在PHP中：在用户邮件中发送验证链接以获取忘记的密码

Question

I have a task on Registration system in Php.after forgot password I have to send a verification link to user mail so that if user click on that verification link forgot password form will open I am not understanding where I am doing wrong and why my code is not working Can Anyone Point me where I am going wrong. Thanks In Advance

<?php
 require_once ( "./connect.php" );

 if ( !empty( $_POST['submit'] ) ) {
    $passkey = isset($_POST['$passkey']) ? $_POST['$passkey'] : '';
    // Passkey that got from link 
            $passkey = $_POST['passkey'];
            $user = "registration";

            // Retrieve data from table where row that match this passkey 
            $sql ="SELECT * FROM `user` WHERE confirm_code ='$passkey'";
            $result = $db->query($sql);

            // If successfully queried 
            if( $result ) {

            // Count how many row has this passkey
                $count = mysql_num_rows( $result );

            // if found this passkey in our database, retrieve data from table "temp_members_db"
            if ( $count == 1 ) {

                $rows = mysql_fetch_array( $result );
                $username = $rows['username'];
                $email = $rows['email'];
                $password = $rows['password']; 

                $user = "registration";

                // Insert data that retrieves from "temp_members_db" into table "registered_members" 
                $sql = "INSERT INTO $user ( name, email, password )VALUES( '$name', '$email', '$password' )";
                $result = $db->query($sql);
            }

                // if not found passkey, display message "Wrong Confirmation code" 
                else {
                    echo "Wrong Confirmation code";
                }

                // if successfully moved data from table"temp_members_db" to table "registered_members" displays message "Your account has been activated" and don't forget to delete confirmation code from table "temp_members_db"
                if ( $result ){
                    echo "Your account has been activated"; 
                    // Delete information of this user from table "temp_members_db" that has this passkey 
                    $sql="DELETE FROM `user` WHERE confirm_code = '$passkey'";
                    $result = $db->query($sql);

                }

        }
}
?>

Answer 1

I've made some changes to your code, give it a try.

<?php
    if(isset($_POST['submit'])){
      if(!empty($_POST['passkey'])){
   //Get the Passkey that got from link 
           $passkey = $_POST['passkey'];
           $user = "registration";

           // Retrieve data from table where row that match this passkey 
           $sql ="SELECT * FROM `user` WHERE confirm_code = $passkey ";
           $result = $db->query($sql);

           // If successfully queried 
           if( $result ) {

           // Count how many row has this passkey
               $count = mysql_num_rows( $result );

           // if found this passkey in our database, retrieve data from table "temp_members_db"
           if ( $count == 1 ) {

               $rows = mysql_fetch_array( $result );
               $username = $rows['username'];
               $email = $rows['email'];
               $password = $rows['password']; 

               $user = "registration";

               // Insert data that retrieves from "temp_members_db" into table "registered_members" 
               $sql = "INSERT INTO $user ( name, email, password )VALUES( $name, $email, $password )";
               $result = $db->query($sql);
              }
               // if not found passkey, display message "Wrong Confirmation code" 
              else {
                   echo "Wrong Confirmation code";
              }
               // if successfully moved data from table"temp_members_db" to table "registered_members" displays message "Your account has been activated" and don't forget to delete confirmation code from table "temp_members_db"
              if($result){
                  // add inside the massage variable the confirmation code $passkey and your customized message 
                  // change the $from variable with the email address you want use to send the verification mail. This is the address who the user will see
                   $message = "To activate your account please click on the following link https://yoursite.com/?code=$passkey";
                   $from = "";

                   if(mail($email, $message, $from)){

                   echo "Your account has been activated"; 
                   // Delete information of this user from table "temp_members_db" that has this passkey 
                   $sql="DELETE FROM `user` WHERE confirm_code = $passkey";
                   $result = $db->query($sql);
                   }
                   else{
                   // error
                   }
               }
           }
       }
}
?>

I've added the PHP built in function mail. Read the doc about for more info on how to use it. You can see the var $from that will hold your mail address and the var $message that will contain the link you want to send. The form variable will be passed as an header of the email that will be sended using the mail() func. Note the if() statement, mail function will return true if success.

Answer 2

There are plenty of things to point out here, all of which may contribute to the problem.

