title: Change password script works but doesn't write correct password into database
body: <p>I have this script for change password :</p>
  
  <pre><code>&lt;?php
  /*
  Page/Script Created by Shawn Holderfield
  */
  
  //Establish output variable - For displaying Error Messages
  $msg = "";
  
  //Check to see if the form has been submitted
  if (mysql_real_escape_string($_POST['submit'])):
  
      //Establish Post form variables
      $username = mysql_real_escape_string($_POST['username']);
      $password = mysql_real_escape_string(md5($_POST['password']));
      $npassword = mysql_real_escape_string(md5($_POST['npassword']));
      $rpassword = mysql_real_escape_string(md5($_POST['rpassword']));
  
      //Connect to the Database Server
      mysql_connect("mysql..", "", "")or die(mysql_error());
  
      // Connect to the database
      mysql_select_db("") or die(mysql_error());
  
      // Query the database - To find which user we're working with
      $sql = "SELECT * FROM members WHERE username = '$username' ";
      $query = mysql_query($sql);
      $numrows = mysql_num_rows($query);
      //Gather database information
      while ($rows = mysql_fetch_array($query)):
  
          $username == $rows['username'];
          $password == $rows['password'];
  
  
      endwhile;
  
      //Validate The Form
      if (empty($username) || empty($password) || empty($npassword) || empty($rpassword)):
  
          $msg = "All fields are required";
  
      elseif ($numrows == 0):
  
          $msg = "This username does not exist";
  
      elseif ($password != $password):
  
          $msg = "The CURRENT password you entered is incorrect.";
  
      elseif ($npassword != $rpassword):
  
          $msg = "Your new passwords do not match";
  
      elseif ($npassword == $password):
  
          $msg = "Your new password cannot match your old password";
  
      else:
  
          //$msg = "Your Password has been changed.";
          mysql_query("UPDATE members SET password = '$npassword' WHERE username = '$username'");
  
  
  
          endif;
  endif;
  
  ?&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;title&gt;Change Password&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
              &lt;form method="POST" action=""&gt;
                  &lt;table border="0"&gt;
                      &lt;tr&gt;
                          &lt;td align="right"&gt;Username: &lt;/td&gt;
                          &lt;td&gt;&lt;input type="TEXT" name="username" value=""/&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                      &lt;tr&gt;
                          &lt;td align="right"&gt;Current Password: &lt;/td&gt;
                          &lt;td&gt;&lt;input type="password" name="password" value=""/&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                      &lt;tr&gt;
                          &lt;td align="right"&gt;New Password: &lt;/td&gt;
                          &lt;td&gt;&lt;input type="password" name="npassword" value=""/&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                      &lt;tr&gt;
                          &lt;td align="right"&gt;Repeat New Password: &lt;/td&gt;
                          &lt;td&gt;&lt;input type="password" name="rpassword" value=""/&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                      &lt;tr&gt;&lt;td&gt;
                          &lt;input type="submit" name="submit" value="Change Password"/&gt;
                          &lt;/td&gt;
                      &lt;/tr&gt;
                  &lt;/table&gt;
              &lt;/form&gt;
          &lt;br&gt;
  &lt;?php echo $msg; ?&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>This actually works fine, access databse and overwrite the current password, but it does not hash the password like while registration 
  Registration process script:</p>
  
  <pre><code>&lt;?php
  include_once 'db_connect.php';
  include_once 'psl-config.php';
  
  $error_msg = "";
  
  if (isset($_POST['username'], $_POST['email'], $_POST['p'])) {
      // Sanitize and validate the data passed in
      $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
      $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
      $email = filter_var($email, FILTER_VALIDATE_EMAIL);
      if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
          // Not a valid email
          $error_msg .= '&lt;p class="error"&gt;The email address you entered is not valid&lt;/p&gt;';
      }
  
      $password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
      if (strlen($password) != 128) {
          // The hashed pwd should be 128 characters long.
          // If it's not, something really odd has happened
          $error_msg .= '&lt;p class="error"&gt;Invalid password configuration.&lt;/p&gt;';
      }
  
      // Username validity and password validity have been checked client side.
      // This should should be adequate as nobody gains any advantage from
      // breaking these rules.
      //
  
