I want the user to enter their account number and username to confirm their identity and change the password.
The code works if I only enter the user name to be confirmed, but I can not seem to get the extra injection in the sql to work.
I want the SQL to say that
WHERE account = ? AND username = ?;But it does not work. I tried everything that came to mind. I have been here for a week. Please help.
// Prepare an update statement
$sql = "UPDATE vendors SET password = ? WHERE account = ?";
I'm not sure if it's the way I issue the variables or if I put it wrong, that it just does not complete it if I add the username option.
if($stmt = mysqli_prepare($link, $sql)){
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "si", $param_password, $param_account);
// Set parameters
$param_password = password_hash($new_password, PASSWORD_DEFAULT);
$param_account = $account;
// Attempt to execute the prepared statement
if(mysqli_stmt_execute($stmt)){
// Store result
mysqli_stmt_store_result($stmt);
// Check if account exists, if yes then verify password
if(mysqli_stmt_num_rows($stmt) !== 1){
// Bind result variables
mysqli_stmt_bind_result($account);
// submited
session_start();
// Store data in session variables
$_SESSION("loggedin") = true;
$_SESSION("id_users") = $id_users;
$_SESSION("account") = $account;
echo "you made it";
} else{
// Display an error message if password is not valid
$password_err = "The password you entered was not valid.";
}
}
} else{
// Display an error message if account doesn't exist
$account_err = "No account found with that Security Number.";
}
} else{
echo "Oops! Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
}
// Close connection
mysqli_close($link);
?>
