In the provided PHP script for changing passwords, what improvements can be made to enhance security and efficiency?

One improvement to enhance security and efficiency in the provided PHP script is to use prepared statements with parameterized queries to prevent SQL injection attacks. This involves using placeholders for user input and binding the actual values at execution time. Additionally, implementing password hashing using PHP's password_hash() function can enhance security by securely storing passwords. Lastly, adding input validation to ensure that passwords meet certain criteria, such as minimum length and complexity requirements, can further enhance security.

// Improved PHP script for changing passwords with enhanced security measures

// Establish database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare SQL statement using a prepared statement
$stmt = $pdo->prepare("UPDATE users SET password = :password WHERE id = :id");

// Bind parameters
$stmt->bindParam(':password', password_hash($_POST['new_password'], PASSWORD_DEFAULT));
$stmt->bindParam(':id', $_SESSION['user_id']);

// Execute the statement
$stmt->execute();