Allow users to change random password

[rskuse]

I currently use a script to register users on a site that generates a random password using MD5 eg...

function makeRandomPassword() {
$salt = "abcdefghjkmnpqrstuvwxyz0123456789";
srand((double)microtime()*1000000);
$i = 0;
while ($i <= 7) {
$num = rand() % 33;
$tmp = substr($salt, $num, 1);
$pass = $pass . $tmp;
$i++;
}
return $pass;
}

$random_password = makeRandomPassword();

$db_password = md5($random_password);

My script works fine and users can login successfully but I would like them to be able to change their password to one of their own choice by allowing them to enter their old password (that was randomly generated) and then entering a new password that will update MySQL database.
I have attempted to do this myself by querying the database and updating the field if the data is correct but it has not worked.

Can anyone give me a clue as to how I can do this??

Thankyou in advance....

 

[sleipnir214]

Exactly what have you tried?

If you issue a query like:

UPDATE usertable SET passwd=md5('[newpassword]') WHERE username='[user-name'] AND passwd=md5('[oldpassword]')

You can then issue mysql_affected_rows() to see whether the change was successful.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[jgd12345]

What I do is on the form I'll have <input type=&quot;password&quot; name=&quot;oldpassword&quot;> and then you need to compare the variable md5($oldpassword) with the value for the password stored in the database.

 

[DRJ478]

sleipnirs SQL statment does exactly that - and more.

If you just want to compare the entered old password you could use:

$SQL = "SELECT COUNT(username) AS num WHERE username='[username]' AND passwd=md5('[oldpassword]')";
$result = mysql_query($SQL, $conn);
# get the row
$row = mysql_fetch_array($result);
# should be 1
if ($row['num'] == 1){
   # etc.
[code]

However, sleipnir's SQL only updates when the oldpassword matches. You can check the number of rows affected by the SQL statement and if it's 0 the oldpassword was wrong.