Insert New Password In MD5

PHP
1

Hi,

I am trying to create a script which allows me to insert a new password. I can set it up to accept plain text but when I try to add MD5 it keeps returning the same message:

An error occurred Unknown column ‘4b29a21e5aa032dd4f5a1590c29016f2’ in ‘field list’

However the code looks logical enough. Can anyone advise what I am doing wrong. I can see that I am saying I want password (the field in my database) to be in MD5


			
<?php	

	
     $errors = array();
    $success = array();
	
function mysql_real_escape_array($t)
{
    return array_map("mysql_real_escape_string",$t);
}

function trim_array($ar)
{
    return array_map("trim",$ar);
}

if(isset($_POST['form_id']))
{

    $_POST = mysql_real_escape_array($_POST);
    $_POST = trim_array($_POST);



    if($error == "")
    {
	$newpassword = md5('resetpassword');
        $sql = "
        UPDATE
            users
        SET
            password = $newpassword";


        $result = mysql_query($sql) or die("An error occurred ".mysql_error());

    }

}

?>



<div class="registerinfopagecell">
<div class="registerpageheaderorganiser">
Choose a New Password
</div>
<div class="registerform">
				
<form class="form_id"  class="appnitro"  method="post" action="">
										
	
<ul >
			
					
	

	
 	

		<div class="forminputcell">
		<div class="datainput">
<li class="li_1" >
		<div class="forminputleft">	
Your New Password:
		</div> 	

	<div class="forminputright">	
<input name="resetpassword" type="text" class="field" width="600" />
</div>
</li>
</div>
	</div>
	

		
</li>
</div>
	</div>
2

Hi,
Try replace this code:

$newpassword = md5('resetpassword');
        $sql = "
        UPDATE
            users
        SET
            password = $newpassword";

With this one:

$newpassword = md5($_POST['resetpassword']);
$sql = "UPDATE users SET password = '$newpassword'";

Also, it is needed a WHERE clause in sql query, else makes update to all rows.

3

http://www.unixwiz.net/techtips/sql-injection.html

and

http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection

and then have a look at how to create a random salt