Q: php code not working, $query string not working well formatted code:
<?php
        require_once 'connectvars.php';

        if (isset($_POST['submit'])) {
            //set vars
            $oldpw = mysqli_real_escape_string($dbc, trim($_POST['oldpw']));
            $newpw = mysqli_real_escape_string($dbc, trim($_POST['newpw']));
            $retype = mysqli_real_escape_string($dbc, trim($_POST['retype']));

            $query = mysqli_query($dbc, 'SELECT password from user_info WHERE password = "hash(\'SHA256\',$oldpw)" and user_id = "$SESSION[\'user_id\']"'); // this line is "not working well"

            if (strlen($newpw) < 7) {
                if (strlen($newpw) > 32 ) {
                    if (mysqli_num_row($query) == 1) {
                        if ($newpw == $retype) {
                            mysqli_query($dbc, "UPDATE user_info SET password = 'hash('SHA256',$newpw)'");
                            $msg = "You successfully changed your password";
                        }
                        else {
                            $msg = "Your old password doesn't match.";
                        }
                    }
                    else {
                        $msg = "You must enter your old password correct.";
                    }
                }
                else {
                    $msg = "Your password must contain 32 characters or less.";
                }
            }
            else {
                $msg = "Your new password must contain at least 7 characters.";
            }

    ?>


A: I think you want to improve your sql syntax.
'SELECT password 
    from user_info 
    WHERE password = "hash(\'SHA256\',$oldpw)" 
    and user_id = "$SESSION[\'user_id\']"'

may be corrected to
"SELECT password 
    from user_info 
    WHERE password = '" . hash('SHA256',$oldpw) ."' 
    and user_id = '" . $_SESSION['user_id'] . "'"

to propperly escape the string. Try to correct your update statement the same way.
