PHP - Directing User Based On Password Entered (using Stristr)

Hi, after following lots of advice and changing to MySqli I am running into a few probs. This is me just probably missing something stupid, I know what I want, but can't figure out what query I should use and where I should place it. All the queries I have tried have failed.   I just need a query that gets the $current_stored_password from the password field on the database, to confirm the last check

elseif 
	($current_password !== $current_stored_password) {
	include 'includes/overall/header.php';
	echo $current_password . ' AND ' . $_POST['current_password'] . ' Password and password again do not match';
	include 'includes/overall/header.php';

}

Here is the whole script.

<?php
session_start();
error_reporting(0);
//ini_set('display_errors', '1');

require( 'database.php' );

$username = $_SESSION['loggedinuser'];
$current_stored_password = $_SESSION['password'];
$current_password = $_POST['current_password'];
$password = mysqli_real_escape_string($con, md5( $_POST['password']));
$password_again = mysqli_real_escape_string($con, md5( $_POST['password_again']));


// Run checks

if	(isset($_POST['current_password'], $_POST['password'], $_POST['password_again'])) {
	
if( strlen( $_POST['current_password'] ) < 8 )
    {
        include('includes/overall/header.php');
        echo "Password Must Be 8 or More Characters.";
        include('includes/overall/footer.php');
}
elseif( strlen( $_POST['password'] ) < 8 )
    {
        include('includes/overall/header.php');
        echo "Password Must Be 8 or More Characters.";
        include('includes/overall/footer.php');
    }
elseif 
		( strlen( $_POST['password_again'] ) < 8 )
    {
        include('includes/overall/header.php');
        echo "Password Must Be 8 or More Characters.";
        include('includes/overall/footer.php');
    }
elseif 
	($password !== $password_again) {
	include 'includes/overall/header.php';
	echo ' Password and password again do not match';
	include 'includes/overall/header.php';
}
elseif 
	($current_password !== $current_stored_password) {
	include 'includes/overall/header.php';
	echo $current_password . ' AND ' . $_POST['current_password'] . ' Password and password again do not match';
	include 'includes/overall/header.php';

} else {

// Define a query to run 
$query = "UPDATE `user` SET `password` = '$password' WHERE `username` = '$username'"; 

// Query the database 
$result = mysqli_query($con,$query); 

// Check if the query failed 
if( !$result ) 
{ 
   die('There was a problem executing the query ('.$query.'):<br>('.mysqli_errno($con).') '.mysqli_error($con)); 
} 

else {

include 'includes/overall/header.php';
	echo 'Password has been changed';
include 'includes/overall/footer.php';
}    
}
}

// Close the connection 
mysqli_close($con); 
?> 

At the moment the message displayed when the form is submitted is

	echo $current_password . ' AND ' . $_POST['current_password'] . ' Password and password again do not match';
 

How do I retrieve the password from the database to compare against the current password entered by the user? Any help is much appreciated.   PS. Yes I know I have repeated code and that md5 is not secure, but I am just building onto a template I got and will be making changes to shorten the code and secure the password soon    

I'm building a php program that registers users onto a website. With the help of people from this thread http://www.phpfreaks.com/forums/index.php?topic=332260.15
I was able to accomplish the goal and now the signup works with conditions that check for a valid email, and if the password is strong enough.

T he program correctly displays the the problem when a user does NOT enter a valid email, or a strong enough password, but the user has to re-enter the email and password everytime.

I want to make it so that the fields remained populated with what the user entered previously, so he or she does not have to re-enter his or her email/password.

