问用BCRYPT更改密码脚本

EN

<form action="editAccount.php" method="post"> 
  <div class="input-group">
    <span class="input-group-addon">Password:</span>
      <input type="password" name="password" class="form-control" placeholder="password">
  </div>
  <button class="btn btn-primary custom-button btn-block" type="submit"><i class="fa fa-check"></i> Save Changes</button>                           
    <div class="input-group">
       <span class="input-group-addon">Confirm password:</span>
          <input type="password" name="passwordConfirm" class="form-control" placeholder="Confirm password">
    </div>                                                                                                            
</form>

if(empty($_SESSION['id'])) 
{ 
    header("Location: userAction.php"); 
    die("Redirecting to userAction.php"); 
} 
if(isset($_POST['submit']))
{
//basic validation
if(strlen($_POST['password']) < 3){
    $error[] = 'Password is too short.';
}

if(strlen($_POST['passwordConfirm']) < 3){
    $error[] = 'Confirm Password is too short.';
}

if($_POST['password'] != $_POST['passwordConfirm']){
    $error[] = 'Password and Confirm password doesn't match.';
}
  if(empty($error)){

        $hashedpassword = $user->password_hash($_POST['password'], PASSWORD_BCRYPT);

        try {
            $stmt = $pdo->prepare("UPDATE users SET password = :hashedpassword WHERE id = :user_id");
            $stmt->execute(array(
                    ':hashedpassword' => $hashedpassword,
                    ':user_id' => $_SESSION['id']
            ));

            header('Location: userAction.php?action=joined');
            exit;

        } catch(PDOException $e) 
          {
             $error[] = $e->getMessage();
          }

   }
}

class User extends Password{

private $_db;

function __construct($pdo){
    parent::__construct();

    $this->_db = $pdo;
}

 private function get_user_hash($username){ 

    try {
        $stmt = $this->_db->prepare('SELECT password FROM users WHERE username = :username AND active="Yes" ');
        $stmt->execute(array('username' => $username));

        $row = $stmt->fetch();
        return $row['password'];

    } catch(PDOException $e) {
        echo '<p class="bg-danger">'.$e->getMessage().'</p>';
    }
 }

 public function login($username,$password){

    $hashed = $this->get_user_hash($username);

    if($this->password_verify($password,$hashed) == 1){

        $_SESSION['loggedin'] = true;          
        return true;
    }   
 }
 public function login_user_id($username){  

    try {
        $stmt = $this->_db->prepare('SELECT id FROM users WHERE username = :username');
        $stmt->execute(array('username' => $username));

        $row = $stmt->fetch();

        return $row['id'];

    } catch(PDOException $e) {
        echo '<p class="bg-danger">'.$e->getMessage().'</p>';
    }
 }

 public function logout(){
    session_destroy();
 }

 public function is_logged_in(){
    if(isset($_SESSION['loggedin']) && $_SESSION['loggedin'] == true){
        return true;
    }       
 }

}