ik ben bezig met een wachtwoord vergeten script. je ziet eerst een formulier waar je je username en e-mail adres invoert, dan krijg je op het aangegeven e-mail adres een e-mail met daarin een link. open je de link dan kun je je ww wijzigen, dit werkt.
Maar als je op de knop update password klikt dan zal het ww in de database moeten veranderen, dit werkt nog niet.
Als ik een var_dump uitvoer van de query dan krijg ik: string(48) "UPDATE users SET password='w' WHERE username='' " .
Hij laat de username leeg, hoe kan ik veranderen?
Ik voeg de code erbij want misschien staat er ergens anders een fout?
alvast bedankt.
Dit is het eerste bestand:
<!DOCTYPE HTML>
<html lang="en">
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
include ("connect.php");
if(isset($_GET['code']) ? $_GET['code'] : null)
{
//$get_username = $_GET['username'];
$get_username = isset($_GET['username']) && trim($_GET['username'])!='' ? $_GET['username'] : '';
//$get_username = (!empty($_GET['username']) ? $_GET['username'] : null);
//$get_code = $_GET['code'];
//$db_username = $_GET['username'];
$sq = "SELECT * FROM users WHERE username='$get_username' ";
//var_dump($get_username);
$result = mysqli_query($link, $sq) or die(mysqli_error());
while($row = mysqli_fetch_assoc($result))
{
$db_code = $row['passreset'];
$db_username = $row['username'];
//$get_username = $row ['username'];
}
$db_username = null;
$db_code = null;
$get_code = null;
if($get_username == $db_username && $get_code == $db_code)
{
echo "
<form action='pass_reset_complete.php?code=$get_code' method='POST'>
Enter a new password <br />
<input type='password' name='newpass'><br />
Re-enter your password <br />
<input type='password' name='newpass1'><br />
<input type='hidden' name='username' value='$db_username'>
<input type='submit' value='update password'>
</form>
";
}
}
//if(isset(!$_GET['code']) ? !$_GET['code'] : null)
//if(!empty(!$_GET['code']) ? !$_GET['code'] : null);
if(!$_GET['code'])
{
echo "<form action='forgot_pass.php' method='POST'>Enter your username <br /> <input type='text' name='username'> <br />
Enter your email <br /> <input type='text' name='email'><br />
<input type='submit' value='submit' name='submit'>
</form> ";
if(isset($_POST['submit']))
{
$username = $_POST['username'];
$email = $_POST ['email'];
$query = "SELECT * FROM users WHERE username='$username' ";
$result = mysqli_query($link, $query) or die(mysqli_error());
$numrow = mysqli_num_rows($result);
if($numrow !=0)
{
while ($row = mysqli_fetch_assoc($result))
{
$db_email = $row['email'];
}
if($email == $db_email)
{
$code = rand(10000, 1000000);
$to = $db_email;
$subject = "password reset";
$body = "Dit is een automatische E-mail, doe geen reply.
Klik op de link of plak dit in de browser
http://localhost/php/wachtwoord_vergeten/forgot_pass.php?code=$code$username=$username
";
$sql = "UPDATE users SET passreset='$code' WHERE username='$username' ";
$result = mysqli_query($link, $sql) or die(mysqli_error());
//mail($to, $subject, $body);
include 'mail.php';
echo "check your E-mail.";
}
else
{
echo "email is incorrect";
}
}
else
{
echo "That username doesn't exist";
}
}}
?>
</body>
</html>
Dit is het tweede bestand: waarbij je gaat updaten naar de db:
<?php
include ("connect.php");
if(!empty($_POST['username'])){
$post_username = $_POST['username'];
}
$newpass = $_POST['newpass'];
$newpass1 = $_POST['newpass1'];
$post_username = $_POST ['username'];
$code = $_GET['code'];
if($newpass == $newpass1)
{
//$enc_pass = md5($newpass);
$enc_pass = $newpass;
$query = "UPDATE users SET password='$enc_pass' WHERE username='$post_username' ";
//$query = "UPDATE users SET passreset='0' WHERE username='$post_username' ";
$sql = "UPDATE users SET passreset='0' WHERE username='$post_username' ";
$result = mysqli_query($link, $query) or die(mysqli_error());
$result = mysqli_query($link, $sql) or die(mysqli_error());
//if (mysqli_query($link, $query)) {
//echo "Record updated successfully";
//} else {
// echo "Error updating record: " . mysqli_error($link);
//}
echo "Your password has been updated <p><a href='#'>Click here to login</a></p>";
var_dump($query);
//var_dump($sql);
var_dump($post_username);
}
else
{
echo "password must match <a href='forgot_pass.php?code=$code&username=$post_username'></a>click here to go back";
}
?>
