[RESOLVED] Updating database

Sacha1234

I am now having trouble with the forgot password function. I want the user to get an email with a new random password in from which they can then reset through the link. I got the email working, generating a random number but it does not update the database. im not getting any errors 😕

<?php  

include 'my_sql_connect.php';
$user_email=$_POST['user_email']; //set the user_email to the following

if($user_email == "")
{
	echo "You have not entered an email address";
}

$newpassword = substr(md5(uniqid(rand(),true)), 3, 10);

$sql= "UPDATE users SET user_password ='$newpassword' WHERE user_email ='$user_email'" or die (mysql_error());
	//send email code 
	//send email to
	$to=$user_email;

$subject="Your Password";

$header="from: admin";

$message="Your password to login to our website has been temporarily changed: \r\n Your new password is $newpassword \r\n Please click on this link to change your password: http://www.welovetwitter.co.uk/reset_password.html";

$sentmail=mail($to,$subject,$message,$header);


	if($sentmail)
	{
		echo"Your new password has been sent to yout email address. If you cannot find the email in your inbox, please look under your junk mail as your email server may have redirected it. Please follow the link and reset your password";
		}
		else {
		echo"Sorry, we were unable to send your password at this time";	
			}

?>

bradgrafelman

When posting PHP code, please use the board's [noparse]

..

[/noparse] bbcode tags as they make your code much easier to read and analyze.

As for your problem, you never attempt to execute the SQL query string (e.g. with [man]mysql_query/man).

Sacha1234

ah sorry im pretty new to this! but thanks for the tip!

and as for the code that worked!! thank you very much 🙂

bradgrafelman

Forgot to mention this..

Note that user-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (for string data).