Never allow a session-validated user to enter a new password without also entering their old password, for example.绝对不要让一个仅通过会话验证的用户在不输入旧密码的情况下去修改密码。