Here is the code (its really ghetto)

Code: [Select]
<?php

function check_email_address($email) {
    // First, we check that there's one @ symbol, and that the lengths are right
    if (!ereg("^[^@]{1,64}@[^@]{1,255}$", $email)) {
        // Email invalid because wrong number of characters in one section, or wrong number of @ symbols.
        return false;
    }
    // Split it into sections to make life easier
    $email_array = explode("@", $email);
    $local_array = explode(".", $email_array[0]);
    for ($i = 0; $i < sizeof($local_array); $i++) {
         if (!ereg("^(([A-Za-z0-9!#$%&'*+/=?^_`{|}~-][A-Za-z0-9!#$%&'*+/=?^_`{|}~\.-]{0,63})|(\"[^(\\|\")]{0,62}\"))$", $local_array[$i])) {
            return false;
        }
    }    
    if (!ereg("^\[?[0-9\.]+\]?$", $email_array[1])) { // Check if domain is IP. If not, it should be valid domain name
        $domain_array = explode(".", $email_array[1]);
        if (sizeof($domain_array) < 2) {
                return false; // Not enough parts to domain
        }
        for ($i = 0; $i < sizeof($domain_array); $i++) {
            if (!ereg("^(([A-Za-z0-9][A-Za-z0-9-]{0,61}[A-Za-z0-9])|([A-Za-z0-9]+))$", $domain_array[$i])) {
                return false;
            }
        }
    }
    return true;
}

define('DB_NAME', 'catch');
define('DB_USER', 'username');
define('DB_PASS', 'password');
define('DB_HOST', 'page.sqlserver.com');

// contact to database
$connect = mysql_connect(DB_HOST, DB_USER, DB_PASS) or die('Error , check your server connection.');
mysql_select_db(DB_NAME);
  
//Get data in local variable
$v_name=$_POST['name'];
$v_email=$_POST['email'];
$v_msg=$_POST['msg'];


 if ( check_email_address($_POST['name'])  == false) 
 
 
 {
   $query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')";
$result = mysql_query( $query );

if( !$result ) {
die( mysql_error() );
}
echo <<<EOD
<head>      
<link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css">
</head>
<h2>Free Registration</h2>
<form action="contact_insert2.php" method="POST" id="insert">
<table>
<tr>
<td>Email</td>
<td ><input type="text" size="40" name="name"></td>
</tr>
    <tr>
<td>Password</td>
<td><input type="password" size="40"  name="msg" ></td>
</tr>
<tr>
<td colspan=2 id="sub">
You must enter a valid email. <br />
<input type="submit" name="submit" value="submit">
</td>
</tr>
</Table>
</form>
EOD;
}

if( $v_name == "" || $v_msg == "" )
// if name is empty or if pass is empty
{
$query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')";
$result = mysql_query( $query );

if( !$result ) {
die( mysql_error() );
}

echo <<<EOD
<head>      
<link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css">
</head>
<h2>Free Registration</h2>
<form action="contact_insert2.php" method="POST" id="insert">
<table>
<tr>
<td>Email</td>
<td ><input type="text" size="40" name="name"></td>
</tr>
    <tr>
<td>Password</td>
<td><input type="password" size="40"  name="msg" ></td>
</tr>
<tr>
<td colspan=2 id="sub">
You must enter an email and password. <br />
<input type="submit" name="submit" value="submit">
</td>
</tr>
</Table>
</form>
EOD;
}

if( strcspn( $_REQUEST['msg'], '0123456789' ) == strlen( $_REQUEST['msg'] ) )
// the above statement says if pass does not contain a number
{
$query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')";
$result = mysql_query( $query );

if( !$result ) {
die( mysql_error() );
}
echo <<<EOD
<head>      
<link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css">
</head>
<h2>Free Registration</h2>
<form action="contact_insert2.php" method="POST" id="insert">
<table>
<tr>
<td>Email</td>
<td ><input type="text" size="40" name="name"></td>
</tr>
    <tr>
<td>Password</td>
<td><input type="password" size="40"  name="msg" ></td>
</tr>
<tr>
<td colspan=2 id="sub">
<div style="color:red;">Your password must contain a number.</div> <br />
<input type="submit" name="submit" value="submit">
</td>
</tr>
</Table>
</form>
EOD;
}


if( strlen($_POST['msg']) < 8 )
// the above statement says if pass is not 8 characters long
{
$query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')";
$result = mysql_query( $query );

