Forgot password script

[merlinti]

Hey all,

I found this script somewhere on these board, but can't get the whole thing to work.

It sends the UN & PW to the correct email that was input to the form from the first page, but I can't get any of these messages to show, such as if they don't exist in the DB. What am I doing wrong?

thanks for any help.

here's the code.

<?

if ($email) { 


MYSQL_CONNECT('localhost','UN','PW');
@mysql_select_db("database");

    $db = "database"; 


    $query_checkemail = "SELECT * FROM members WHERE Email = '$email'"; 


    $result_checkemail = mysql_query($query_checkemail); 


    if (!$result_checkemail) { 


            echo("Error performing query: " . mysql_error()); 


            exit; 


    } 


    $recordcount_checkemail = mysql_num_rows($result_checkemail); 


    if ($recordcount_checkemail) { 


            while($row_checkemail = mysql_fetch_array($result_checkemail)) { 


                    $username = $row_checkemail["UserName"]; 


                    $password = $row_checkemail["Password"]; 


                    $mail_to = trim($email); 


                    $mail_headers = "From: mysite.com\r\nReply-to: [email][e-mail][/email]"; 


                    $mail_subject = "Your login details for mysite.com:"; 


                    $mail_body .= "Username = $username\n"; 


                    $mail_body .= "Password = $password\n\n"; 


                    $mail_body .= "Don't forget that they are case sensitive!\n\n"; 


                    $mail_body .= "To sign up to mysite Wireless, go to:\n"; 


                    $mail_body .= "http://www.mysite.com/\n\n"; 


                    $mail_body .= "Yours,\n\n"; 


                    $mail_body .= "mysite.com Team\n\n"; 


                    mail($mail_to, $mail_subject, $mail_body, $mail_headers); 


                    $message = "<center><p><font face=\"verdana\">Your password has been sent to $email</p></center>"; 
print "$message";

?>

<div align="center"><a href="javascript:window.close();"><font size="2" face="Verdana, Arial, Helvetica, sans-serif">Close</font></a><?

            } 
    } else { 


            $message = "<center><p><font face=\"verdana\" color=\"#FF0000\"> <b>NOT FOUND</b></font> <br> <font face=\"verdana\">Your e-mail address, <b>$email</b>, is not in our database. 
This means you are not a member of mysite.com. <br> <a href=\"forgotpw01.php\">Go Back</a></font></p></center>";

print "$message";


    } 


} else { 


    $message = "<center><p><font face=\"verdana\" color=\"#FF0000\"> <b>You didn't enter your e-mail address!</b></font><br><font face=\"verdana\"><a href=\"forgotpw01.php\">Go Back</a></font></p></center>"; 
print "$message";


} 


?>

UPDATE 01: You can tell I'm still a real newbie!!
I forgot to put the damn "print" statements in!! DOH!! 😃 :p

UPDATE 02: I replaced the above code with the one that's now working for me.

[Ravenous]

Hey man.. I live in Vegas, as well. Who ya' working for?

As far as a forgotten password tthing, I wouldn't bother using a pre-made script. It should be specifically tailored to your database. I would recommend the following:

When a user clicks on "I forgot my password," they should be shown a textfield in which they enter their email. Upon verifying that the supplied email address exists in your user table, create a new password with an md5 hash of time() or something like that. Email that new password to the email address they gave you.

Anyway.. you doing work for a company or just learning PHP for yourself?

[Cleric]

I agree with Ravenous in that a home brewed solution would be much better than the "round peg" solution.

The big problem here is that the password is stored as clear text (i.e. any system administrator can know my password and with any type of digging for more information on me, s/he may have enough to hack into my accounts). Passwords should strictly be stored in some type of hash (MD5 works fine and is a part of PHP). If a person forgets their password, then you need to generate a new one for them and let them change it afterwards. If you follow this way, just wait until they login first before you over-write their password as someone could maliciously put someone else's email address in just so their password can be over-written.

[merlinti]

I built the whole site in ASP, but my host OLM, uses Chilisoft and they are working on installing the "Spice Pack" to enable JMAIL, and CDONTS, so I decided to try it in PHP.
I haven't use MD5 yet. MySQL can encrypt the whole Password column then?

Hey Ravenous,
I'm working at Computer Intellect, on Rainbow & Sahara.
What about you?

[Cleric]

Ok here is the deal:

MySQL has its own built-in hashing algorithm which it uses for its passwords, but I don't know if they have a supported MD5 function yet. So what I tend to do is use PHP's MD5 function as the point of hashing the password is a concern of the application and not the database.

Here is something I am doing until I get the next great idea on how to do it:

Have your MySQL daemon setup with a single user for each website it is hosting to access the database. Each of these users should have no super user privileges in the user table, but have full permission to the database in which they are a part of in the db table. Within the database for each site, there should be a secondary user table where you can store all the user that are to access it along with their MD5 passwords and any other information necessary (email, telephone, et cetera). This way I conserve space in the mysql.user table, restrict permissions, and protect the mysql database from abuse/accidents.

Sorry that I can't post any code at the moment, but I am at work and my work is on my laptop at home, but can drop in some code.

[merlinti]

I am using an INSERT RECORD that adds users automatically when they sign up on the website.
So your saying that I should have that page write to the MySQL USERS table for the UN & PW and also write to the members table with the rest of their info?

I'll check it out when you post the code.

thanks Cleric

[Ravenous]

MySQL does have MD5 hashing capabilities; at least the lastest version does. MySQL also has a password() function which hashes in some other fashion. I don't know if one is better than the other or not, so I stick with MD5 as it is almost a standard.

I work for an accounting firm located at Rancho and Gowan. I'll also be doing some volunteer stuff for a non-profit organization called Redress, Inc. here shortly, too.

[Desertsnowman]

alturnatly - in a simple approach,

try:

$Password=md5($Password);
just before the insert record script.