First off, the $result variable is being checked multiple times without being reset in between. This means that you may get both the output "Wrong Confirmation code" and "Your account has been activated" from the same form submission (if the first query is successful, but no matching passkey is found in the db).

This line looks like it probably won't do anything:

$passkey = isset($_POST['$passkey']) ? $_POST['$passkey'] : '';

It should probably be:

$passkey = isset($_POST['passkey']) ? $_POST['passkey'] : '';

This doesn't matter much though, since $passkey is assigned a new value on the next line of code.

Finally, this insert uses the variable $name instead of $username:

$sql = "INSERT INTO $user ( name, email, password )VALUES( '$name', '$email', '$password' )";

This is probably what is intended:

$sql = "INSERT INTO $user ( name, email, password )VALUES( '$username', '$email', '$password' )";

Answer 3

I think the problem is with $_POST array. usually we send confirmation link in email the confirmation link contains the confirmation code as query string. when we click on the link the redirected page get the confirmation code and proceed.

<?php
    require_once ( "./connect.php" );

   if ( isset($_GET['passkey']) && !empty( $_GET['passkey'] ) ) {
     $passkey = $_GET['passkey'];
     // Passkey that got from link 
        $passkey = $_GET['passkey'];
        $user = "registration";

        // Retrieve data from table where row that match this passkey 
        $sql ="SELECT * FROM `user` WHERE confirm_code ='$passkey'";
        $result = $db->query($sql);

        // If successfully queried 
        if( $result ) {

        // Count how many row has this passkey
            $count = mysql_num_rows( $result );

        // if found this passkey in our database, retrieve data from table "temp_members_db"
        if ( $count == 1 ) {

            $rows = mysql_fetch_array( $result );
            $username = $rows['username'];
            $email = $rows['email'];
            $password = $rows['password']; 

            $user = "registration";

            // Insert data that retrieves from "temp_members_db" into table "registered_members" 
            $sql = "INSERT INTO $user ( name, email, password )VALUES( '$name', '$email', '$password' )";
            $result = $db->query($sql);
        }

            // if not found passkey, display message "Wrong Confirmation code" 
            else {
                echo "Wrong Confirmation code";
            }

            // if successfully moved data from table"temp_members_db" to table "registered_members" displays message "Your account has been activated" and don't forget to delete confirmation code from table "temp_members_db"
            if ( $result ){
                echo "Your account has been activated"; 
                // Delete information of this user from table "temp_members_db" that has this passkey 
                $sql="DELETE FROM `user` WHERE confirm_code = '$passkey'";
                $result = $db->query($sql);

            }

    }
}
 ?>  

I hope this will work for you. I copy your code and made some changes. :)

Answer 4

<?php

require_once ( "./connect.php" );

if (!empty($_POST['submit'])) {

    $passkey = isset($_POST['passkey']) ? $_POST['passkey'] : '';
    // Passkey that got from link 
    $passkey = $_POST['passkey'];
    $user = "registration";

    // Retrieve data from table where row that match this passkey 
    $sql = "SELECT * FROM `user` WHERE confirm_code ='$passkey'";
    $result = $db->query($sql);

    // If successfully queried 
    if ($result) {

        // Count how many row has this passkey
        $count = mysql_num_rows($result);

        // if found this passkey in our database, retrieve data from table "temp_members_db"
        if ($count == 1) {

            $rows = mysql_fetch_array($result);
            $username = $rows['username'];
            $email = $rows['email'];
            $password = $rows['password'];

            $user = "registration";

            // Insert data that retrieves from "temp_members_db" into table "registered_members" 
            $sql = "INSERT INTO $user ( name, email, password )VALUES( '$username', '$email', '$password' )";
            $result = $db->query($sql);
        }

        // if not found passkey, display message "Wrong Confirmation code" 
        else {
            echo "Wrong Confirmation code";
        }

        // if successfully moved data from table"temp_members_db" to table "registered_members" displays message "Your account has been activated" and don't forget to delete confirmation code from table "temp_members_db"
        if ($result) {
            echo "Your account has been activated";
            // Delete information of this user from table "temp_members_db" that has this passkey 
            $sql = "DELETE FROM `user` WHERE confirm_code = '$passkey'";
            $result = $db->query($sql);
        }
    }
}
?>