note 84843 deleted from function.mysql-affected-rows by danbrown
| From: | danbrown@php.net | Date: | Fri, 01 Aug 2008 16:16:50 +0000 |
| Subject: | note 84843 deleted from function.mysql-affected-rows by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-143013@lists.php.net to get a copy of this message | ||
Note Submitter: george at torindul-designs dot co dot uk
Reason: bad code
----
Some users may use this method for CMS systems. Below is an example of a password change function.
It can be very useful as it:
1. Is secure from hacks
2. Checks for the user by username and password
3. Displays error message if user dosn't exist
_________________________________________________
<?
$new = "$_POST[new]";
$old = "$_POST[old]";
$username = "$_POST[username]";
$table = "admins";
include_once "../config/config.inc.php";
$con = mysql_connect("$server","$username","$password");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("$database", $con);
$new1 = mysql_real_escape_string($new);
$old1 = mysql_real_escape_string($old);
$user = mysql_real_escape_string($username);
$query = "UPDATE $table SET password = '$new1' WHERE password = '$old1' AND
username = '$user'";
$result = mysql_query($query);;
if (mysql_affected_rows() <= 0)
echo "We couldn't find the account to change in our records"
} else {
echo "Password Changed Successfully";
}
mysql_close($con);
?>