Forgotten Password Form - PHP

Question

I have this code for my forgotten password form, but it does not work, can anybody see the error(s)? It just comes up with a blank screen and does nothing. I have tried everything, but cannot make it work. Thanks

    <?php
$host="localhost"; // Host name 
$username="admin"; // Mysql username 
$password=""; // Mysql password 
$db_name="members"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword 
$myemail=$_POST['myemail']; 

$sql="SELECT * FROM $tbl_name WHERE email='$myemail'";
$result=mysql_query($sql);
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
$email = $_P0ST['email']; 

function createRandomPassword() {



    $chars = "abcdefghijkmnopqrstuvwxyz023456789";

    srand((double)microtime()*1000000);

    $i = 0;

    $pass = '' ;



    while ($i <= 7) {

        $num = rand() % 33;

        $tmp = substr($chars, $num, 1);

        $pass = $pass . $tmp;

        $i++;

    }
    return $pass;

}

if($count==1){
$newpassword=createRandomPassword();
$encrypted_mypassword=md5($newpassword);
$sql="UPDATE members SET password= ('$encrypted_mypassword') WHERE email = ('$myemail')";
$run=mysqli_query($sql);


$to = "$myemail";
$subject = "Your Password";
$messages="Your password for accessing to our website \r\n";
$messages="Your password is $encrypted_mypassword \r\n";
$messages="Please change this password for security reasons. Thank you. \r\n";
$from = "info@.co.uk";
$headers = "From:" . $from;
mail($to,$subject,$messages,$headers);
echo "Mail Sent.";

**warning** your code is vulnerable to sql injection attacks. — Daniel A. White, Dec 09 '13 at 17:39
[**Vulnerable is an understatement**](http://stackoverflow.com/q/60174/1415724) – Plus, change `$email = $_P0ST['email'];` to `$email = $_POST['email'];` it's `O` as in "**OMG!**" and not `zero`. (*To name a few*). — Funk Forty Niner, Dec 09 '13 at 17:51
Add this to the top of your page: `ini_set('display_errors', 1); error_reporting(-1);`. — Rocket Hazmat, Dec 09 '13 at 18:41

score 1 · Answer 1 · answered Dec 09 '13 at 17:42

Can you try this, $sql="UPDATE members SET password='$encrypted_mypassword' WHERE email = '$myemail' "; $run=mysql_query($sql);. you have used mysqli_query that is the reason.

        $host="localhost"; // Host name 
        $username="admin"; // Mysql username 
        $password=""; // Mysql password 
        $db_name="members"; // Database name 
        $tbl_name="members"; // Table name 

        // Connect to server and select databse.
        mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
        mysql_select_db("$db_name")or die("cannot select DB");

        // Define $myusername and $mypassword 
        $myemail=$_POST['myemail']; 

        $sql="SELECT * FROM $tbl_name WHERE email='$myemail'";
        $result=mysql_query($sql);
        // Mysql_num_row is counting table row
        $count=mysql_num_rows($result);
        $email = $_POST['email']; 

        function createRandomPassword() {       

            $chars = "abcdefghijkmnopqrstuvwxyz023456789";

            srand((double)microtime()*1000000);         
            $i = 0;         
            $pass = '' ;            
            while ($i <= 7) {           
                $num = rand() % 33;         
                $tmp = substr($chars, $num, 1);         
                $pass = $pass . $tmp;           
                $i++;

            }
            return $pass;

        }

        if($count>0){
        $newpassword=createRandomPassword();
        $encrypted_mypassword=md5($newpassword);
        $sql="UPDATE members SET password='$encrypted_mypassword' WHERE email = '$myemail' ";
        $run=mysql_query($sql);


        $to = "$myemail";
        $subject = "Your Password";
        $messages="Your password for accessing to our website \r\n";
        $messages="Your password is $encrypted_mypassword \r\n";
        $messages="Please change this password for security reasons. Thank you. \r\n";
        $from = "info@.co.uk";
        $headers = "From:" . $from;
        mail($to,$subject,$messages,$headers);
        echo "Mail Sent.";
  }

score 1 · Answer 2 · edited May 23 '17 at 12:03

It just comes up with a blank screen and does nothing

As you have an echo at the end of the script, but are getting a blank screen and no message, this more than likely points to a PHP error (which will halt the script and why you get a blank page).

You need to access your error log file, usually in /var/log/apache2/error.log.
You should be accessing this file regularly when developing PHP anyway to check for errors, mistakes and problems from PHP warnings and notices.

I suspect the error is simply a missing close of this:
if($count==1){

You open it with { but do not close it with }.
Put } after your echo "Mail Sent."; and that problem will be gone. Leaving only the remaining issues:

Echoing "echo "Mail Sent.";" at the end of your script does not mean the email was sent. Something might have gone wrong somewhere, so check if the email was sent, and echo a relevant statement to the outcome.

Such as:

if (mail($to,$subject,$messages,$headers))
  {
    echo "Mail Sent.";
  }
else
  {
    echo "Something went wrong";
  }

You can do a bit better than that, but it gives you the idea, as just echoing "email sent" is misleading and you will trust the script is working even if something failed.

You also really need to read about user input validation and Mysql sanitization. As trusting the variables before you insert or select or delete (anything) with the database introduces a very real security issue.
A starter read can be found here:
How can I prevent SQL injection in PHP?

md5() is no longer a secure method for encrypting passwords. See here for the main reason and also ideas of the current best practice, such as "crypt()":
http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash

score 0 · Answer 3 · answered Dec 09 '13 at 17:42

0

Besides the fact that you should use prepared statements, and you should use a secure way to store passwords [i.e. not md5], $_P0STshould be $_POST.

answered Dec 09 '13 at 17:42

moonwave99

19,895
2
38
62

score 0 · Answer 4 · answered Dec 09 '13 at 17:43

0

This brace

if($count==1){

is never closed.

answered Dec 09 '13 at 17:43

Aioros

4,074
1
15
19

This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. – MZimmerman6 Dec 09 '13 at 18:00
Well, actually he stated that "it comes up with a blank screen and does nothing", and "can anybody see the error(s)?". The reason for the blank screen is a syntax error, and I think it's the one I pointed out here. James' answer here is obviously better than mine, but I don't see the point of your critique. – Aioros Dec 10 '13 at 08:39

Forgotten Password Form - PHP

4 Answers4