I built a website with php that contains a sign up and log in system.
Now I want to make users able to change their password.
The code I have for this is inside of 4 files:
A file that shows a page to the users on which you can enter your email adress, click a button and then see a message that you recieved an email with further instructions.
A file that only contains php code, that sends this email to the user(with PHPMailer), containing a link with a token and selector. Also inside this file there is code so the token, selector and an expiry date get inserted in a table inside the database. This is all working fine.
This file will open as a page when you click the link inside the email. In here you can enter a new password and confirm this new password. Also you can see the token and selector (that I also see inside my database) are inside of the URL of this page. When you submit the new password, something is going wrong. Because I see my error message appear: "Error: The row can not be fetched from the database (pwdreset.inc.php line 44)." This error is coming from my last file:
A file that checks if the token from the URL matches the token from the database. If so, the rest of the code should actually update the old password with the new one inside the users table.
I followed a tutorial on YouTube to make this password reset system. I did everything like in the video, I checked my code for typo's like a hundred times and didn't find any. I also read all the comments and I see many other viewers have the same problem. Nobody in the comment section seems to know the answer and the maker of the video did not reply to anyone adressing this problem. Do you see what is causing this problem?
<?php
error_reporting(E_ALL); ini_set('display_errors', TRUE);
if (isset($_POST["reset-confirm-submit"])) {
$selector = $_POST["selector"];
$validator = $_POST["validator"];
$password = $_POST["resetpwd"];
$passwordRepeat = $_POST["resetpwdrepeat"];
if (empty($password) || empty($passwordRepeat)) {
header("location: ../pwdreset.php?newpwd=empty-input");
exit();
} else if ($password != $passwordRepeat) {
header("location: ../pwdreset.php?newpwd=passwords-do-not-match");
exit();
}
$currentDate = date("U");
require "dbh.inc.php";
$sql = "SELECT * FROM reset_pwd WHERE pwd_reset_selector=? AND pwd_reset_expires >= ?;";
$stmt = mysqli_stmt_init($conn);
if (!mysqli_stmt_prepare($stmt, $sql)) {
echo "Error: The data can not be selected inside the database (pwdreset.inc.php line 36).";
exit();
} else {
mysqli_stmt_bind_param($stmt, "ss", $selector, $currentDate);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if (!$row = mysqli_fetch_assoc($result)) {
echo "Error: The row can not be fetched from the database (pwdreset.inc.php line 44).";
exit();
} else {
$tokenBin = hex2bin($validator);
$tokenCheck = password_verify($tokenBin, $row["pwd_reset_token"]);
if ($tokenCheck === false) {
echo "Error: There is no token for this user inside the database (pwdreset.inc.php line 52).";
exit();
} else if ($tokenCheck === true) {
$tokenEmail = $row["pwd_rest_email"];
$sql = "SELECT * FROM users WHERE users_email=?;";
$stmt = mysqli_stmt_init($conn);
if(!mysqli_stmt_prepare($stmt, $sql)) {
echo "Error: The e-mail adress can not be selected inside the users table (pwdreset.inc.php line 61).";
exit();
} else {
mysqli_stmt_bind_param($stmt, "s", $tokenEmail);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if (!$row = mysqli_fetch_assoc($result)) {
echo "Error: The row can not be fetched from the database (pwdreset.inc.php line 70).";
exit();
} else {
$sql = "UPDATE users SET users_pwd=? WHERE users_email=?;";
$stmt = mysqli_stmt_init($conn);
if(!mysqli_stmt_prepare($stmt, $sql)) {
echo "Error: the password can not be updated inside the database (pwdreset.inc.php line 77).";
exit();
} else {
$newPwdHash = password_hash($password, PASSWORD_DEFAULT);
mysqli_stmt_bind_param($stmt, "ss", $newPwdHash, $tokenEmail);
mysqli_stmt_execute($stmt);
$sql = "DELETE FROM reset_pwd WHERE pwd_rest_email=?;";
$stmt = mysqli_stmt_init($conn);
if(!mysqli_stmt_prepare($stmt, $sql)) {
echo "Error: The token was not deleted from the database (pwdreset.inc.php line 90).";
exit();
} else {
mysqli_stmt_bind_param($stmt, "s", $tokenEmail);
mysqli_stmt_execute($stmt);
header("location: ../index.php?newpwd=password-reset-success");
}
}
}
}
}
}
}
} else {
header("location: ../pwdreset.php?error=no-access");
}