Insert New Password In MD5

[justlukeyou]

Hi,

I am trying to create a script which allows me to insert a new password. I can set it up to accept plain text but when I try to add MD5 it keeps returning the same message:

An error occurred Unknown column '4b29a21e5aa032dd4f5a1590c29016f2' in 'field list'

However the code looks logical enough. Can anyone advise what I am doing wrong. I can see that I am saying I want password (the field in my database) to be in MD5

			
<?php	

	
     $errors = array();
    $success = array();
	
function mysql_real_escape_array($t)
{
    return array_map("mysql_real_escape_string",$t);
}

function trim_array($ar)
{
    return array_map("trim",$ar);
}

if(isset($_POST['form_id']))
{

    $_POST = mysql_real_escape_array($_POST);
    $_POST = trim_array($_POST);
 
     
 
    if($error == "")
    {
	$newpassword = md5('resetpassword');
        $sql = "
        UPDATE
            users
        SET
            password = $newpassword";


        $result = mysql_query($sql) or die("An error occurred ".mysql_error());

    }

}

?>



<div class="registerinfopagecell">
<div class="registerpageheaderorganiser">
Choose a New Password
</div>
<div class="registerform">
				
<form class="form_id"  class="appnitro"  method="post" action="">
										
	
<ul >
			
					
	

	
 	

		<div class="forminputcell">
		<div class="datainput">
<li class="li_1" >
		<div class="forminputleft">	
Your New Password:
		</div> 	

	<div class="forminputright">	
<input name="resetpassword" type="text" class="field" width="600" /> 
</div>
</li> 
</div> 
	</div> 
	

		
</li> 
</div> 
	</div>

[MarPlo]

Hi,
Try replace this code:

$newpassword = md5('resetpassword');
        $sql = "
        UPDATE
            users
        SET
            password = $newpassword";

With this one:

$newpassword = md5($_POST['resetpassword']);
$sql = "UPDATE users SET password = '$newpassword'"; 

Also, it is needed a WHERE clause in sql query, else makes update to all rows.

[K. Wolfe]

http://www.unixwiz.net/techtips/sql-injection.html

and

http://stackoverflow.com/questions/6...-sql-injection

and then have a look at how to create a random salt