Change a Member Password Securely in PHP

SQL concepts used: SELECT · UPDATE · WHERE

<?php
session_start();
$memberId = $_SESSION['member_id'] ?? 0;
$currentPassword = $_POST['current_password'] ?? '';
$newPassword = $_POST['new_password'] ?? '';

$stmt = $pdo->prepare(
    'SELECT password_hash FROM members WHERE id = :id'
);
$stmt->execute([':id' => $memberId]);
$storedHash = $stmt->fetchColumn();

if (!$storedHash || !password_verify($currentPassword, $storedHash)) {
    exit('Current password is not correct.');
}

if (strlen($newPassword) < 12) {
    exit('Choose a longer password.');
}

$newHash = password_hash($newPassword, PASSWORD_DEFAULT);
$stmt = $pdo->prepare(
    'UPDATE members SET password_hash = :hash WHERE id = :id'
);
$stmt->execute([':hash' => $newHash, ':id' => $memberId]);

session_regenerate_id(true);
?>

Using JQuery

Checking user Session status

// check the login details of the user and stop execution if not logged in

require "check.php";

<?Php
if(!isset($_SESSION['userid'])){
echo "<center><font face='Verdana' size='2' color=red>
Sorry, Please login and use this page </font></center>";
exit;
}
?>

$todo=$_POST['todo'];
$password=$_POST['password'];
$password2=$_POST['password2'];
$old_password=$_POST['old_password'];

$status = "OK";
$msg="";

Verify the current password and store the replacement securely

Load the stored hash with a prepared query, verify the current password, validate the new password, then store a fresh hash. Do not compare password hashes with md5() or place the session user ID directly inside the SQL string.

<?php
$currentPassword = (string) ($_POST['old_password'] ?? '');
$newPassword = (string) ($_POST['password'] ?? '');
$confirmPassword = (string) ($_POST['password2'] ?? '');
$userId = $_SESSION['userid'] ?? null;

$stmt = $dbo->prepare('SELECT password FROM plus_signup WHERE userid = :userid');
$stmt->execute(['userid' => $userId]);
$storedHash = $stmt->fetchColumn();

if (!is_string($storedHash) || !password_verify($currentPassword, $storedHash)) {
    throw new RuntimeException('Current password is incorrect.');
}
if ($newPassword !== $confirmPassword || strlen($newPassword) < 12) {
    throw new InvalidArgumentException('Choose a matching password of at least 12 characters.');
}

$newHash = password_hash($newPassword, PASSWORD_DEFAULT);
$update = $dbo->prepare('UPDATE plus_signup SET password = :password WHERE userid = :userid');
$update->execute(['password' => $newHash, 'userid' => $userId]);
?>

After changing the password, invalidate other authenticated sessions if your application supports session management across devices.

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: