Updating specific column in a particular row in mysql using php?

Question

I have been trying to create a reset password feature for my website, where the user can insert the already registered email and that will generate a random OTP and will be stored in the same column as the user's details such as

id firstname lastname username email resetpassword
1  name      last     user     email OTP

this is my code but it's not working.

<?php
require 'dbh.php';
session_start();

$random = mt_rand(1000,1000000);

$email = $_POST['email'];

$sql = "SELECT Email FROM registeredusers WHERE Email='$email'";
$result = mysqli_query($connection,$sql);
$emailCheck = mysqli_num_rows($result);

if (empty($email))
{
    echo "please fill out all the fields";
}

else{

    $result = mysqli_query($connection,$sql);
    $sql = "UPDATE registeredusers SET ResetPassword='$random' WHERE Email='$email'";
Header("Location: submitOTP.php");
}

?>

I am just trying this out so the form looks something like this

<form action="resetPassword.php" method="POST">

<input type="text" value="email" name="email"></input>
<input type="submit" value="submit"></input>

</form>

[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) — Jay Blanchard, Feb 27 '17 at 18:52

score 1 · Answer 1 · answered Feb 27 '17 at 18:55

You should firts assigne the sql code and after execute the query

$sql = "UPDATE registeredusers SET ResetPassword='$random' WHERE Email='$email'";
$result = mysqli_query($connection,$sql);

otherwise you simply repeat the previous (select ) query ..

and be careful for avoid sql injection take a look at prepared query and binding param

Updating specific column in a particular row in mysql using php?

1 Answers1