Form not mailing variables..

dotty

Hi,

I have a 'retrieve password' form but the password is held in a different table to the email address. So the user enters their email address and my script does a query to find their ID from their email address. Then I have a second query which looks up their username and password with the ID from the first query - but it won't work for me. Am I missing something in between?

This bit finds the ID:

$query_rsGetuser = "SELECT ID FROM tbl_clients WHERE email = '$POST[email]'";
$rsGetuser = mysql_query($query_rsGetuser, $myconn);

Grand -this gives me the ID

Now I run the query to find the username and password in the other table:

$query_rsGetlogin = "SELECT username, password FROM client_details WHERE clientid = '$ID'"; //the ID from the previous query
$rsGetlogin = mysql_query($query_rsGetlogin, $myconn)

Then mail the results...
but the email arrives with empty variables and I don't know why 😕

Can anybody help?

Thank you...

Piranha

I have found a couple of security issues in your code:

The database are not safe against SQL injection attacks. Basically this is a way for users to get more information that they should, or even delete or edit rows they should not be able to do.
Never store passwords in plain text in the database. At least use some way of hashing them, like md5.
Don't give the same password back to the user. If you hash it you can't do that, but don't do it otherwise either. Instead generate a new password, store it in the database and send it to the user. And get the user to change password next time he logs in.

Until you have solved the security issues I don't see any reason to solve what you asked about. And when you have solved it the question is not relevant anymore.

dotty

Hi Pirhana,

For the purposes of explaining what I am trying to achieve, I simplified the code. I pre-define the $post variable and am storing passwords in encrypted format. I thought if I posted a pile of code it would be irritating and then nobody would want to help..

Piranha

Ah, then it is another matter, as long as you process the variables against SQL injection and don't just do "$email = $_POST('email')". And use hash instead of encryption to store the password, encryption with the key stored in the code is easy to break.

You should probably use one query and not two:

select columns
from clients
left join client_details on clients.id = client_details.cliendtid
where email = $email

dotty

Thanks Pirhana,

I hadn't thought of using left join but I will try it and let you know how I get on.

I've used the 'mysql_real_escape_string' function to validate the variables before running the query and will take your advice about using hash to store passwords.

thanks again,