setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
// Grab session username to make sure we're updating the person logged in
$username = $_SESSION["username"];
// Grab the existing data, so we can only update the things that got updated
$sqlGetUserInfo = $conn->prepare("SELECT password FROM " . $userTableName . " WHERE username=\"" . $username . "\"");
$sqlGetUserInfo->execute();
$userInfo = $sqlGetUserInfo->fetch(); // fetch row
// Grab passwords entered on account page
$oldPassword = $_POST["oldPassword"];
$newPassword = password_hash($_POST["password"], PASSWORD_DEFAULT);
// Grab the hashed password from the database
$passwordHash = $userInfo["password"];
// Function from StackOverflow used to get the base URL, to which we append
// the redirect (where the user came from)
function url(){
return sprintf(
"%s://%s/user/%s",
isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off' ? 'https' : 'http',
$_SERVER['SERVER_NAME'],
$_SESSION["username"]
);
}
$address = url();
// Make sure the old password(s) match
if (password_verify($oldPassword, $passwordHash)) {
// Prepare the command
$update = $conn->prepare("UPDATE " . $userTableName . " SET
password = :password
WHERE username = :username
");
// Bind parameters to query
$update->bindParam(":username", $username);
$update->bindParam(":password", $newPassword);
$update->execute(); // Execute query
// Tell the user what we did
echo "Password successfully changed!
";
echo "This link will take you back to your account
";
echo "Or, you will be re-directed automatically in 5 seconds...
";
echo "";
} else {
// Or tell them something fucked up
echo "Whoops!
";
echo "There was a problem and your password couldn't be updated. Make sure you've typed your old password correctly and try again
";
echo "This link will take you back to your account
";
echo "Or, you will be re-directed automatically in 5 seconds...
";
echo "";
}
} catch (PDOException $e) { // failed connection
echo "Connection failed: " . $e->getMessage();
}
$conn = null;
?>