      $prep_stmt = "SELECT id FROM members WHERE email = ? LIMIT 1";
      $stmt = $mysqli-&gt;prepare($prep_stmt);
  
     // check existing email  
      if ($stmt) {
          $stmt-&gt;bind_param('s', $email);
          $stmt-&gt;execute();
          $stmt-&gt;store_result();
  
          if ($stmt-&gt;num_rows == 1) {
              // A user with this email address already exists
              $error_msg .= '&lt;p class="error"&gt;A user with this email address already exists.&lt;/p&gt;';
                          $stmt-&gt;close();
          }
                  $stmt-&gt;close();
      } else {
          $error_msg .= '&lt;p class="error"&gt;Database error Line 39&lt;/p&gt;';
                  $stmt-&gt;close();
      }
  
      // check existing username
      $prep_stmt = "SELECT id FROM members WHERE username = ? LIMIT 1";
      $stmt = $mysqli-&gt;prepare($prep_stmt);
  
      if ($stmt) {
          $stmt-&gt;bind_param('s', $username);
          $stmt-&gt;execute();
          $stmt-&gt;store_result();
  
                  if ($stmt-&gt;num_rows == 1) {
                          // A user with this username already exists
                          $error_msg .= '&lt;p class="error"&gt;A user with this username already exists&lt;/p&gt;';
                          $stmt-&gt;close();
                  }
                  $stmt-&gt;close();
          } else {
                  $error_msg .= '&lt;p class="error"&gt;Database error line 55&lt;/p&gt;';
                  $stmt-&gt;close();
          }
  
      // TODO: 
      // We'll also have to account for the situation where the user doesn't have
      // rights to do registration, by checking what type of user is attempting to
      // perform the operation.
  
      if (empty($error_msg)) {
          // Create a random salt
          //$random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE)); // Did not work
          $random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));
  
          // Create salted password 
          $password = hash('sha512', $password . $random_salt);
  
          // Insert the new user into the database 
          if ($insert_stmt = $mysqli-&gt;prepare("INSERT INTO members (username, email, password, salt) VALUES (?, ?, ?, ?)")) {
              $insert_stmt-&gt;bind_param('ssss', $username, $email, $password, $random_salt);
              // Execute the prepared query.
              if (! $insert_stmt-&gt;execute()) {
                  header('Location: ../error.php?err=Registration failure: INSERT');
              }
          }
          header('Location: ./continue.php');
      }
  }
  ?&gt;
  </code></pre>
  
  <p>What can I do to fix this? I want the password that is changed to be in format like while registration. Because now, when I change password, it's hashed but not + salted so it doesnt work when logging in with new password.</p>
  
  <p>EDIT:
  Here is login script:</p>
  
  <pre><code>&lt;?php
  include_once 'psl-config.php';
  
  function sec_session_start() {
      $session_name = 'sec_session_id';   // Set a custom session name
      $secure = SECURE;
      // This stops JavaScript being able to access the session id.
      $httponly = true;
      // Forces sessions to only use cookies.
      if (ini_set('session.use_only_cookies', 1) === FALSE) {
          header("Location: ../error.php?err=Could not initiate a safe session (ini_set)");
          exit();
      }
      // Gets current cookies params.
      $cookieParams = session_get_cookie_params();
      session_set_cookie_params($cookieParams["lifetime"],
          $cookieParams["path"], 
          $cookieParams["domain"], 
          $secure,
          $httponly);
      // Sets the session name to the one set above.
      session_name($session_name);
      session_start();            // Start the PHP session 
      session_regenerate_id(true);    // regenerated the session, delete the old one. 
  }
  function login($email, $password, $mysqli) {
      // Using prepared statements means that SQL injection is not possible. 
      if ($stmt = $mysqli-&gt;prepare("SELECT id, username, password 
          FROM members
         WHERE email = ?
          LIMIT 1")) {
          $stmt-&gt;bind_param('s', $email);  // Bind "$email" to parameter.
          $stmt-&gt;execute();    // Execute the prepared query.
          $stmt-&gt;store_result();
  
          // get variables from result.
          $stmt-&gt;bind_result($user_id, $username, $db_password );
          $stmt-&gt;fetch();
  
