retreiving a password

habbardone

Hello
I have written a liitle script to email someone the password that they have forgotten (like everyone does)

Problem is it is sending the scrambled password in the file even when I use password() on it!

I must be doing something wrong!

here is the code:

$row = mysql_fetch_array($result, MYSQL_ASSOC);

extract($row);
$pass_wd = password('$pass');
mysql_close();

then in the email:
<tr><td> 
This is the password that you choose 
Password: $pass_wd

The script errored with :
Call to undefined function: password() in blah blah

I use the fuction fine when inserting the new record so I dont get why I cant use it here ?

Please help...
thanks david

habbardone

Oh I should point out -
just to clarify it

First I tried

this

then in the email:
<tr><td> 
This is the password that you choose 
Password: password($pass)

which is when it sent the scarmbled password.

The error came when I started using the $pass_wd variable.

devinemke

Originally posted by habbardone
The script errored with :
Call to undefined function: password() in blah blah

I use the fuction fine when inserting the new record so I dont get why I cant use it here ?

PASSWORD() is a mySQL function, not a PHP function.

habbardone

ah haaaa
I seeeeee

soo how do I send them their password which is recoreded in the mysql db as a field called "pass" ???

devinemke

if you are encyrpting password on the way in to the db (which it sound like you are) then you cannot decrypt them. the mySQL PASSWORD() function is a one-way hash.

habbardone

I am doing this

INSERT INTO clients (city,confirm,pass)

VALUES ('$sel_city','$N_confirm',password('$N_pass'))

I followed the example in Idiots guide
to PHP and mySql where it also says that as an extra I might want to send an email to someone that forgot their password.

It didn't say how to do it or that it couldn't be done.

So - all these websites (including this forum) How do they send the password ?
Do they not encrypt it ?

There must be an obvious (?) answer because eberybody does it !

Thanks for any help.

Drakla

If they don't encrypt the password then they can send you your original one back, but sites that do encrypt it will send you a new randomly generated password that you can login with, then change.

You could use a dictionary file, choose two words and a random number and slam them all together, or just send them a heap of gibberish. As long as it's gone into the database in the appropriate format it doesn't matter.

habbardone

As my website only dishes out free adverts - I guess I'll just save them un-crypted ??

For now at least - maybe write something better latter.

Thanks for the input.