title: changing user password in mysql, check old password matches and make new password compulsory?
body: <p>can someone please help, i have this change password script that allows a user to change their password.</p>
  
  <p>at the moment it lets the user change their password despite what they put in the old password box. can someone please show me how i can get it to check that the old password matches with that stored in 'ptb_users.password' ?</p>
  
  <p>Also it currently lets a user set their password to nothing, is there a way i can make the enw password and confirm password fields compulsory?</p>
  
  <p>Thanks.</p>
  
  <pre><code>&lt;?php
  require_once("session.php"); 
  require_once("functions.php");
  require('_config/connection.php');
  ?&gt;
  &lt;?php 
  
  session_start();
  
  include '_config/connection.php'; 
  
  
  $password = md5($_POST['password']);
  $newpassword = md5($_POST['newpassword']);
  
  $result = mysql_query("SELECT password FROM ptb_users WHERE id=".$_SESSION['user_id']." AND password = '".$password."'");
  if(!$result) 
  { 
  echo "The username you entered does not exist or old password didn't match"; 
  } 
  else
  {
       $sql=mysql_query("UPDATE ptb_users SET password='$newpassword' WHERE id=".$_SESSION['user_id'].""); 
  }
  if($sql) 
  { 
      echo "Thank You. Your Password has been successfully changed."; 
  }
  ?&gt;
  </code></pre>