash()和password_verify()函数： 你如何使用 bcrypt 在 PHP 中散列密码？

回答by banjoAtix

$password1 = $_POST['newPassword']; $password2 = $_POST['confirmPassword'];

$password1 = $_POST['newPassword']; $password2 = $_POST['confirmPassword'];

must be

必须是

$password1 = $_POST['InputPassword2']; $password2 = $_POST['InputPassword3'];

$password1 = $_POST['InputPassword2']; $password2 = $_POST['InputPassword3'];

回答by Vasant

you can use update statement for this purpose, create a same form with:

您可以为此目的使用更新语句，创建一个相同的表单：

1. username(name=$name)
2. existing password(password=$pw1)
3. new password
4. submit

1. 用户名（名称=$名称）
2. 现有密码（密码=$pw1）
3. 新密码
4. 提交

First select the current user name using sql select statement:

首先使用 sql select 语句选择当前用户名：

$my_qry ="select * from table_name where name= $name";

for updation use the statement:

更新使用语句：

$query = mysql_query("UPDATE table_name SET password='".$pw1."' WHERE name='".$name."'");
    if(!$query)
{   
    mysql_error();
    echo "hello";
}

use if else conditions for this, if the first select query is true then only the update query with work

为此使用 if else 条件，如果第一个选择查询为真，则只有更新查询有效