0

I'm writing a page to work as a forgotten password which emails a link with a token, for the most it works perfectly and up until line 89 which is to update the user table with the token and exp date for the token, I get nothing, no errors no success, it doesn't even return me to the index.php page defined on success

Line 89 is just after the commented-out section which emails the user, up till this point all works perfectly

I'm learning as I'm building, to be honest, so I have no formal training I have used the mysqli_prepare statements on the Register and Login pages but there is a select and insert statement this is the first time with an UPDATE.

From my existing pages and web guides/references, I can not see where I have gone wrong.

Any help you can give would be much appreciated.

    <?php
// Initialize the session
session_start();
 
// Check if the user is logged in, otherwise redirect to login page
if($_SESSION["loggedin"] == true){
    header("location: password-change.php");
    exit;
}
 
// Include config file
require_once "inc/config.php";
 
// Define variables and initialize with empty values
$email = $human = "";
$email_err = $human_err = "";
 
// Processing form data when form is submitted
if($_SERVER["REQUEST_METHOD"] == "POST"){
 
    // Validate email
    if(empty(trim($_POST["email"]))){
        $email_err = "Please enter a email.";
    } elseif(!preg_match('/^([a-zA-Z0-9\+_\-]+)(\.[a-zA-Z0-9\+_\-]+)*@([a-zA-Z0-9\-]+\.)+[a-zA-Z]{2,6}$/', trim($_POST["email"]))){ 
        $email_err = "email can only contain letters, numbers, and underscores.";
    } else{
        // Prepare a select statement
        $sql = "SELECT id FROM users WHERE email = ?";
        
        if($stmt = mysqli_prepare($link, $sql)){
            // Bind variables to the prepared statement as parameters
            mysqli_stmt_bind_param($stmt, "s", $param_email);
            
            // Set parameters
            $param_email = trim($_POST["email"]);
            
            // Attempt to execute the prepared statement
            if(mysqli_stmt_execute($stmt)){
                /* store result */
                mysqli_stmt_store_result($stmt);
                
                if(mysqli_stmt_num_rows($stmt) == 1){
                    $email = trim($_POST["email"]);
                } else{
                    $email_err = "No email like this exists.";
                }
            } else{
                echo "Oops! Looks like Something went wrong. Please try again later.";
            }

            // Close statement
            mysqli_stmt_close($stmt);
        }
    }
    
    // Validate human name
    if(empty(trim($_POST["human"]))){
        $human_err = "Please enter your answer (In Numbers)"; 
    } elseif(!preg_match('/[0-9]$/', trim($_POST["human"]))){ 
        $human_err = "Your answer can only contain numbers."; 
    } elseif(trim($_POST["human"]) != 12 ) { 
        $human_err = "Sorry thats incorrect, please try again."; 
    } else {
    }
 
   // Check input errors before inserting in database
   if(empty($email_err) && empty($human_err)){
        $token = md5($email).rand(10,9999);
        $expFormat = mktime(date("H"), date("i"), date("s"), date("m") ,date("d")+1, date("Y"));
        $expDate = date("Y-m-d H:i:s",$expFormat); 
        $link = "<a href='https://www.heroestable.com.au/reset-password.php?key=" . $email . "&token=" . $token . "'>Click To Reset password</a>";

        //  $toMail = "peddlerstable@gmail.com";
        //  $header = "From: Trevor <trevormulley@outlook.com>\r\n" .
        //  "Content-Type: text/html; charset=UTF-8\r\n" .
        //  "Reply-To: trevormulley@outlook.com\r\n" .
        //  "X-Mailer: PHP/" . phpversion();
        //  $MySubject = "User password request request from [HeroesTable.com.au]\r\n";

        //  $body = "<p>Hey there friend,</p>" .
        //  "Someone has requested the password to be reset for this email address: $email.<br>" . 
        //  "If this wasnt you please ignore this email as no change has been made, otherwise please click the link below to reset your password." .
        //  "<p> $link </p>" .
        //  "Regards<br>" .
        //  " - Trev<br><br>" .
        //  "<img src='https://heroestable.com.au/images/heroes-table-disc-150x150.webp' width='150' height='150'>";
        //  mail($toMail, $MySubject, $body, $header); 

    // Prepare an update statement
    $sql = "UPDATE users SET reset_link_token = ?, exp_date = ? WHERE email = ?";
    
    if($stmt = mysqli_prepare($link, $sql)){
        mysqli_stmt_bind_param($stmt, "sss", $param_token, $param_expDate, $param_email);
        // Set parameters
        $param_token = $token;
        $param_expDate = $expDate;
        $param_email = $email;

    // Attempt to execute the prepared statement
    if(mysqli_stmt_execute($stmt)){
        header("location: index.php");
        exit();
    } else{
        echo "Oops! Something went wrong. Please try again later.";
        echo("Error description: " . $stmt -> error);
        echo "<br>"; print_r($_POST);
    }

    // Close statement
    mysqli_stmt_close($stmt);
    }
    }
    
    // Close connection
    mysqli_close($link);
}
include "inc/headder.php"
?>

<body>
<div class="center padd-text-top">
  <div class="auth">
    <h2>Forgot password</h2>
    <p>Please enter your registered email address and the human check and we will email you a link to reset your password.</p>
    <form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post"> 
        <div class="form-group">
            <label>&nbsp;</label>
            <input type="text" name="email" placeholder="email address" class="form-control <?php echo (!empty($email_err)) ? 'is-invalid' : ''; ?>" value="<?php echo $email; ?>">
            <span class="invalid-feedback"><?php echo $email_err; ?></span>
        </div>
        <div class="form-group">
            <label>&nbsp;</label>
            <input type="text" name="human" placeholder="What is six plus six? (Numbers Only)" class="form-control <?php echo (!empty($human_err)) ? 'is-invalid' : ''; ?>" value="<?php echo $human; ?>">
            <span class="invalid-feedback"><?php echo $human_err; ?></span>
        </div>
        <div class="form-group">
                &nbsp;
            </div>        
        <div class="form-group">
            <input type="submit" class="btn btn-primary" value="Submit">
            <a class="btn btn-link ml-2" href="index.php">Cancel</a>
        </div>
    </form>
  </div>    
</div>
  </body>
</html>
Trev
  • 1
  • 1
  • All your web guides/references are pathetically wrong. This `if($stmt = mysqli_prepare($link, $sql)){` stuff is what you should [never ever do](https://phpdelusions.net/basic_principles_of_web_programming#error_reporting), leading you to the exact situation you described: nothing works and nothing says. You should always properly configure error reporting for your application and should never ever sweep errors under the rug. Then you will get notified of the problem and be able to fix it – Your Common Sense Oct 02 '22 at 05:30

0 Answers0