0byt3m1n1
Path:
C:
/
wamp64
/
www
/
cpms_new
/
ED
/
[
Home
]
File: changepassword_ctrl.php
<?php require_once "../lib/config.php"; require_once "../model/employee_mdl.php"; require_once BASE_DIR."/lib/db/connection.php"; $ex_password=""; $newpassword=""; $confirmpassword=""; $error_flag=0; $ex_password=@$_POST['txtex_password']; $newpassword=@$_POST['txtnewpassword']; $confirmpassword=@$_POST['txtconfirmpassword']; $user_id=@$_SESSION['user_id']; //---------Null---/ if($ex_password=="") { $error['password_null']="Please Enter Existing password"; $error_flag=1; } if($newpassword=="") { $error['newpassword_null']="Please Enter newpassword"; $error_flag=1; } if($confirmpassword=="") { $error['confirmpassword_null']="Please Enter confirmpassword"; $error_flag=1; } if($confirmpassword!=$newpassword) { $error['confirm_null']="Password mismatch "; $error_flag=1; } $mysqli = new mysqli("localhost", "root", "", "cpms"); if ($mysqli->connect_error) { die("Connection failed: " . $mysqli->connect_error); } $user_id = $mysqli->real_escape_string($user_id); $sql = "SELECT * FROM `user` WHERE `user_id` = '$user_id'"; $result = $mysqli->query($sql); $ex_db_password = ""; if ($result && $result->num_rows > 0) { $row = $result->fetch_assoc(); $ex_db_password = $row['passwd']; $result->free(); } else { echo "Error: " . $mysqli->error; } $mysqli->close(); if (!empty($ex_db_password) && $ex_db_password !== $ex_password) { $error['password_null'] = "Invalid password"; $error_flag = 1; } if($error_flag==1) { include("changepassword.php"); exit(); } else { $mysqli = new mysqli("localhost", "root", "", "cpms"); if ($mysqli->connect_error) { die("Connection failed: " . $mysqli->connect_error); } $user_id = $mysqli->real_escape_string($user_id); $newpassword = $mysqli->real_escape_string($newpassword); $sql = "UPDATE `user` SET `passwd` = '$newpassword' WHERE `user_id` = '$user_id'"; $result = $mysqli->query($sql); if ($result) { $affected_rows = $mysqli->affected_rows; if ($affected_rows > 0) { $message = "Password updated"; @$_SESSION['password'] = $newpassword; $url = $server_ip . "ED/changepassword.php?message=$message"; echo "<script>window.location='$url'</script>"; exit(); } else { $message = "Password not updated"; $url = $server_ip . "ED/changepassword.php?message=$message"; echo "<script>window.location='$url'</script>"; exit(); } } else { echo "Error: " . $mysqli->error; } $mysqli->close(); } ?>