Changing a user's password
basic structure/design

I would not echo in a class, but throw an exception instead. That way, the calling class can decide how to handle these problems, and your class will thus be more flexible.

Your class also does two things: It changes a password, and it redirects. I would leave the redirection to the calling class as well (but this is probably a matter of taste).

is_empty

The is_empty function doesn't seem to be working correctly. 

If only one of the two fields is filled in by the user, Field/s are empty is echoed, but set_values is called anyways. 

In this case it doesn't really matter, because it will not do anything. But then your function could be simplified to:

private function is_empty(){
    foreach($_POST as $post_value){
        if(empty($post_value)){
            echo "Field/s are empty";
            break;
        }
    }

    $this-&gt;set_values();
}


An alternative way would be to move that check into set_values, where all the other checks also take place:

    if ($this-&gt;password_one == "" || $this-&gt;password_two == "") {
        $this-&gt;show_message("Field/s are empty");
    } else if($this-&gt;password_one != $this-&gt;password_two){
        $this-&gt;show_message("Please make sure the passwords match");
    }else if (strlen($this-&gt;password_one) &lt;= 10) {
        $this-&gt;show_message("The password you provided is too weak");
    } else {
        $this-&gt;password_one = md5($this-&gt;password_one);
        $this-&gt;change_password_to_new();
    }


Note that I rearranged the if statements for more readability, and used the shoe_message method for all messages, instead of using echo.

Naming


is_posted doesn't seem like an optimal name, although I have problems coming up with a better name.
PHP class names should be in CamelCase


Misc


I would not change a user password. If a user wants their password to be "    &lt;p&gt;  \'  &lt;!-- super good password --&gt; why not let them? In addition to annoying users, this could also lead to real problems, because you have to use those exact filter functions everywhere where the user supplies a password, as otherwise some users will not be able to login.
in set_values, the or (strlen($this-&gt;password_two) &gt; 10 check is unnecessary, as password_one and password_two are equal and password_one is already checked.
security: md5 isn't really considered good enough anymore. If possible, you should use bcrypt (password_hash in PHP) or pbkdf2 instead.