php - I'm trying to make a change password page for my website. What am I doing wrong? -

i have page on website allows users change passwords

the form asks username, current password, new password, confirm new password.

if user enters incorrect username, form won't change password.

but if user enters wrong password, form changes password anyway.

my code pasted below, if can help, grealt appreciative! thanks!

joost

changepassword information screen:

<div id="inlogscherm">     <form name="form1" method="post" action="changepw.php">         <div class="textm">change password</div><br>         <div class="text">username:</div><div class="invulbalkje"><? echo "{$_session['myusername']}"; ?></div><br />         <input name="username" type="hidden" id="username" value="<? echo "{$_session['myusername']}"; ?>">         <div class="text">password:</div><input name="npassword" type="password" id="npassword" class="invulbalkje"><br />         <div class="text">new password:</div><input name="newpassword" type="password" id="newpassword" class="invulbalkje"><br />         <div class="text">repeat new password:</div><input name="repeatnewpassword" type="password" id="repeatnewpassword" class="invulbalkje"><br />         <input type="submit" name="submit" value="change" class="button">     </form> </div> 

here php change.(changepw.php)

    <?php  session_start();  $host="localhost";  $username=",";  $password=",";   $db_name=",";   $tbl_name=",";  mysql_connect("$host", "$username", "$password")or die("cannot connect");  mysql_select_db("$db_name")or die("cannot select db");  $username = $_post['username']; $password = $_post['password']; $newpassword = $_post['newpassword']; $repeatnewpassword = $_post['repeatnewpassword'];  $encrypted_password=md5($password); $encrypted_newpassword=md5($newpassword);  $result = mysql_query("select password $tbl_name username='$username' , password = '$encrypted_password'");  if(!$result)  {      header("location:error1.php");  }  if(mysql_num_rows($result)){     if($newpassword==$repeatnewpassword){         $sql=mysql_query("update $tbl_name set password='$encrypted_newpassword' username='$username'");                 if($sql)          {                  header("location:success.php");         }         else         {             header("location:error3.php");         }            } else {          header("location:error_password_not_matched.php");     } } else {      header("location:error.php");  } ?>  

if see problem please contact me. thankful that!

here 1 error, have found.

that it, in form, using npassword name password field , @ time of getting $password = $_post['password']; name password can see here.

so change code:

$password = $_post['password']; 

with

$password = $_post['npassword']; 

and work.