-1

I'm trying to have a password reset request where a link is emailed to the user to reset their password on my site, but the PHP file isn't picking up the values from my form. I orginally embedded the form in my PHP just to get the method to work, but for my formatting, I need to have the form separate. It worked with the form embeded, but won't work if I have my form separate in my HTML. My form HTML--

<form action="" method="post">
<p>Email Address: <input type="email" name="email" size="50" maxlength="255">
<input type="submit" name="submit" value="Get New Password"></p>
</form>

And my PHP file ("settings.php" is my database file)--

<?php

$email=$_GET['email'];

include("settings.php");
connect();
$q="select email from users where email='".$email."'";
$r=mysql_query($q);
$n=mysql_num_rows($r);
if($n==0){echo "Email id is not registered";die();}
$token=getRandomString(10);
$q="insert into tokens (token,email) values ('".$token."','".$email."')";
mysql_query($q);
function getRandomString($length) 
       {
    $validCharacters = "ABCDEFGHIJKLMNPQRSTUXYVWZ123456789";
    $validCharNumber = strlen($validCharacters);
    $result = "";

    for ($i = 0; $i < $length; $i++) {
        $index = mt_rand(0, $validCharNumber - 1);
        $result .= $validCharacters[$index];
    }
    return $result;}
 function mailresetlink($to,$token){
$subject = "Forgot Password";
$uri = 'http://'. $_SERVER['HTTP_HOST'] ;
$message = '
<html>
<head>
<title>Forgot Password</title>
</head>
<body>
<p>Click on the given link to reset your password <a     href="'.$uri.'/reset.php?token='.$token.'">Reset Password</a></p>

</body>
</html>
';
$headers = "MIME-Version: 1.0" . "\r\n";
$headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n";
$headers .= 'From: Admin<noreply@ca>' . "\r\n";

if(mail($to,$subject,$message,$headers)){
    echo "We have sent the password reset link to your  email id <b>".$to."      </b>"; 
}}

if(isset($_GET['email']))mailresetlink($email,$token);
?>
Jamie
  • 1
  • 3
  • Note that your code is vulnerable to SQL injection, and that you are using deprecated functions `mysql_*` [Read more here](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Ibu Feb 10 '17 at 23:46
  • Thanks! I'm still learning PHP, so I appreciate it! – Jamie Feb 11 '17 at 00:01

1 Answers1

1

You are using $_GET while you are making a Post request.

You have to use $_POST instead

Try this :

$email = $_POST['email'];
Ibu
  • 42,752
  • 13
  • 76
  • 103
Ramen Bar
  • 61
  • 3