Question

用户忘记了我网站上的密码。他们输入用户名并触发一封电子邮件，其中包含一个链接，其中包含一个附加到重置页面网址的标记。单击链接时，将验证令牌是否存在且到期。如果好，则显示重置密码表单，否则出现错误消息并重试。这一切都很好。当用户输入新密码并点击提交时，网址的附加部分将消失，只有常规页面网址位于地址栏中。重置密码表格只是空白。由于我使用$ _GET来检索令牌和$ _POST来处理表单，这可能是我的问题吗？我在这里包含页面代码：

<?php
require_once ('functions.inc.php');
include("header.php");
require_once ('config.inc.php');
?>
<body> 
<div data-role="page" id="resetpassword">
    <div data-role="header">
        <h1>Reset Password</h1>
    </div>
    <div data-role="content">
<?php
$page_title = 'ResetPassword';
if ($_SERVER['REQUEST_METHOD'] == 'GET') { 
$tk = ($_GET['token']);
$q1 = "SELECT uname, request_time FROM users WHERE token = '$tk'";
    $r1 = mysqli_query($dbconn,$q1)or die("Error: ".mysqli_error($dbconn));
    $row = mysqli_fetch_array($r1); 
    $user = $row['uname'];
    $then = $row['request_time'];
    //echo $then;
    $now = time();
    //echo $now;
    $expired = ($now - $then);
    //echo $expired;
    $num_rows = mysqli_num_rows($r1);       
    if ($num_rows !== 1 || $expired > 900){
    echo "An error has prevented a password change.<br />Most likely the link has       expired.<br />Please try again.";   
    ?>
    </div>
    <div data-role="footer" class="ui-bar">
    <a href="../index.php" data-role="button">Try Again</a> 
    </div><!-- /footer -->
    </div>
    <?php
    exit();
}           
        if ($_SERVER['REQUEST_METHOD'] == 'POST') {         
        $trimmed = array_map('trim', $_POST);
        if (preg_match ('/^[[:alnum:]]{8,20}$/', ($trimmed['password']))) {
            $p = mysqli_real_escape_string($dbconn, ($trimmed['password']));
            // hash the password
            require ("passhash.php");
            $pass_hash = PassHash::hash($p);
            } else {
            echo '<p>Please enter a valid password!</p>';
            }
            if ($pass_hash) {
            $q2 = "UPDATE `users` SET upass='$pass_hash' WHERE uname='$user'";
            $r2 = mysqli_query($dbconn, $q2)or die("Error: ".mysqli_error($dbconn));
            if ($r2 == TRUE) {
            echo "<p>Password Changed!</p>";
            }
            }               
?>
</div><!-- /content -->
    <div data-role="footer" class="ui-bar">
<a href="../index.php" data-role="button">Login</a> 
    </div><!-- /footer -->
</div><!-- /page -->
<?php
}
}
?>
<form id="passwordreset" method="post" action="<?php echo $_SERVER['PHP_SELF'];?>?token=<?php echo $tk;?>" data-ajax="false"> 
<p>Choose a new password.<br />
Letters and numbers only.<br />
Minimum of 8 Maximum of 20 characters.</p>
<label for="password" class="ui-hidden-accessible">New Password:</label> 
<input type="password" name="password" id="password" value="" placeholder="New Password"/>
<button type="submit" name="submit" value="submit"/>Submit</button>  
</form>
</div><!-- /content -->
    <div data-role="footer" class="ui-bar">
    </div><!-- /footer -->
</div><!-- /page -->
</body>
</html>

Answer 1

同时使用POST和GET不会导致任何问题，因为它在此处说明： Want to use both GET and POST methods

但是当表单发布数据时，POST URL也需要包含GET参数（令牌）。因此，修改帖子网址以发送您需要的全部数据。

令牌验证后，重置表单不会处理

1 个答案: