How to Change Password using PHP

Submitted by nurhodelta_17 on Tuesday, May 22, 2018 - 18:55.

Getting Started

I've used Bootstrap in this tutorial which is included in the downloadable but if you want, you can download it yourself using this link. Take not that I'm using password_hash and password verify function which is available on PHP >=5.

Creating our Database

First we create our database which contains our sample user. I've included a SQL file in the downloadable of this tutorial. All you have to do is import the said file. If you have no idea on how to import, please visit my tutorial How import .sql file to restore MySQL database. You should be able to create a database named dbase.

Creating our Login Form

Next, we create our sample login form. Create a new file, name it as index.php and paste the codes below.

<?php
        session_start();
 
        //redirect to home if session has been set
        if(isset($_SESSION['user'])){
                header('location:home.php');
                exit();
        }
?>
<!DOCTYPE html>
<html>
<head>
        <meta charset="utf-8">
        <title>How to Change Password using PHP</title>
        <link rel="stylesheet" type="text/css" href="bootstrap/css/bootstrap.min.css">
</head>
<body>
<div class="container">
        <h1 class="page-header text-center">Change Password using PHP</h1>
        <div class="row">
                <div class="col-sm-4 col-sm-offset-4 panel panel-default" style="padding:20px;">
                        <form method="POST" action="login.php">
                                <p class="text-center" style="font-size:30px;"><b>Login</b></p>
                                <hr>
                                <div class="form-group">
                                        <label for="username">Username:</label>
                                        <input type="text" name="username" id="username" class="form-control">
                                </div>
                                <div class="form-group">
                                        <label for="password">Password:</label>
                                        <input type="password" name="password" id="password" class="form-control">
                                </div>
                                <button type="submit" name="login" class="btn btn-primary"><span class="glyphicon glyphicon-log-in"></span> Login</button>
                        </form>
                        <?php
                                if(isset($_SESSION['error'])){
                                        ?>
                                        <div class="alert alert-danger text-center" style="margin-top:20px;">
                                                <?php echo $_SESSION['error']; ?>
                                        </div>
                                        <?php
 
                                        unset($_SESSION['error']);
                                }
                        ?>
                </div>
        </div>
</div>
</body>
</html>

Creating our Login Script

Lastly, we create our login script that checks our user. Create a new file, name it as login.php and paste the codes below.

<?php
        session_start();
 
        if(isset($_POST['login'])){
                //connection
                $conn = new mysqli('localhost', 'root', '', 'dbase');
 
                //get the user with the username
                $sql = "SELECT * FROM users WHERE username = '".$_POST['username']."'";
                $query = $conn->query($sql);
                if($query->num_rows > 0){
                        $row = $query->fetch_assoc();
                        //verify password
                        if(password_verify($_POST['password'], $row['password'])){
                                $_SESSION['user'] = $row['id'];
                        }
                        else{
                                $_SESSION['error'] = 'Password incorrect';
                        }
                }
                else{
                        $_SESSION['error'] = 'No account with that username';
                }
 
        }
        else{
                $_SESSION['error'] = 'Fill up login form first';
        }
 
        header('location: index.php');
 
?>

Creating our Homepage

Next, we create the page where our verified users are directed. It also contains our change password form. Create a new file, name it as home.php and paste the codes below.

<?php
        session_start();
 
        //redirect ot login page if not logged in
        if(!isset($_SESSION['user'])){
                header('location:index.php');
                exit();
        }
 
        //connection
        $conn = new mysqli('localhost', 'root', '', 'dbase');
 
        //get user details
        $sql = "SELECT * FROM users WHERE id = '".$_SESSION['user']."'";
        $query = $conn->query($sql);
        $row = $query->fetch_assoc();
 
?>
<!DOCTYPE html>
<html>
<head>
        <meta charset="utf-8">
        <title>How to Change Password using PHP</title>
        <link rel="stylesheet" type="text/css" href="bootstrap/css/bootstrap.min.css">
</head>
<body>
<div class="container">
        <h1 class="page-header text-center">Change Password using PHP</h1>
        <div class="row">
                <div class="col-sm-4 col-sm-offset-4 panel panel-default" style="padding:20px;">
                        <h3>Welcome, <?php echo $row['username']; ?>
                                <span class="pull-right">
                                        <a href="logout.php" class="btn btn-danger btn-sm"><span class="glyphicon glyphicon-log-out"></span> Logout</a>
                                </span>
                        </h3>
                        <hr>
                        <form method="POST" action="change_password.php">
                                <div class="form-group">
                                        <label for="old">Old Password:</label>
                                        <input type="password" name="old" id="old" class="form-control" value="<?php echo (isset($_SESSION['old'])) ? $_SESSION['old'] : ''; ?>">
                                </div>
                                <div class="form-group">
                                        <label for="new">New Password:</label>
                                        <input type="password" name="new" id="new" class="form-control" value="<?php echo (isset($_SESSION['new'])) ? $_SESSION['new'] : ''; ?>">
                                </div>
                                <div class="form-group">
                                        <label for="retype">Retype New Password:</label>
                                        <input type="password" name="retype" id="retype" class="form-control" value="<?php echo (isset($_SESSION['retype'])) ? $_SESSION['retype'] : ''; ?>">
                                </div>
                                <button type="submit" name="update" class="btn btn-success"><span class="glyphicon glyphicon-check"></span> Update</button>
                        </form>
                        <?php
                                if(isset($_SESSION['error'])){
                                        ?>
                                        <div class="alert alert-danger text-center" style="margin-top:20px;">
                                                <?php echo $_SESSION['error']; ?>
                                        </div>
                                        <?php
 
                                        unset($_SESSION['error']);
                                }
                                if(isset($_SESSION['success'])){
                                        ?>
                                        <div class="alert alert-success text-center" style="margin-top:20px;">
                                                <?php echo $_SESSION['success']; ?>
                                        </div>
                                        <?php
 
                                        unset($_SESSION['success']);
                                }
                        ?>
                </div>
        </div>
</div>
</body>
</html>

Creating our Change Password Script

Next, we create the script that changes the users password. Create a new file, name it as change_password.php.

<?php
        session_start();
 
        if(isset($_POST['update'])){
                //get POST data
                $old = $_POST['old'];
                $new = $_POST['new'];
                $retype = $_POST['retype'];
 
                //create a session for the data incase error occurs
                $_SESSION['old'] = $old;
                $_SESSION['new'] = $new;
                $_SESSION['retype'] = $retype;
 
                //connection
                $conn = new mysqli('localhost', 'root', '', 'dbase');
 
                //get user details
                $sql = "SELECT * FROM users WHERE id = '".$_SESSION['user']."'";
                $query = $conn->query($sql);
                $row = $query->fetch_assoc();
 
                //check if old password is correct
                if(password_verify($old, $row['password'])){
                        //check if new password match retype
                        if($new == $retype){
                                //hash our password
                                $password = password_hash($new, PASSWORD_DEFAULT);
 
                                //update the new password
                                $sql = "UPDATE users SET password = '$password' WHERE id = '".$_SESSION['user']."'";
                                if($conn->query($sql)){
                                        $_SESSION['success'] = "Password updated successfully";
                                        //unset our session since no error occured
                                        unset($_SESSION['old']);
                                        unset($_SESSION['new']);
                                        unset($_SESSION['retype']);
                                }
                                else{
                                        $_SESSION['error'] = $conn->error;
                                }
                        }
                        else{
                                $_SESSION['error'] = "New and retype password did not match";
                        }
                }
                else{
                        $_SESSION['error'] = "Incorrect Old Password";
                }
        }
        else{
                $_SESSION['error'] = "Input needed data to update first";
        }
 
        header('location: home.php');
        
?>

Creating our Logout Script

Lastly, we create our logout script. Create a new file, name it as logout.php and paste the codes below.

<?php
        session_start();
        session_destroy();
        header('location: index.php');
?>

That ends this tutorial. Happy Coding :)

Comments

Appreciation

Thanks a lot, your code really helped me. Thank you

what is the username and…

what is the username and password ? so that I can login

qweeqwew

Creating our Database First we create our database which contains our sample user. I've included a SQL file in the downloadable of this tutorial. All you have to do is import the said file. If you have no idea on how to import, please visit my tutorial How import .sql file to restore MySQL database. You should be able to create a database named dbase.

what is the password to test…

what is the password to test change password ??? username : nurhodelta pass: $2y$10$AP027M5jhULJPIBAUiCa0e0phP1UAQBlKqTLLQZ2.UL44x5DdUwHq

Add new comment

Add new comment
10156 views