Password Reset feature

Question

My website is hosted on a live server with Tsohost. I am using PHP mail function to send emails, however my following mail function does not work in my code but everything else does. How can i try implement this feature.

  <?php include "resources/configuration/config.php"; ?>

   <?php


  if(isset($_POST['btnRecover'])) {


   $Email = $_POST['Email'];


    $query = "SELECT * FROM users WHERE Email = '{$Email}'";

    $query = mysqli_query($connection, $query);

       $numrow = mysqli_num_rows($query);


      if($numrow != 0) {

      while($row = mysqli_fetch_assoc($query)) {

          $db_email = $row['Email'];

                }

              if($Email == $db_email) {

          $code = rand(1000, 1000000);

          $to = $db_email;

          $subject = "Password Reset";

            $body = "This is an automated email. Please DO NOT reply to  this. Click the link below or paste it into your browser http://www.castlewellanforestpark.com/recover_password.php?code =$code&email = $Email ";

          }

              $query1 = "UPDATE users SET passreset ='{$code}' WHERE Email = '{$Email}'";

                $query1 = mysqli_query($connection, $query1);

                 mail($to, $subject, $body);

                  echo "Check Your Email";

                      } 


                       else {

                          echo "That Email does not exist";

                            }



                               }


                                   ?>

Have you checked your spam folder? Does your host allow you to perform email functions? — Jay Blanchard, Apr 11 '16 at 21:38
`if(mail($to, $subject, $body)) { echo "Check Your Email"; }`. — Funk Forty Niner, Apr 11 '16 at 21:40
This, `$query = "SELECT * FROM users WHERE Email = '{$Email}'";` is open to SQL injections. As is your other query, use prepared statements and separate out the input from query. — chris85, Apr 11 '16 at 21:41
Words of advice though: 1) Use a one-time token. 2) Let them choose their password. 3) Delete the token on success. 4) Use a safe password hashing function if you're not using one already. 5) Encode the email. 6) Use full mail headers http://php.net/manual/en/function.mail.php @steve — Funk Forty Niner, Apr 11 '16 at 22:03

Password Reset feature

0 Answers0