php change password script problems

Your sql should like this:

$result = mysql_query("SELECT password FROM $tbl_name WHERE username='$username' AND password = '$password'");

Your problem lies here -

if(!$result)

When a user enters a wrong username, the query searches for that user in the database, but won't find one. So the result will contain empty dataset, but the query is still valid, since you can query a database and return empty datasets. So your !$result check will always evaluate to true unless a DB error occurs.

Instead of just checking the $result, you should do the following -

if($newpassword==$repeatnewpassword) 
{
    // User's provided new password and repeatpassword matches, so keep going forward,
    // query the database.

    $result = mysql_query("SELECT password FROM $tbl_name WHERE username='$username'");

    if($result)
    {
        // Database query successful. Now check if that username exists in the database.
        if(mysql_num_rows($result) <= 0)
        {
            // user has provided wrong username, take action accordingly
        }
        else
        {
            // Username found, now check for old password match
            $row = mysql_fetch_array($result);

            if($password==$row['password'])
            {
                // User's old password matches with DB. So, update password and
                // forward him to confirmation page
            }
            else
            {
                // User's old password doesn't match with db. Show appropriate message
            }
        }
    }
    else
    {
        // Some DB error occurred. Handle it appropriately.
    }
}
else
{
    // User's new and repeat password don't match, so take action accordingly
}

P.S.

Your site is vulnerable to SQL Injection attack. You should at least sanitize your input as follows -

$username = mysql_real_escape_string($_POST['username']);

$password = mysql_real_escape_string($_POST['password']);

$newpassword = mysql_real_escape_string($_POST['newpassword']);

$repeatnewpassword = mysql_real_escape_string($_POST['repeatnewpassword']);

To know more, go here: mysql_real_escape_string() manual.

Also storing passwords in database in plain old text format is another bad idea. Even you should not be able to see the passwords that your site's user provide. Use md5() function to encrypt passwords and then store it in the database.

if(isset($_POST['submit'])){

$sql = "SELECT * FROM $tbl_name WHERE ".
       "username='$username' AND password = '$password' LIMIT 1";


$result = mysql_query($sql);

$numrow = mysql_num_rows($result);

if($numrows != 1){ /**go to error page**/ }

}

this

$result = mysql_query("SELECT password FROM $tbl_name WHERE username='$username'");

and this

 if ($row = mysql_fetch_assoc($result))
{ 
     header("location:error.php"); 
} 

implies that if user has enter correct user name it will redirect to the error page

change to

$result = mysql_query("SELECT password FROM $tbl_name WHERE username='$username' AND password = '$password'");

I have edited your code as more simplified way.

You should try this ::

<?php 

session_start();

$host="localhost"; // Host name 

$username="username"; // Mysql username 

$password="password"; // Mysql password 

$db_name="database"; // Database name 

$tbl_name="table"; // Table name 

// Connect to server and select databse.

mysql_connect("$host", "$username", "$password")or die("cannot connect"); 

mysql_select_db("$db_name")or die("cannot select DB");



$username = $_POST['username'];

$password = $_POST['password'];

$newpassword = $_POST['newpassword'];

$repeatnewpassword = $_POST['repeatnewpassword'];


$result = mysql_query("SELECT password FROM $tbl_name WHERE username='$username' and password = '$password'");

if(!$result) 
{ 
    header("location:error1.php"); 
} 

if(mysql_num_rows($result)){
    if($newpassword==$repeatnewpassword){
        $sql=mysql_query("UPDATE $tbl_name SET password='$newpassword' where username='$username'");        
        if($sql) 
        { 
                header("location:success.php");
        }
        else
        {
            // In case when problem while updating your new password
           header("location:error3.php");
        }       
    } else {
        // In case when new-password and retype-password do not match
        header("location:error_password_not_matched.php");
    }
} else {
    // In case of you have not correct User name and password
    header("location:error.php"); 
}

?>