Forgot Password Script

[hldan1]

I am currntly building a text based game its about 97% done but I have found a problem. The problem is my forgotpassword script. When a user inserts there email address in the the forgot pass form it is meant to change there password in the database (which it does). but it is meant to send an email to the user containing there new password. Butall it says in the email is "You password has been set to" and doesnt give them there new pass. Can someone tell me whats wrong with the code cause ive speant ages looking at it but i cnt see anything wrong with it.

<link href="add/style.css" rel="stylesheet" type="text/css">

<?php //module for password retrieval
 include 'db.php';
 if(isset($_POST['submit']))
 {
   $getpassword=$_POST['getpassword'];
   $passkey="SELECT * from users where email='$getpassword'";
   $passkey2=mysql_query($passkey) or die("Blah");
   $passkey3=mysql_fetch_array($passkey2);
   if(!$passkey3)
   {
     print "We have no player with that e-mail address";
   }
   else 
   {
        $email=$passkey3[email];
        $message="Your password has been set to  $blah";
        $day=date("U");
        srand($day);
        $blah=RAND(1000000,2000000);
        $blah2=md5($blah);
        print "$blah2<br>";
        $newpass="update users set password='$blah' where ID='$passkey3[id]'";
        mysql_query($newpass) or die("Could not insert new password");
        mail($email, Password,$message,'From: MyDomain Webmaster<[e-mail]>');

    print "Password has been sent";
}


 }
 else
 {
   print "<br><center><form action='' method='post'><font color='#FFFFFF' face='Arial, Helvetica, sans-serif' size=2>";
   print "
<table class=thinline width=50% cellspacing=0 cellpadding=2 rules=none><tr><td background=images/topic.jpg align=center><font color=#FFFFFF>Lost Password</font></td></tr>
<tr><td bgcolor=black height=1></td></tr>
<tr><td><center>

.: Please enter the e-mail address you registered with :.<br></font>";
   print "<br>E-mail:</font> <input type='text' name='getpassword' size='20'><br><input type='submit' name='submit' value='submit'></form>";
   print "<br><center>This will create a new random password, <br>then will send that password to your inbox</center></td></tr></table><br>";
 }

?>

Thanks in advnce
Daniel

[Shrike]

It might help if you use sensible variable names instead of $blah, $passkey1, $passkey2 etc. You might have the faintest idea of what your code does when you come back to it that way 😉

Also your open to SQL injection by blindly accepting $_POST['getpassword'].

This line is the culprit

$message="Your password has been set to  $blah"; 

[hldan1]

what should i hange it to then

[Weedpacket]

Originally posted by hldan1
what should i hange it to then

You should check that it's a proper password. At the very least use mysql_real_escape_string.

As for your problem: you don't set the value of $blah until after you've already set the value of $message. Try doing it the other way around.