          // hash the password
          $passwordHash = password_hash($password, PASSWORD_BCRYPT);
          if ($stmt-&gt;num_rows == 1) {
              // If the user exists we check if the account is locked
              // from too many login attempts 
  
              if (checkbrute($user_id, $mysqli) == true) {
                  // Account is locked 
                  // Send an email to user saying their account is locked
                  return false;
              } else {
                  // Check if the password in the database matches
                  // the password the user submitted.
                  if ($db_password == $password) {
                      // Password is correct!
                      // Get the user-agent string of the user.
                      $user_browser = $_SERVER['HTTP_USER_AGENT'];
                      // XSS protection as we might print this value
                      $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                      $_SESSION['user_id'] = $user_id;
                      // XSS protection as we might print this value
                      $username = preg_replace("/[^a-zA-Z0-9_\-]+/", 
                                                                  "", 
                                                                  $username);
                      $_SESSION['username'] = $username;
              $_SESSION['email'] = $email;
                      $_SESSION['login_string'] = hash('sha512', 
                                $password . $user_browser);
                      // Login successful.
                      return true;
                  } else {
                      // Password is not correct
                      // We record this attempt in the database
                      $now = time();
                      $mysqli-&gt;query("INSERT INTO login_attempts(user_id, time)
                                      VALUES ('$user_id', '$now')");
                      return false;
                  }
              }
          } else {
              // No user exists.
              return false;
          }
      }
  }
  function checkbrute($user_id, $mysqli) {
      // Get timestamp of current time 
      $now = time();
  
      // All login attempts are counted from the past 2 hours. 
      $valid_attempts = $now - (2 * 60 * 60);
  
      if ($stmt = $mysqli-&gt;prepare("SELECT time 
                               FROM login_attempts 
                               WHERE user_id = ? 
                              AND time &gt; '$valid_attempts'")) {
          $stmt-&gt;bind_param('i', $user_id);
  
          // Execute the prepared query. 
          $stmt-&gt;execute();
          $stmt-&gt;store_result();
  
          // If there have been more than 5 failed logins 
          if ($stmt-&gt;num_rows &gt; 5) {
              return true;
          } else {
              return false;
          }
      }
  }
  function login_check($mysqli) {
      // Check if all session variables are set 
      if (isset($_SESSION['user_id'], 
              $_SESSION['email'],
                          $_SESSION['username'], 
                          $_SESSION['login_string'])) {
  
          $user_id = $_SESSION['user_id'];
      $email = $_SESSION['email'];
          $login_string = $_SESSION['login_string'];
          $username = $_SESSION['username'];
  
          // Get the user-agent string of the user.
          $user_browser = $_SERVER['HTTP_USER_AGENT'];
  
          if ($stmt = $mysqli-&gt;prepare("SELECT password 
                                        FROM members 
                                        WHERE id = ? LIMIT 1")) {
              // Bind "$user_id" to parameter. 
              $stmt-&gt;bind_param('i', $user_id);
              $stmt-&gt;execute();   // Execute the prepared query.
              $stmt-&gt;store_result();
  
              if ($stmt-&gt;num_rows == 1) {
                  // If the user exists get variables from result.
                  $stmt-&gt;bind_result($password);
                  $stmt-&gt;fetch();
                  $login_check = hash('sha512', $password . $user_browser);
  
                  if ($login_check == $login_string) {
                      // Logged In!!!! 
                      return true;
                  } else {
                      // Not logged in 
                      return false;
                  }
              } else {
                  // Not logged in 
                  return false;
              }
          } else {
              // Not logged in 
              return false;
          }
      } else {
          // Not logged in 
          return false;
      }
  }
  function esc_url($url) {
  
      if ('' == $url) {
          return $url;
      }
  
      $url = preg_replace('|[^a-z0-9-~+_.?#=!&amp;;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
  
      $strip = array('%0d', '%0a', '%0D', '%0A');
      $url = (string) $url;
  
      $count = 1;
      while ($count) {
          $url = str_replace($strip, '', $url, $count);
      }
  
      $url = str_replace(';//', '://', $url);
  
      $url = htmlentities($url);
  
      $url = str_replace('&amp;amp;', '&amp;#038;', $url);
      $url = str_replace("'", '&amp;#039;', $url);
  
      if ($url[0] !== '/') {
          // We're only interested in relative links from $_SERVER['PHP_SELF']
          return '';
      } else {
          return $url;
      }
  }
  </code></pre>