Question

I have a form that updates an MD5 encrypted password. At this point in the process the password field has been updated to a random token that was then sent to the user via email as part of a link and then that token is used to match up the account to update.

I have to check two tables because we broke out the admin and users into different tables. I’m getting the following SQL error. SQL and CodeIgniter are both pretty new to me.

SQL Error:

Error Number: 1064

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'UNION UPDATE staff SET staff_password = '098f6bcd4621d373cade4e832627b4f6' WHERE' at line 1

UPDATE admin SET admin_password = '098f6bcd4621d373cade4e832627b4f6' WHERE admin_password = 'fd323219f98afd367fee9907173012db' UNION UPDATE staff SET staff_password = '098f6bcd4621d373cade4e832627b4f6' WHERE staff_password = 'fd323219f98afd367fee9907173012db'

Model Code:

public function update_password() {
    $sql = "UPDATE admin SET admin_password = ? WHERE admin_password = ? UNION UPDATE staff SET staff_password = ? WHERE staff_password = ?";
    $password = $this->input->post('password');
    $token = $this->input->post('token');
    $query = $this->db->query($sql, array($password, $token, $password, $token));

    if($query->num_rows() == 1) {
        return true;
    } else {
        return false;
    }
}

The token is set as a hidden field in the view:

<input type="hidden" name="token" value="<?php echo $token;?>" id="token">

Answer 1

You can update the tables individually:

$this->db->update('admin',array('admin_password'=>'098f6bcd4621d373cade4e832627b4f6'),'id = 123');
$this->db->update('staff',array('staff_password'=>'098f6bcd4621d373cade4e832627b4f6'),'id = 456');

You could also use method chaining:

$this->db->where('id','123')->update('admin',array('admin_password'=>'newpass'));

As tadman said, much better to check on the users ID rather than the password.

Check out https://www.codeigniter.com/userguide2/database/active_record.html

And for future reference: https://www.codeigniter.com/userguide2/libraries/encryption.html