error message on change password code using php

Question

I used a script for my user to change their password when logged in and when I tested it I showed this error message

Notice: Undefined index: username in /home/www/sitename/directory/changepw.php on line 8 Notice: Undefined index: pin in /home/www/sitename/directory/changepw.php on line 9 Notice: Undefined index: newpassword in /home/www/sitename/directory/changepw.php on line 10 Notice: Undefined index: repeatnewpassword in /home/www/sitename/directory/changepw.php on line 11

This is what I have in line 8,9,10and 11

 $username = $_POST['username']; 
 $pin = $_POST['pin']; 
 $newpassword = $_POST['newpassword']; 
 $repeatnewpassword = $_POST['repeatnewpassword'];

this is my HTML Code below

<style type="text/css">
    a:link {
       text-decoration: none;
    }
    a:visited {
        text-decoration: none;
    }
    a:hover {
        text-decoration: none;
    }
    a:active {
        text-decoration: none;
    }
</style>
<div id="inlogscherm">
<form name="form1" method="post" action="changepw.php">
    <div class="textm">Change password</div><br>
    <div class="text">Username:</div><div class="invulbalkje"><? echo    "{$_SESSION['username']}"; ?></div><br />
    <input name="username" type="text" id="username" value="<? echo   "{$_SESSION['username']}"; ?>">
  <div class="text">Password:</div><input name="pin" type="password"  id="pin" class="invulbalkje"><br />
    <div class="text">New Password:</div><input name="newpassword" type="password" id="newpassword" class="invulbalkje"><br />
    <div class="text">Repeat New Password:</div><input name="repeatnewpassword" type="password" id="repeatnewpassword" class="invulbalkje"><br />
    <input type="submit" name="Submit" value="Change" class="button">
  <a href="logout.php">LOGOUT</a>
</form>

This is my php code below

<?php 
    error_reporting(E_ALL);
    ini_set('display_errors', 1);
    session_start();
    include 'db.php';


    $username = $_POST['username'];
    $pin = $_POST['pin'];
    $newpassword = $_POST['newpassword'];
    $repeatnewpassword = $_POST['repeatnewpassword'];

    $encrypted_password=md5($pin);
    $encrypted_newpassword=md5($newpassword);
    $wtbusers = '`wtbusers`';//this should be defined (change this to your whatever table name)

    $result = mysql_query("SELECT pin FROM $wtbusers WHERE     username='$username' and pin = '$pin'");
    if(!$result) 
    { 
        echo"<script>alert('Please Fill Form Correctly')</script>"; } 
        if(mysql_num_rows($result) != 0){
            if($newpassword == $repeatnewpassword){
            $sql=mysql_query("UPDATE $wtbusers SET pin='$pin' where  username='$username'");        
            if($sql) 
            { 
                echo"<script>alert('Successful')</script>";
            }
            else
            {

                echo"<script>alert('error')</script>";
            }       
        } else {

          echo"<script>alert('error_password_not_matched')</script>";
    }
} else {

    echo"<script>alert('Please Fill Form Correctly')</script>";
}

?> 

Thank You.

Answer 1

All the other problems aside and addressing your actual question; There is no checking to see if a POST is being made that I can tell, so adding an @ symbol to those, like $username = @$_POST['username']; in your context is the fastest fix to get rid of them but I would recommend checking for a post first. isset is pretty good for that.

Alternatively you can turn off error reporting for notices by doing this

error_reporting(E_ALL & ~E_NOTICE);

See error_reporting

Answer 2

That is not how you assign the value to a text field using sessions in PHP. It has syntactical error:

<input name="username" type="text" id="username" value="<? echo "{$_SESSION['username']}"; ?>">

I hope you have written session_start(); in the beginning of your code (in every file you're using sessions in) or all of this (related to sessions) will be of no use.

Try this instead:

<?php
 session_start();
 $_SESSION['username'] = "mk";
 ?>
  <input name="username" type="text" id="username" value="<?php echo $_SESSION['username'];?>">

Now, you must use isset in a way so it doesn't run the php if it doesn't come from the form.

<?php 
    error_reporting(E_ALL);
    ini_set('display_errors', 1);
    session_start();
    include 'db.php'; // you might want to make corresponding changes here

if(isset($_POST['Submit'])){
    $username = $_POST['username'];
    $pin = $_POST['pin'];
    $newpassword = $_POST['newpassword'];
    $repeatnewpassword = $_POST['repeatnewpassword'];

    $encrypted_password=md5($pin);
    $encrypted_newpassword=md5($newpassword);
  // the rest of your code

   }
?>

EDIT:

Moving forward from the comments, this is the simplified/minor bugs fixed code:

<?php 
    error_reporting(E_ALL);
    ini_set('display_errors', 1);
    session_start();
    include 'db.php';


$servername = "localhost";
$username = "your_user_name_here";
$password = "your_pass_here";
$dbname = "your_db_name_here";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}


if(isset($_POST['Submit'])){
    $username = $_POST['username'];
    $pin = $_POST['pin'];
    $newpassword = $_POST['newpassword'];
    $repeatnewpassword = $_POST['repeatnewpassword'];

    $encrypted_password=md5($pin);
    $encrypted_newpassword=md5($newpassword);

   $wtbusers = '`your_table_name_here`';       //this should be defined (change this to your whatever table name)

    $result = mysqli_query($conn, "SELECT pin FROM $wtbusers WHERE username= '$username' and pin = '$pin'");
    if(!$result) 

        echo"<script>alert('Please Fill Form Correctly')</script>";

        if(mysqli_num_rows($result) > 0){
            if($newpassword == $repeatnewpassword){
            $sql=mysqli_query($conn, "UPDATE $wtbusers SET pin= '$pin' WHERE username='$username'");        
            if($sql) 
                echo"<script>alert('Successful')</script>";
            else
                echo"<script>alert('error')</script>";
        } 
        else 
          echo"<script>alert('error_password_not_matched')</script>";
} 
else
    echo"<script>alert('Please Fill Form Correctly')</script>";

?>