May 10, 201511 yr Hi. I have created a password reset function in PHP. It's working just fine...........except that, for some reason, I'm unable to set the recipient's email address : "TO" The code works this way : (a) the user is asked to provide his login/username ( php sends an sql query to the database; © if the username is found, php takes the email-address, and sends a Reset Link via email (d) this reset-link has a unique "token" attached to it (e) the user clicks on the link in his email, and is re-directed to a new page where he resets his password Everything is working fine...........except for the email structure itself. The email comprises : TO, CC, SUBJECT, BODY, and HEADERS. Everything is being shown..........except the actual "TO". In fact, the only reason I know that the code works ie because I'm getting a copy of the email, via the the "CC" Here is my code : if(isset($_POST['submit']) || isset($_POST['submit'])) { $login = $_POST['login']; $query = "select * from personal_data where login='$login'"; $result = mysqli_query($conn,$query); $count=mysqli_num_rows($result); $rows=mysqli_fetch_array($result); if($count==0) { echo "Sorry; that username does not exist in our database"; } else { function getRandomString($length) { $validCharacters = "ABCDEFGHIJKLMNPQRSTUXYVWZ123456789!#+=%&/?*$"; $validCharNumber = strlen($validCharacters); $result = ""; for ($i = 0; $i < $length; $i++) { $index = mt_rand(0, $validCharNumber - 1); $result .= $validCharacters[$index]; } return $result; } $token=getRandomString(40); $q="insert into token (token,login) values ('".$token."','".$login."')"; mysqli_query($conn,$q); function mailresetlink($to,$token){ $to = $rows['email']; $subject = "Password Reset"; $uri = 'http://'.$_SERVER['HTTP_HOST'] ; $message = ' <html> <head> <title>Password Reset Link</title> </head> <body> <p>We received a Password-Reset request from your account.</p> <p>Click on the following link to reset your password : <a href="'.$uri.'/PHP/password_reset?token='.$token.'">Reset Password</a></p> </body> </html> '; $headers = "MIME-Version: 1.0" . "\r\n"; $headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n"; $headers .= 'From: Support<support@xxxxx.com>' . "\r\n"; $headers .= 'Bcc: Info<info@xxxxx.com>' . "\r\n"; if(mail($to, $subject, $message, $headers)) { echo "A password reset link has been sent to your email address." } } if(isset($_POST['login'])) { mailresetlink($email,$token); exit(); } } } Edited May 21, 201511 yr by rallport Edited to use CODE tags
May 21, 201511 yr Author We are in 2015 and people actually still build their own email headers? Really? Try using something like SwiftMailer / PHPMailer - both have been tried an tested by thousands of other developers and work. Assume you're looking into the security issues in the rest of your code? This is 2015 ???????????? REALLY ????? Damn, time sure flies when you got work to do
May 21, 201511 yr Have you tried a var_dump of your $rows['email'] after the query has been performed? What does it return? Also I think you should use prepared statements with your db query. Right now it looks like a hacker could concatenate a delete statement or similar with the existing query just by using the post input. Edited May 21, 201511 yr by Nillervision
Create an account or sign in to comment