if( !$result ) {
die( mysql_error() );
}
echo <<<EOD
<head>      
<link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css">
</head>
<h2>Free Registration</h2>
<form action="contact_insert2.php" method="POST" id="insert">
<table>
<tr>
<td>Email</td>
<td ><input type="text" size="40" name="name"></td>
</tr>
    <tr>
<td>Password</td>
<td><input type="password" size="40"  name="msg" ></td>
</tr>
<tr>
<td colspan=2 id="sub">
<div style="color:red;">Your password must be at least 8 characters long.</div> <br />
<input type="submit" name="submit" value="submit">
</td>
</tr>
</Table>
</form>
EOD;
}


if ( $_POST['msg'] == strtolower($_POST['msg']) )
// the above statement says if pass is all lowercase
{
$query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')";
$result = mysql_query( $query );

if( !$result ) {
die( mysql_error() );
}
echo <<<EOD
<head>      
<link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css">
</head>
<h2>Free Registration</h2>
<form action="contact_insert2.php" method="POST" id="insert">
<table>
<tr>
<td>Email</td>
<td ><input type="text" size="40" name="name"></td>
</tr>
    <tr>
<td>Password</td>
<td><input type="password" size="40"  name="msg" ></td>
</tr>
<tr>
<td colspan=2 id="sub">
<div style="color:red;">Your password must have at least one capital letter.</div> <br />
<input type="submit" name="submit" value="submit">
</td>
</tr>
</Table>
</form>
EOD;
}

if ( preg_replace("/[^a-zA-Z0-9\s]/", "", $_POST['msg']) == $_POST['msg'] )
// the above statement says if pass contains no special characters
{
$query = "INSERT INTO contact(name,email,msg) VALUES ('$v_name','$v_email','$v_msg')";
$result = mysql_query( $query );

if( !$result ) {
die( mysql_error() );
}
echo <<<EOD
<head>      
<link rel="stylesheet" type="text/css" href="http://hedgezoo.com/signup.css">
</head>
<h2>Free Registration</h2>
<form action="contact_insert2.php" method="POST" id="insert">
<table>
<tr>
<td>Email</td>
<td ><input type="text" size="40" name="name"></td>
</tr>
    <tr>
<td>Password</td>
<td><input type="password" size="40"  name="msg" ></td>
</tr>
<tr>
<td colspan=2 id="sub">
<div style="color:red;">Your password must have at least one special character.</div> <br />
<input type="submit" name="submit" value="submit">
</td>
</tr>
</Table>
</form>
EOD;
}
else 
echo <<<EOD
<B>GO FUCK YOURSELF</B>
EOD;
 ?>

Code what i made so far.

$inputText = 'This is testing http://www.youtube.com';

$allowedDomains = 'www.google.com
		   youtube.com/
		   http://www.test.org';

$array = preg_split('/[\s]+/', $allowedDomains);
$regex = '';//Need this line

if(preg_match($regex, $inputText)){
    print 'Domain match!';
}else{
    print 'Domain not match!';
}

Edited by jacob21, 16 October 2014 - 08:31 AM.

Hi,

so far I have managed to set up a somewhat basic login website with a mysql database backend.

Once they have logged on they go to a "main menu" page.

What I need to define is that user A sees button A but only that button, etc.

(Then of course that same rule would have to apply if they tried to directly go to the page, but I am guessing I can do that in the same way that I currently do to force a login).

If anyone has any tutorials or sample code I would much appreciate it.

Thanks,

Having trouble trying to validate a user name and password. This is my code:

Code: [Select]
//check username/password
$user_name_check = mysql_query("SELECT * FROM users WHERE user_name=" . $_POST["user_name"] . "\" AND password=" . $_POST["password"] . "\"");
if(mysql_num_rows($user_name_check))
{
//Do stuff here...
}
But I get the following error:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /xxxx/xxxxxxxx/xxxxx/xxxxxxxxxxxxx/xxxx.php on line 32

Any ideas as to why? $user_name_check is a result set right (which is what the mysql_num_rows() requires)??