title: let user change their own password?
body: <p>I am just starting to learn php and sql so please go easy on me, i know i'm going to be wrong in certain places. I am trying to allow a user to login and be able to change their password. I have made an attempt of a script which i believe should work, but i guess i'm doing something wrong as it will just link to the php function page and not change the password at all. Here's my script:</p>
  
  <p>HTML form:</p>
  
  <pre><code>&lt;form method="POST" action="includes/changepassword.php"&gt;
  &lt;p&gt;&lt;input type="password" name="oldpasswd" id="oldpasswd" maxlength="30" placeholder="Old Password"&gt;&lt;/p&gt;
  &lt;p&gt;&lt;input type="password" name="newpsswd1" id="newpsswd1" maxlength="30" placeholder="New Password"&gt;&lt;/p&gt;
  &lt;p&gt;&lt;input type="password" name="newpsswd2" id="newpsswd2"maxlength="30" placeholder="Confirm Password"&gt;&lt;/p&gt;
  &lt;input type="submit" name="submit" id="submit" value="change password"&gt;
  </code></pre>
  
  <p>changepassword.php file:</p>
  
  <pre><code> &lt;?php
  require_once("session.php"); 
  require_once("functions.php");
  require('_config/connection.php');
  function changepassword ($oldpasswd, $newpasswd1, $newpasswd2) {
      /*
       * RETURNS
       * 0 - if password changed
       * 1 - if new passwords are not equal
       * 2 - if user authentification problems
       */
  
  
          $oldpasswd = ($_POST['oldpasswd']);
          $newpasswd1 = ($_POST['newpasswd1']);
          $newpasswd1 = ($_POST['newpasswd2']);
  
  
  
  
      if ($newpasswd1 != $newpasswd2) {
          return 1;
      }
  
      //check user logged in changes OWN passwd
      $sql = "SELECT password FROM ptb_users WHERE id = ".$_SESSION['user_id'];
      $result = mysql_query($sql)or die('User not found: ' . mysql_error());
  
      if (md5($oldpasswd)==$result) { 
  
          //Encrypt $emailpassword in MD5 format for the database
          $md5_np=md5($newpasswd1);
  
          // Make a safe query
          $query = sprintf("UPDATE `ptb_users` SET `password` = '%s' 
                      WHERE `id` = ".$_SESSION['user_id'],
                      mysql_real_escape_string($md5_np));
  
          mysql_query($query)or die('Could not update password: ' . mysql_error());
          return 0;
      } else {
          return 2;
      }
  
  
  }   
  ?&gt;
  </code></pre>
  
  <p>What have I done wrong?</p>