mailing password to user

[brockie99]

how do i mail the users password to them when they forget it??
i have a form input box 'username', and a submit button 'mailpassword'. I know i have to use the 'mailto' function, but not sure how to include it.

thanks for your help

[devinemke]

you didn't mention how/where you are storing your usernames/passwords. assuming they are in a database just query the database for the entered username and pull out their password and email then use [man]mail[/man] to send the data.

[TheDefender]

I would personally avoid this scenario...

Instead, I would store the password in an encrypted format, and when someone forgets their password, I woul dpersonally devise a sceme to confirm their account, and send them some "new" randomly generated password, and let them just reset their password after logging in with the new password.

It just doesn't lend to a secure feeling knowing you could potentially learn my password since at some point, it would be sent unencrypted...

But, that's just me.

[brockie99]

sorry for the lack of information. I am trying to get the username and password from the database, where the username is the email address, and send the user their password. i know it is not the most secure option, but i need to start basic. here is the code i have written to start off:

<table width="100%" border="0">
<form>
<tr>
<td><p class="password" align="center">Please enter your username: </p></td>
<td><input type="text" size="35" name="username"></td>
</tr>
<tr>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
<tr>
<td><p align="right">(Click here to send password to email address)</p></td>
<td align="center"><input type="submit" name="mailpassword" value="Send"></td>
</tr>
</form>
</table>
<?php
if ($mailpassword)
{
$db = mysql_connect("****", "*", "*");
mysql_select_db("******",$db);
$select = mysql_query("SELECT password, username FROM member WHERE username LIKE '$username';", $db) or die(mysql_error());
while ($myrow = mysql_fetch_array($select))
{
mail($username, "Password Reminder", "Here is your password: "$password, "From: Maitland Medical");
}
?>

This code doesnt seem to be working.
Can anyone help??
thanks

[TheBB]

My suggestion:

<table width="100%" border="0"> 
<form method="post" action="this_page.php"> 
<input type="hidden" name="submitted" value="yes">
<tr> 
<td><p class="password" align="center">Please enter your username: </p></td> 
<td><input type="text" size="35" name="username"></td> 
</tr> 
<tr> 
<td> </td> 
<td> </td> 
</tr> 
<tr> 
<td><p align="right">(Click here to send password to email address)</p></td> 
<td align="center"><input type="submit" name="mailpassword" value="Send"></td> 
</tr> 
</form> 
</table> 
<?php 
if ($_POST['submitted'] == 'yes') 
{ 
	$username = $_POST['username'];
	$db = mysql_connect("*******", "*******", "*******"); 
	mysql_select_db("*********",$db); 
	$select = mysql_query("SELECT password, username FROM member WHERE username = '$username';", $db) or die(mysql_error()); 
	if (mysql_num_rows($select) < 1)
		die("Couldn't find username: $username.");
	$myrow = mysql_fetch_array($select);
	mail($username, "Password Reminder", 'Here is your password: ' . $myrow['password'], "From: Maitland Medical");
?>

1. You didn't set the form method. POST is best here.
2. You didn't set the form action. You need it to point back at this page.
3. Use the superglobal array $POST['value_name'] to get form input instead of just $value_name. If the form method is GET, you should use $GET['value_name'].
4. Don't use LIKE in the MySQL query, use '='.
5. You use a while loop to iterate a result set that is supposed to be only one value anyway. My script dies if there is less than 1 value (i.e. the username was not found). If it found 1 (or more) it sends a mail to the first one only.
6. You messed up the quotes in the mail() function.
7. After having fetched the array from the result set, you can't get the password through $password, you have to get it from the array like I did: $myrow['password'].
8. Like it is now, the script will show the form even if it just was submittted, you may want to fix that yourself.

[brockie99]

just tried the code above, and i am still getting an error on the mail( "***", "*", ................) line. do i have to specify a from email address?? or can i simply use a 'From: Mailtland Medical' ??

[TheBB]

Sorry, I mistyped a little. You need a semicolon after the statement before:

$myrow = mysql_fetch_array($select)

should be:

$myrow = mysql_fetch_array($select);

Hmm... actually I mistyped a lot. I edited the previous post. =P

As for the mail headers, this will work:

From: Maitland Medical <[e-mail]>

Often you'll want a reply-to header as well, i.e.

"From: Maitland Medical <[e-mail]>\nReply-To: [e-mail]"