Question

I am having two problems with my code below.

 <?php

$validSubmission = isset($_POST['resetpass']) && $_POST['students'] && $_POST['newpass'] && $_POST['confirmpass'];


$sql = "SELECT StudentUsername, StudentForename, StudentSurname FROM Student ORDER BY StudentUsername";

$sqlstmt = $mysqli->prepare($sql);

$sqlstmt->execute();

$sqlstmt->bind_result($dbStudentUsername, $dbStudentForename, $dbStudentSurname);

$students = array(); // easier if you don't use generic names for data 

$studentHTML = "";
$studentHTML .= '<select name="students" id="studentsDrop">' . PHP_EOL;
$studentHTML .= '<option value="">Please Select</option>' . PHP_EOL;

$outputstudent = "";

while ($sqlstmt->fetch())
{
    $student   = $dbStudentUsername;
    $firstname = $dbStudentForename;
    $surname   = $dbStudentSurname;

    if (!$validSubmission && isset($_POST['students']) && $student == $_POST['students'])
    {
        $studentHTML .= "<option value='" . $student . "' selected='selected'>" . $student . " - " . $firstname . " " . $surname . "</option>" . PHP_EOL;
    }
    else
    {
        $studentHTML .= "<option value='" . $student . "'>" . $student . " - " . $firstname . " " . $surname . "</option>" . PHP_EOL;
    }

}


$studentHTML .= '</select>';

$errormsg = (isset($errormsg)) ? $errormsg : '';

if (isset($_POST['resetpass']))
{
    //get the form data
    $studentdrop = (isset($_POST['students'])) ? $_POST['students'] : '';
    $newpass     = (isset($_POST['newpass'])) ? $_POST['newpass'] : '';
    $confirmpass = (isset($_POST['confirmpass'])) ? $_POST['confirmpass'] : '';

    //make sure all data was entered
    if ($studentdrop != "")
    {
        if ($newpass)
        {
            if (strlen($newpass) <= 5)
            {
                $errormsg = "Your Password must be a minimum of 6 characters or more";
            }
            else
            {
                if ($confirmpass)
                {
                    if ($newpass === $confirmpass)
                    {
                        //Make sure password is correct
                        $query = "SELECT StudentUsername FROM Student WHERE StudentUsername = ?";
                        // prepare query
                        $stmt  = $mysqli->prepare($query);
                        // You only need to call bind_param once
                        $stmt->bind_param("s", $username);
                        // execute query
                        $stmt->execute();
                        // get result and assign variables (prefix with db)
                        $stmt->bind_result($dbStudentUsername);
                        //get number of rows
                        $stmt->store_result();
                        $numrows = $stmt->num_rows();

                        if ($numrows == 1)
                        {
                            //encrypt new password
                            $newpassword = md5(md5("93w" . $newpass . "ed0"));

                            //update the db

                            $updatesql = "UPDATE Student SET StudentPassword = ? WHERE StudentUsername = ?";
                            $update    = $mysqli->prepare($updatesql);
                            $update->bind_param("ss", $newpassword, $username);
                            $update->execute();

                            //make sure the password is changed

                            $query = "SELECT StudentUsername, StudentPassword FROM Student WHERE StudentUsername = ? AND StudentPassword = ?";
                            // prepare query
                            $stmt  = $mysqli->prepare($query);
                            // You only need to call bind_param once
                            $stmt->bind_param("ss", $username, $newpassword);
                            // execute query
                            $stmt->execute();
                            // get result and assign variables (prefix with db)
                            $stmt->bind_result($dbStudentUsername, $dbStudentPassword);
                            //get number of rows
                            $stmt->store_result();
                            $numrows = $stmt->num_rows();

                            if ($numrows == 1)
                            {
                                $errormsg = "<span style='color: green'>Student " . $student . " - " . $firstname . " " . $surname . " has been Registered</span>";

                            }
                            else
                            {
                                $errormsg = "An error has occured, the Password was not Reset";
                            }
                        }
                    }
                    else
                    {
                        $errormsg = "Your New Password did not Match";
                    }
                }
                else
                {
                    $errormsg = "You must Confirm your New Password";
                }
            }
        }
        else
        {
            $errormsg = "You must Enter your New Password";
        }

    }
    else if ($studentdrop == "")
    {
        $errormsg = "You must Select a Student";
    }

} 

I am trying to create a rest password page where an admin can reset a student’s password.

PROBLEM 1:

In my code what I am trying to do is that if a php validation message appears (one of the $errormsg appears except for the $errormsg which displays the sucess message), then the students drop down menu should still display the option that was selected after the submission of the form occurs. Now this works for all the validation message where the user has left a text input blank, but the only validation message it doesn’t work for is when the user has not typed in matching passwords for the new and confirm passwords. If the $errormsg = "Your New Password did not Match";
occurs then the students drop down menu goes back to the Please Select option. How come it goes back to the Please Select option everytime this validation message appears and how can I keep the selected student still selected if this validation occurs?

PROBLEM 2:

If I successfully enter in all the details and submit, it does not perform the insert, yet it does not display the fail message $errormsg = "An error has occured, the Password was not Reset";
or the success message $errormsg = "<span style='color: green'>Student " . $student . " - " . $firstname . " ". $surname . " has been Registered</span>";, why is this occuring? I know the UPDATE statement is correct as I tested this in phpmyadmin.

Answer 1

$username (line 72 and onwards) is never set. I presume this should come from ‘$studentdrop’?

This means you update where StudentUsername == ”, which will fail.

To help you debug:

1. Turn on warning and notices in the error handler for writing code ( error_reporting(E_ALL); ) as it will reveal problems like this
2. As opposed to constantly counting the rows, you can save time in that the bind_result/store_value won't work unless you got a result. So you can check that value you get in bind_result - and if you had checked that `$dbStudentUsername == $username` in line 78, then it would have also thrown a wobbly at that stage.
3. When you've done the "update", you can check the number of "affected rows"; if this > 0 then the password has been updated; no need for a secondary DB query.

Hope that helps