$_POST['email'] ); try { // Execute the query $stmt = $db->prepare($query); $result = $stmt->execute($query_params); } catch(PDOException $ex) { // Note: On a production website, you should not output $ex->getMessage(). // It may provide an attacker with helpful information about your code. die("Failed to run query: " . $ex->getMessage()); } // Retrieve results (if any) $row = $stmt->fetch(); if($row) { die("This E-Mail address is already in use"); } } if( !empty( $_POST['theme'] ) ) update_user_theme( $userId, $_POST['theme']-1 ); if( !empty( $_POST['massEmails'] ) ) update_user_mass_emails( $userId, TRUE ); else update_user_mass_emails( $userId, FALSE ); if( !empty( $_POST['weeklyReport'] ) ) update_user_weekly_report( $userId, TRUE ); else update_user_weekly_report( $userId, FALSE ); // If the user entered a new password, we need to hash it and generate a fresh salt // for good measure. if(!empty($_POST['password'])) { $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); $password = hash('sha256', $_POST['password'] . $salt); for($round = 0; $round < 65536; $round++) { $password = hash('sha256', $password . $salt); } } else { // If the user did not enter a new password we will not update their old one. $password = null; $salt = null; } // Initial query parameter values $query_params = array( ':email' => $_POST['email'], ':user_id' => $userId, ); // If the user is changing their password, then we need parameter values // for the new password hash and salt too. if($password !== null) { $query_params[':password'] = $password; $query_params[':salt'] = $salt; } // Note how this is only first half of the necessary update query. We will dynamically // construct the rest of it depending on whether or not the user is changing // their password. $query = " UPDATE Users SET Email = :email "; // If the user is changing their password, then we extend the SQL query // to include the password and salt columns and parameter tokens too. if($password !== null) { $query .= " , Password = :password , Salt = :salt "; } // Finally we finish the update query by specifying that we only wish // to update the one record with for the current user. $query .= " WHERE UserID = :user_id "; try { // Execute the query $stmt = $db->prepare($query); $result = $stmt->execute($query_params); } catch(PDOException $ex) { // Note: On a production website, you should not output $ex->getMessage(). // It may provide an attacker with helpful information about your code. die("Failed to run query: " . $ex->getMessage()); } // Now that the user's E-Mail address has changed, the data stored in the $_SESSION // array is stale; we need to update it so that it is accurate. $_SESSION['user']['Email'] = $_POST['email']; ?>

Updates submitted successfully. Redirecting in 3 seconds...

Edit Account

Username:


E-Mail Address:


Password

(leave blank if you do not want to change your password)

Theme:

name="massEmails">Receive mass emails from pool administrators

name="weeklyReport">Receive weekly report of results