Forum Moderators: coopster
Yesterday, a visitor to my site wanted to change the random password they received, so I created a form page, and a php page. Though my php works, there are a few flaws I can't seem to address.
1. If a user enters an email address that is not already in the database and fills in all the form fields, s/he still gets the message that their password has been changed (even though they are not added to the database).
2. There is no check to see if the new password has already been used (by the way the passwords are encrypted).
I know I have to verify that the email address exists in the database, and check to see if the password exists. I'm also not sure if the old password is being matched with the registered email address, as part of the verification. I have tried everything, and nothing works without errors. Here is the php page (the existing database titles are password and email_address):
<?php
include 'db.php';
// Convert input box entries from the html form to variables
$regemail = $_POST['regemail'];
$old_pass = $_POST['old_pass'];
$new_pass = $_POST['new_pass'];
$conf_new_pass = $_POST['conf_new_pass'];
if (!preg_match("/\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*/", $regemail)) {
echo "<h4><font color=red>You are not using an appropriate email address format. Make sure all the fields are entered correctly.</font></h4>";
} elseif ($old_pass == "") {
echo "<h4><font color=red>You did not fill in the field asking for your current password. Make sure all the fields are entered correctly.</font></h4>";
} elseif ($new_pass == "") {
echo "<h4><font color=red>You did not fill in the field asking for your new password. Make sure all the fields are entered correctly.</font></h4>";
} elseif ($conf_new_pass == "") {
echo "<h4><font color=red>You did not fill in the field asking for you to confirm your new password. Make sure all the fields are entered correctly.</font></h4>";
}
elseif($new_pass == $conf_new_pass) {
// Convert passwords to md5 hash
$old_pass = md5($old_pass);
$new_pass = md5($new_pass);
$conf_new_pass = md5($conf_new_pass);
// If new_pass and conf_new_pass are the same, change the password in the database.
$sql = mysql_query("UPDATE users SET password='$new_pass' WHERE password='$old_pass' AND email_address='$regemail'");
echo "Your password has been changed.<BR>";
echo "<P align='center'><A href='http://mysite.org'>Back to Home Page</A>";
}else{
echo "<font color=red><br>Either you did not use your registered email address, you did not enter your current password, or the new password and the confirmation password do not match. Make sure all the fields are entered correctly.";
include 'change_pw_form.html';
exit();
}
?>
Where am I going wrong? Thanks so much!
password='$old_pass'
Also, add mysql_error() to the end of your query. If there is a specific database problem you will seen an error message:
Change:
$sql = mysql_query("UPDATE users SET password='$new_pass' WHERE password='$old_pass' AND email_address='$regemail'");
to:
$sql = mysql_query("UPDATE users SET password='$new_pass' WHERE password='$old_pass' AND email_address='$regemail'") or die(mysql_error());
:)
Most of the script came from a Webmaster's forum post as the starting point to change md5 passwords in a database. Here's the link in case anyone else is trying to learn how to do the same thing:
[phpfreaks.com...]
Thanks to all the skilled webmasters that take the time to teach others!
I then added some coding as suggested in the post. Since I posted my question here, the author of the post has explained to me how to complete the script. The only thing I have left to figure out is how to check that a user does not enter a password that already exists in the database.
Thanks again for your help!
$query = mysql_query("SELECT password FROM users WHERE password = '$new_pass' LIMIT 1") or die(mysql_error());if (mysql_num_rows($query)>0)
{
echo "Error! This password already exists in Database!";
exit;
}
Something like that should do.
2) It doesn't matter if they use a duplicate password - your system should only require username + password to be a unique combination.
;)
But yes, as dcrombie mentioned, some verification would be a good idea. Maybe disable their account once they have changed their e-mail addy, then re-enable it once its been verified?
