Hello:
I have a script which resets a password for a user. The user receives an email with the new password. The script works correctly because I receive an email with the new password. To verify that the password values changed, I compared the previous value to the new and they are different.
So I then attempted to login using the new password and I receive login fails.
I then tested my login using the old password and the login fails as well. So now the user can't login with the old or new password.
I do not understand what is going wrong Can someone help me out?
Thank you in advance.
Here is the lost password script:
<?php
include "conn.inc.php";
switch($_REQUEST['req'])
{
case "recover":
$sql = mysql_query("SELECT * FROM member
WHERE
memberid = '{$_POST['memberid']}'
");
if(mysql_num_rows($sql) == 1)
{
while($row = mysql_fetch_assoc($sql))
{
$alphanum = "abchefghjkmnpqrstuvwxyz0123456789";
for ($i=0; $i <= 10; $i++) {
$num = rand() % 33;
$tmp = substr($alphanum, $num, 1);
$newpass = $newpass . $tmp;
$i++;
}
$update = mysql_query("UPDATE member
SET password = '".md5($newpass)."'
WHERE memberid='{$row['memberid']}'");
stripslashes(extract($row));
}
if(!$update)
{
header("Location: http://www.bridgemilltennis.com/login_form.php");
}
else
{
echo '<p align="center">Password Reset! '.
'Please check your email for your new '.
'password.</p>';
include ('clsEmailpw.php');
$mailer = &new Email;
$mailer->ToMail = $email;
$mailer->FromMail = "support@summitwebcrafters.com";
$mailer->FromName = "Technical Support";
$mailer->Subject = "New Password";
$mailer->Message = "Dear $first_name,\n\n".
"You have requested a new ".
"password.".
"Below is your new login ".
"informaiton:\n\n".
"=====================\n".
"Username: $username\n".
"New Password: $newpass\n".
"=====================\n\n".
"You may login at any time ".
"at [url]http://www.bridgemilltennis.com/login_form.php\n\n[/url]".
"Thank You!\n".
"Site Administrator";
$mailer->SendMail();
}
} else
{
header("Location: http://www.bridgemilltennis.com/lost_password.php");
exit;
}
break;
}
?>
=======
Here is the login script:
<?php
include "conn.inc.php";
switch($_REQUEST['req'])
{
case "validate":
$validate = mysql_query("SELECT * FROM member WHERE
username = '$POST[username]' AND password = password('$POST[password]')") or
die (mysql_error());
if (mysql_num_rows($validate) == 1)
{
while($row = mysql_fetch_assoc($validate))
{
$SESSION['login'] = true;
$SESSION['memberid'] = $row['memberid'];
$SESSION['first_name'] = $row['first_name'];
$SESSION['last_name'] = $row['last_name'];
$SESSION['email'] = $row['email'];
$SESSION['phone1'] = $row['phone1'];
$_SESSION['phone2'] = $row['phone2'];
}
header("Location: http://www.bridgemilltennis.com/member-area.htm");
}
else
{
header("Location: http://www.bridgemilltennis.com/login_form.php");
exit;
}
break;
}
?>
