Hello everyone!
I’ve been trying to debug this piece of code for days now. I’ve tried nesting the conditions in various ways, and then making them independent. The result would be the same. I’d get to the reset password form (through code and token validation), and when I hit Submit on the form, after which it says “The page does not exists.” - my first validation step, as if it exits on Submit. And the password isn’t updated in the database either.
When I test the execution of individual pieces of code, they do what they are supposed to do.
And then sometimes it starts redirecting me to the login page, when I type in my reset password page in the browser. And then the problem disappears on its own (- I think, because I don’t make any changes to the code). And I don’t understand why.
I thought I understood the logic of nesting if statements. But obviously, I don’t. I will need to add the code, which will remove the token ($code) from the database, after it’s been used, but without the understanding, I’m not even sure where it will need to go.
Any input would be valuable.
Thanks. 
<?php
// Initialize the session
session_start();
// Check if the user is logged in, if not then redirect to login page
if(!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true){
header("location: login.php");
exit;
}
// Include config file
require_once "config.php";
// Check if the link contais code
if(!isset($_GET["code"])){
exit ("The page does not exists.");
//Check if the link contains the generated code
} elseif(isset($_GET["code"])){
$code = $_GET["code"];
$sql = "SELECT email FROM reset_password WHERE code = :code";
if($stmt = $pdo->prepare($sql)){
$stmt->bindParam(":code", $param_code, PDO::PARAM_STR);
$param_code = $code;
if($stmt->execute()){
if($stmt->rowCount() == 0){
exit ("The page does not exists (again).");
}
}
}
}
// Define variables and initialize with empty values
$new_password = $confirm_password = "";
$new_password_err = $confirm_password_err = "";
// Processing form data when form is submitted
if($_SERVER["REQUEST_METHOD"] == "POST"){
// Validate new password
if(empty(trim($_POST["new_password"]))){
$new_password_err = "Please enter the new password.";
} elseif(strlen(trim($_POST["new_password"])) < 8){
$new_password_err = "Password must have atleast 8 characters.";
} else{
$new_password = trim($_POST["new_password"]);
}
// Validate confirm password
if(empty(trim($_POST["confirm_password"]))){
$confirm_password_err = "Please confirm the password.";
} else{
$confirm_password = trim($_POST["confirm_password"]);
if(empty($new_password_err) && ($new_password != $confirm_password)){
$confirm_password_err = "Password did not match.";
}
}
// Check input errors before updating the database
if(empty($new_password_err) && empty($confirm_password_err)){
// Prepare an update statement
$sql = "UPDATE users SET password = :password WHERE id = :id";
if($stmt = $pdo->prepare($sql)){
// Bind variables to the prepared statement as parameters
$stmt->bindParam(":password", $param_password, PDO::PARAM_STR);
$stmt->bindParam(":id", $param_id, PDO::PARAM_INT);
// Set parameters
$param_password = password_hash($new_password, PASSWORD_DEFAULT);
$param_id = $_SESSION["id"];
// Attempt to execute the prepared statement
if($stmt->execute()){
// Password updated successfully. Destroy the session, and redirect to login page
$sql = "DELETE FROM reset_password WHERE code = :code";
session_destroy();
echo header("location: login.php");
exit();
}
// Close statement
unset($stmt);
}
}
// Close connection
unset($pdo);
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Reset Password</title>
</head>
<body>
<div class="wrapper">
<h2>Reset Password</h2>
<p>Please fill out this form to reset your password.</p>
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
<div class="form-group <?php echo (!empty($new_password_err)) ? 'has-error' : ''; ?>">
<label>New Password</label>
<input type="password" name="new_password" class="form-control" value="<?php echo $new_password; ?>">
<span class="help-block"><?php echo $new_password_err; ?></span>
</div>
<div class="form-group <?php echo (!empty($confirm_password_err)) ? 'has-error' : ''; ?>">
<label>Confirm Password</label>
<input type="password" name="confirm_password" class="form-control">
<span class="help-block"><?php echo $confirm_password_err; ?></span>
</div>
<div class="form-group">
<input type="submit" class="btn btn-primary" value="Submit">
<a class="btn btn-link" href="login.php">Cancel</a>
</div>
</form>
</div>
</body>
</html>
I’ve got lots of learning and practice to do. 
