Hello everyone!..
Can someone please help me to clear a mistake which I seem not able to find!..I use the below script for updating user details, but when this script run I see no changes to the password which was what I intended to update. If I remove the check section(i.e. check if password is not empty or the two passwords match the code seem to work fine)…but this is not what I want I want to be able to know the password field was filled and that the two fields real match!..can someone please help!..
<?php include('includes/dbConnect.inc.php');
include('includes/corefuncs.inc.php');
//remove backslashes
nukeMagicQuotes();
//initilise flag
$done = false;
//prepare an array of expected items
$expected = array('password1', 'password2','userID');
//create database connection
$conn = dbConnect('admin');
//get details of selected record
if($_GET && !$_POST){
if(isset($_GET['userID']) && is_numeric($_GET['userID'])){
$userID = $_GET['userID'];
}
else{
$userID = NULL;
}
if($userID){
$sql = "SELECT * FROM users WHERE userID = $userID";
$result = mysql_query($sql) or die(mysql_error());
$row = mysql_fetch_assoc($result);
}
}
//if form has been submitted, update record
if(array_key_exists('update',$_POST)){
//prepare expected items for insertion into database
foreach($_POST as $key => $value){
if(in_array($key, $expected)){
${$key} = mysql_real_escape_string($value);
}
}
//abandon if primary key is invalid
if(!is_numeric($userID)){
die('invalid requst');
}
//prepare sql query
//added code
$password1 = htmlspecialchars($_POST['password1']);
$password2 = htmlspecialchars($_POST['password2']);
//initialise error array to display errors
$error = array();
//check if all fields have been filled
if( empty($password1) || empty($password2) ){
$error[] = 'Please fill in all the details';
}
//check password length
if(strlen($password1)<4 || preg_match('/\\s/', $password1)){
$error[] = 'Password should be at least 4 characters; no spaces';
}
//check if password do match
if( $password1!=$password2){
$error[] = 'Password do not match; re-enter same password';
}
if no error, check for duplicate username
if(!$error){
$pass1 = md5('$password1');
$pass1 = md5($_POST['password1']);
$sql = "UPDATE users SET password = '$pass1' WHERE userID = $userID";
//submit query
$done = mysql_query($sql) or die(mysql_error());
header ('Location: List_All_User.php');
}
}//end if(!error)
//redirect page if $userID is invalid
if(!isset($userID)){
header('Location: List_All_User.php');
exit;
}
?>
And this is the form…
<?php if(empty($row)){?>
<p class="warning">Invalid request: record does not exist.</p>
<?php } else {
if (isset($error)) {
echo '<ul>';
foreach ($error as $item) {
echo "<li>$item</li>";
}
echo '</ul>';
}
?>
<form id="update" name="update" method="post" class="formfield" action="Update_User.php">
<h1>Change user password</h1>
<div >
<label class="fixedwidth">First Name:</label>
<?php echo htmlentities($row['fname']); ?> </div>
<div >
<label class="fixedwidth">Other Names:</label>
<?php echo htmlentities($row['othernames']); ?> </div>
<div >
<label class="fixedwidth">Username:</label>
<?php echo htmlentities($row['username']); ?> </div>
<div>
<label for="gender" class="fixedwidth">Gender:</label>
<?php echo $row['gender']; ?> </div>
<div >
<label for="userrole" class="fixedwidth">User Role:</label>
<?php echo htmlentities($row['userrole']); ?> </div>
<div >
<label class="fixedwidth">Password:</label>
<input name="password1" id="password1" type="password" class="fixedwidth" />
</div>
<div>
<label class="fixedwidth">Re-type Password:</label>
<input name="password2" id="password2" type="password" class="fixedwidth" />
</div>
<div>
<input name="userID" type="hidden" value="<?php echo htmlentities($row['userID']); ?>" />
</div>
<div class="buttonarea">
<div align="center">
<input name="update" id="update" type="submit" value="update user" />
</div>
</div>
</form>
<?php } ?>
<p align="center"><img src="images/headingbg.gif" alt="div" height="18" /></p>
</td>
</tr>
</table>
‘U cannot test your own code’