Q:

Change password page

I'm having trouble with this PHP code, it seems logical to me but as I'm new to PHP and MySQL, I am obviously wrong.
I'm trying to set up a change password page for an assignment, and I can't see where I have gone wrong, the code is as follows:
session_start();
if(isset($_SESSION['uname'])){
    echo "Welcome " . $_SESSION['uname'];
}
require_once 'PHP/Constants.php';
$conn = new MySQLi(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) or die ('There was a problem connecting to the database');
$query = "SELECT * FROM user";
$result = mysqli_query($conn, $query);
while ($pwdReq = mysqli_fetch_array($result)){
    if ($pwdReq['Password'] == $_POST['oldPwd']) {
        if ($_POST['confPwd'] == $_POST['newPwd']){
            $change = "INSERT INTO user(Password) VALUES ('newPwd')";
            $pwdChange = mysqli_query($conn, $change);
        } else return "The new passwords do not match!";
    } else return "Please enter a correct password!";
} 

The body Of my page is as follows:
<form method="post" action="">
    <h2>Change Password</h2>
    <p>
        <label for="oldPwd">Old Password:</label>
        <input type="password" name="oldPwd" />
    </p>
    <p>
        <label for="newPwd">New Password:</label>
        <input type="password" name="newPwd" />
    </p>
    <p>
        <label for="confPwd">Confirm Password:</label>
        <input type="password" name="confPwd" />
    </p>
    <p>
        <input type="submit" id="submit" value="Submit" name="submit" />
    </p>
</form>

When the page runs all I get is as follows:

Notice: Undefined index: oldPwd in C:\Program Files
  (x86)\xampp\htdocs\Assignment\change_password.php on line 11

Thank you in advance for any help I receive - Nick

A:

Always check your POST values before you do anything
You should select the single record that matches uname
prepare your queries to avoid SQL injection

Here's an improved version of your script:
 <?php
session_start();
if(isset($_SESSION['uname'])){
    echo "Welcome " . $_SESSION['uname'];
}
if(isset($_POST['oldPwd']) && 
   isset($_POST['newPwd']) && 
   isset($_POST['confPwd']){
   //Values are set
    require_once 'PHP/Constants.php';
    $conn = new MySQLi(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) 
            or die ('There was a problem connecting to the database');
    //Select user from DB where username matches Session
    $query = "SELECT * FROM user WHERE uname = ?";
    //prepare query
    $stmt = mysqli_prepare($conn, $query);
    mysqli_stmt_bind_param($stmt, "s", $_SESSION['uname']);
    $result = mysqli_stmt_execute($stmt);
    $row = mysqli_fetch_assoc($result);
    //get the password from DB
    $pwdReq = $row['Password'];

    if ($pwdReq == $_POST['oldPwd']){   
        if($_POST['confPwd'] == $_POST['newPwd'])) {
            $change = "INSERT INTO user(Password) VALUES (?)";
            $stmt = mysqli_prepare($conn, $change);
            mysqli_stmt_bind_param($stmt, "s", $_POST['newPwd']);
            mysqli_stmt_execute($stmt);
            echo "Password has been changed";
        } else{
         echo "The new password does not match confirmation";
        }
    }else{
        echo "Old password not matching the database";
    }
}else{
    echo "oldPwd, confPwd, or confPwd is not set";
}
?>

if oldPwd, confPwd, or confPwd is not set you will need to figure why. This is not PHP fault anymore. You will need to look in your html and make sure the script is receiving these values

