Question

I store user passwords as a plain text in the database. So it’s easy to change the password. I use this code,

while($row = mysql_fetch_array($result)) {
  if($row['Password']==$opass)
    mysql_query(
      "UPDATE information SET Password='$pass' WHERE Username='$name'"
    );
}

First I am checking that user put his old password correctly ($opass), then I allow him to change it to new password ($pass). I think I could check old password because I stored it as plain text. But if I use any hash algorithm, how could this if($row['Password']==$opass) code work? I think $opass and $row['Password'] won’t be same.

Answer 1

Just hash the user inputted password with the equivalent hashing function, and compare that to what you have stored in your database.

while($row = mysql_fetch_array($result)){
 if($row['Password']==yourOneWayPasswordHashingFunction($opass))
  mysql_query("UPDATE information SET Password='$pass' WHERE Username='$name'");}

As I mentioned in the comments, use bcrypt. Passwords can be hard, so use this, and then go shopping, in time for xmas too 🙂

Also…

I store user passwords as a plain text in the database. So it’s easy to change the password.

_{Emphasis mine.}

You should never store plain text passwords, and it’s easy to change is not a valid reason. Kudos, however, for recognising the need to do something about it.