title: codeigniter change password
body: <p>i am new to codeigniter and trying to write a secure code to change user password. please help me</p>
  
  <p>my Controller function are</p>
  
  <pre><code>public function change_password()
            {
  
              $data = array( "main_content" =&gt; 'includes/memberadmin/memberadmin_cpass'
                  );
                  $this-&gt;load-&gt;view('includes/memberadmin/template',$data);
            }
  
          public function change_password_process()
          {
  
          $this-&gt;load-&gt;library('form_validation');
          $this-&gt;form_validation-&gt;set_rules('old_password','Old Password','trim|required|min_length[4]|max_length[32]');
          $this-&gt;form_validation-&gt;set_rules('password','Password','trim|required|min_length[4]|max_length[32]');
          $this-&gt;form_validation-&gt;set_rules('password2','Reenter Password','trim|required|min_length[4]|max_length[32]|matches[password]');
  
          if ($this-&gt;form_validation-&gt;run() == FALSE)
          {
              $this-&gt;change_password();
  
          }else {
              $this-&gt;load-&gt;model('membership_model');
              $query=$this-&gt;membership_model-&gt;change_password();
  
  
                  $data = array( "main_content" =&gt; 'includes/memberadmin/memberadmin_cpass_process',
                  "query" =&gt; $query
                  );
                  $this-&gt;load-&gt;view('includes/memberadmin/template',$data);
  
  
          }
  </code></pre>
  
  <p>my model functions are</p>
  
  <pre><code>function Change_password()
          {   
          $this-&gt;db-&gt;select('id');
          $this-&gt;db-&gt;where('username',$this-&gt;session-&gt;userdata('uname'));
          $this-&gt;db-&gt;where('password',md5($this-&gt;input-&gt;post('old_password')));
          $query=$this-&gt;db-&gt;get('memberadmin');   
  
          if ($query-&gt;num_rows() &gt; 0)
           {
                  $row = $query-&gt;row();
                  if($row-&gt;id==$this-&gt;session-&gt;userdata('uid'))
                  {
                      $data = array(
                        'password' =&gt; md5($this-&gt;input-&gt;post('password'))
                       );
                    $this-&gt;db-&gt;where('username',$this-&gt;session-&gt;userdata('uname'));
                    $this-&gt;db-&gt;where('password',md5($this-&gt;input-&gt;post('old_password')));
                         if($this-&gt;db-&gt;update('memberadmin', $data)) 
                         {
                         return "Password Changed Successfully";
                         }else{
                          return "Something Went Wrong, Password Not Changed";
                         }
                  }else{
                  return "Something Went Wrong, Password Not Changed";
                  }
  
  
           }else{
              return "Wrong Old Password";
           }
  
          }
  </code></pre>
  
  <p>Actually my userid and username is stored in session and i try to get username from table and again match the return userid with session userid for extra security and then change password.</p>
  
  <p>Please let me know does my code is secure or i am doing something wrong.</p>