Forgot pass? - php help needed

[Grenz]

Hi all
I have a login form and next to it I want an option called "forgot pass"

I have made this php but it gives me this error:

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '����' at line 1"

Php:

<?php
$con = mysql_connect("#*$!","#*$!","#*$!");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("#*$!", $con);

$sql="SELECT password, email FROM company_profile WHERE name=’".$name.”’”;
$r = mysql_query($sql);
if(!$r) {

$err=mysql_error();

print $err;

exit();
}

if(mysql_affected_rows()==0){

print "no such login in the system. please try again.";

exit();
}
else {

$row=mysql_fetch_array($r);

$password=$row&lt;"password"&gt;;

$email=$row&lt;"email"&gt;;

$subject="your password";

$header="from:[e-mail]";

$content="your password is ".$password;

mail($email, $subject, $row, $header);

print "An email containing the password has been sent to you";

}
?>

The variable $name is from this submit form:

<form action="/assets/snippets/firma/forgot_pass.php" method="post" name="forgot">
<input name="Login" size="20" type="text" value="name" /><br />
<input name="submit" type="submit" value="submit" />
<input name="reset" type="reset" value="reset" />
</form>

Can Anyone help me tracking down the error?

Thanks in advance

[henry0]

A few items
did you copy it from a text editor like MS words?
if you change the quotes to only name=’$name’;
it still does not work because of the quotes

now if you do name='$name'; it works fine

[Grenz]

Hi

I worked with changing the quotes. I use the texteditor notepad++
But most of the php is copy&paste from various sites (im still very new to php :-) )

Now I get another error

Warning: mail() expects parameter 3 to be string, array given in /home/grenzjob/public_html/assets/snippets/firma/forgot_pass.php on line 41
An email containing the password has been sent to you

Line 41 is:

mail($email, $subject, $row, $header);

Thanks a lot for your help :-)

[henry0]

$row is part of your query, why do you use it?
you have email, subject and header
just try to remove it

[Grenz]

Hi
Thanks a lot.
I not gives the message "an e-mail containing the password has been sent to you"

But when I tjeck my inbox nothing happens.

Ive tjecked the table in the database to ensure that the data exist and is correct but I cannot find errors there.

Do you have any suggestions?

[henry0]

$row=mysql_fetch_array($r);

$password=$row&lt;"password"&gt;;

$email=$row&lt;"email"&gt;;

$subject="your password";

$header="from:[e-mail]";

$content="your password is ".$password;

mail($email, $subject, $row, $header);

print "An email containing the password has been sent to you";

did you notice that you have a bunch of " ; " too many
in password and email
next below email
add this for test purpose
echo"EMAIL: $email<P>";
and report what you read
next:
change
<<<
mail($email, $subject, $row, $header);

print "An email containing the password has been sent to you";
>>>>
by:
if(mail($email, $subject, $row, $header))
{
echo"<h3>An email containing the password has been sent to you</h3>";
}
else
{
echo"<h3>sorry, mail problem!</h3>";
}

[henry0]

also
you forgot about the "body"

$content="your password is ".$password;

mail($email, $subject, $content, $header);

Read about mail funtion [php.net]
<edit>added URL</edit>

[Grenz]

You were right. The echo is email = 0

I cant figure it out. The database column is named "email" and I've checked that the input name has an email....

[henry0]

I do not understand what you try to achieve by using
"greater than" &lt; etc...

try:

$password=$row['password'];

$email=$row['email'];

[henry0]

I tested this, it works

$sql="SELECT password, email FROM zzzzz WHERE id='1' ";
$r = mysql_query($sql);
if(!$r) {

$err=mysql_error();

print $err;

exit();
}

while($row = mysql_fetch_array($r))
{

$pw= $row['password']; echo $pw;

}

just adapt it to your needs

[Grenz]

I changed that without succes.

I think its the link from the form to the php cus if I try to hardcode the name its working perfectly.

$sql="SELECT email, password FROM company_profile WHERE name='$name' ";

The variable $name seems to be the problem.

I found an error in the form but still it doesnt work. The form is now:

<form action="/assets/snippets/firma/forgot_pass.php" method="post" name="forgot">
<input name="name" size="20" type="text" value="name" /><br />
<input name="submit" type="submit" value="submit" />
<input name="reset" type="reset" value="reset" />
</form>

[henry0]

try this

<form action="/assets/snippets/firma/forgot_pass.php" method="post" name="forgot">
<input name="name" size="20" type="text" value="<?php echo trim($name); >? " /><br />
<input name="submit" type="submit" value="submit" />
<input name="reset" type="reset" value="reset" />
</form>

[Grenz]

Now it says: no such login in the system. please try again.

I think im giving up. Thanks for the help though :-)

[henry0]

not that fast :)

Below where it says $sql="SELECT etc...
add
echo $sql;
are the expected values showing up
if yes copy the output and paste it in phpMyAdmin
then report again

your trouble comes from "borrowing" many multiple pieces
you have the beginning of a script that pretty much works
now that you have a few working pieces
write down your plan
and work at creating by yourself the missing part
give it a try!

[Grenz]

I have changed the variable name to "loginid" so it would be easier to track down errors.

I also added this:

echo=$_REQUEST["loginid"];

The output is:

SELECT email, password FROM company_profile WHERE name=''testfirma (mat)An email containing the password has been sent to you

So now the input from the form is sent for sure.

The next thing could the use of the variable. cus it seems like thing goes wrong in this sentence:

WHERE name=''testfirma (mat)

[Grenz]

Would it be possible to define something like this:

$loginid="$_REQUEST["loginid"]"

Because the request captures the loginid from the form so if it could be converted into the variable $loginid it would be perfect.

[Grenz]

ho ho oho
I DID IT !

[Grenz]

Thanks a lot. This sentence did it:

$loginid=$_REQUEST["loginid"];

Now I just need to style e-mail according to your previous replys.

THANKS!

[henry0]

Glad you hanged in there, see the result :) Congratulations!

[Grenz]

Glad you convinced me :-)

This is just so perfect

[Grenz]

Hi
I need some more help with the same script :-)

The setup it this:

Page where the user enter username

If username exist=> confirmation page
If username does not exist => error page

The php that gives the error is:

$sql="SELECT email, password FROM company_profile WHERE name='$loginid'";
$r = mysql_query($sql);
if(!$r) {

$err=mysql_error();

print $err;

exit();
}

if(mysql_affected_rows()==0){

echo "<h2>Det brugernavn du har indtastet eksisterer ikke. Indtast venligst et andet.</h2>";

exit();

ow do I make the ECHO appear on the "error page" ? Right now it just opens a blank page.

The later echo with the "confirmation page" works fine. Although I havent made anything different.
Hope someone can help :-)

[henry0]

the script logic has another flaw

you are using
mysql_affected_rows
but a SELECT does not pertain to that function
<<<
Get the number of affected rows by the last INSERT, UPDATE, REPLACE or DELETE query associated with link_identifier .
>>>
instead you could figure out if there is any row corresponding to that username

$r = mysql_query($sql);
$num=mysql_numrows($r); //echo $num;
if ($num == 0)
{
echo your error....
}

[Grenz]

Thanks a lot again :-)
It worked in the first go.

I also trimmed the process so I dont have to use 2 pages just to print the answer to the user. I use snippets in a CMS system where the reply can be printed neatly under the form.

Thanks again :-)