PHP password change system, the password is still changed after entering the wrong password

Question

<?php 
  session_start (); 
  $username = $_REQUEST ["username"]; 
  $oldpassword = $_REQUEST ["oldpassword"]; 
  $newpassword = $_REQUEST ["newpassword"]; 
  $con = mysql_connect ( "localhost", "root", "root" ); 
  if (! $con) { 
    die ( '数据库连接失败' . $mysql_error () ); 
  } 
  mysql_select_db("mtdb",$con);
  $dbusername = null; 
  $dbpassword = null; 
  $result = mysql_query ( "select * from t_account where username ='{$username}'" ); 
  while ( $row = mysql_fetch_array ( $result ) ) { 
    $dbusername = $row ["username"]; 
    $dbpassword = $row ["password"]; 
  } 
  if (is_null ( $dbusername )) { 
    ?> 
  <script type="text/javascript"> 
    alert("用户名不存在"); 
    window.location.href="changepasswd.html"; 
  </script>  
  <?php 
  } 
  if ($oldpassword!=$dbpassword) { 
    ?> 
  <script type="text/javascript"> 
    alert("密码错误"); 
window.location.href="changepasswd.html"; 
  </script> 
  <?php 
  } 
  mysql_query ( "update t_account set password='{$newpassword}' where username='{$username}'" ) or die ( "存入数据库失败" . mysql_error () );//如果上述用户名密码判定不错，则update进数据库中 
  mysql_close ( $con ); 
  ?> 
  <script type="text/javascript"> 
    alert("密码修改成功"); 
    window.location.href="changepasswd.html"; 
  </script>

The code is written according to http://blog.csdn.net/qazcxh/article/details/45726911. The problem now is that after entering the wrong password, it will prompt that the password is incorrect, but the database will be updated with the new one. Password, please tell me how to change it

Answer 1

After displaying the content, the php program will continue to execute until it encounters termination such as die(), exit() or until the execution is completed.
So there are two ways to deal with your problem

1. Add die after judgment
2. Put the code after judgment into else

Answer 2

if ($oldpassword!=$dbpassword) {

?>

<script type="text/javascript">

alert("Password Error");

window.location.href="changepasswd.html";

</script>

<?php

mysql_query ( "update t_account set password='{$newpassword}' where username='{$username}'" ) or die ( "Failed to save to database" . mysql_error () );//If the above username and password are judged well, then update into the database

}

mysql_close ($con);

?>

这样你吧更新语句放外面，无论什么密码都会更新啊= = 还有 mysql不要用了尽量使用mysqli吧

Answer 3

The simplest method is

In the password judgment, after judging that the password is incorrect, add die; to terminate the program