无法获取获取变量以重置密码

时间:2018-08-22 14:13:21

标签: php html change-password reset-password

我已经建立了一个网站,现在我正在尝试创建一种允许用户在忘记密码时重置密码的方式。我已经成功创建了一个密码重置URL链接,但是每次单击它都会收到一个“无效请求!”。通知,而不是带我到index.php页面。如果有人可以帮助,我将不胜感激。我的代码在下面。

resetpassword.php       

  include ("connect.php");

  //Connect to MySQL database using PDO.
 $pdo = new PDO("mysql:host=$host;dbname=$dbname", $user, $pwd);

 //Get the name that is being searched for.
 $email = isset($_POST['email']) ? trim($_POST['email']) : '';

 //The simple SQL query that we will be running.
 $sql = "SELECT `id`, `email` FROM `registration` WHERE `email` = :email";

 //Prepare our SELECT statement.
 $statement = $pdo->prepare($sql);

 //Bind the $name variable to our :name parameter.
 $statement->bindValue(':email', $email);

 //Execute the SQL statement.
 $statement->execute();

//Fetch our result as an associative array.
$userInfo = $statement->fetch(PDO::FETCH_ASSOC);

//If $userInfo is empty, it means that the submitted email
//address has not been found in our users table.
if(empty($userInfo)){
echo 'That email address was not found in our system!';
exit;
}

//The user's email address and id.
$userEmail = $userInfo['email'];
$userId = $userInfo['id'];

//Create a secure token for this forgot password request.
$token = openssl_random_pseudo_bytes(16);
$token = bin2hex($token);

//Insert the request information
//into our password_reset_request table.

//The SQL statement.
$insertSql = "INSERT INTO password_reset_request
          (user_id, date_requested, token)
          VALUES
          (:user_id, :date_requested, :token)";

//Prepare our INSERT SQL statement.
$statement = $pdo->prepare($insertSql);

//Execute the statement and insert the data.
$statement->execute(array(
"user_id" => $userId,
"date_requested" => date("Y-m-d H:i:s"),
"token" => $token
));

//Get the ID of the row we just inserted.
$passwordRequestId = $pdo->lastInsertId();

 //Create a link to the URL that will verify the
 //forgot password request and allow the user to change their
 //password.
 $verifyScript = 'http://localhost/trial/pages/createpassword.php';

//The link that we will send the user via email.
$linkToSend = "<a href='$verifyScript'? 
uid='.$userId.'&id='.$passwordRequestId.'&t='.$token'>$verifyScript.'? 
uid='.$userId.'&id='.$passwordRequestId.'&t='.$token</a>";

//Print out the email for the sake of this tutorial.
echo $linkToSend;

?>

创建密码

<form id="resetpasswordForm" action="verifypassword.php" class="loading-form" 
 method="POST">
<div class="form-group">
  <label for="email-input">Email</label>
  <input required name="email" type="email" class="form-control" id="email" 
title="An email is required">
</div>

<div class="form-group">
  <label for="password-input">Password</label>
  <input required type="password" name="password" class="form-control" 
id="pwd">
</div>

<div class="form-group">
  <label for="password-input">Confirm Password</label>
  <input required type="password" name="confirmpassword" class="form-control" 
 id="conpwd">
 </div>

<div class="form-group">
<!-- Do NOT use name="submit" or id="submit" for the Submit button -->
<button type="submit" name="ResetPasswordForm" class="btn btn-success">Reset 
Password</button>
</div>
<input type="hidden" name="uid" value="<?php echo $_GET['uid'];?>" />
<input type="hidden" name="t" value="<?php echo $_GET['t'];?>" />
<input type="hidden" name="id" value="<?php echo $_GET['id'];?>" />
</form>

验证密码     

include ("connect.php");

//Connect to MySQL database using PDO.
$pdo = new PDO("mysql:host=$host;dbname=$dbname", $user, $pwd);

//The user's id, which should be present in the GET variable "uid"
$userId = isset($_GET['uid']) ? trim($_GET['uid']) : '';
//The token for the request, which should be present in the GET variable "t"
$token = isset($_GET['t']) ? trim($_GET['t']) : '';
//The id for the request, which should be present in the GET variable "id"
$passwordRequestId = isset($_GET['id']) ? trim($_GET['id']) : '';

//Now, we need to query our password_reset_request table and
//make sure that the GET variables we received belong to
//a valid forgot password request.

$sql = "
  SELECT id, user_id, date_requested 
  FROM password_reset_request
  WHERE 
    user_id = :user_id AND 
    token = :token AND 
    id = :id
 ";

//Prepare our statement.
$statement = $pdo->prepare($sql);

 //Execute the statement using the variables we received.
 $statement->execute(array(
"user_id" => $userId,
"id" => $passwordRequestId,
"token" => $token
 ));

 //Fetch our result as an associative array.
 $requestInfo = $statement->fetch(PDO::FETCH_ASSOC);

 //If $requestInfo is empty, it means that this
 //is not a valid forgot password request. i.e. Somebody could be
 //changing GET values and trying to hack our
 //forgot password system.
 if(empty($requestInfo)){
 echo 'Invalid request!';
 exit;
 }

 //The request is valid, so give them a session variable
 //that gives them access to the reset password form.
 $_SESSION['user_id_reset_pass'] = $userId;

//Redirect them to your reset password form.
header('Location: index.php');
exit;

?>

2 个答案:

答案 0 :(得分:0)

修改此代码:

vertical-align: text-top

收件人:

vertical-align: baseline

或者只是从字符串中删除偶然的点

$linkToSend = "<a href='$verifyScript'? 
uid='.$userId.'&id='.$passwordRequestId.'&t='.$token'>$verifyScript.'? 
uid='.$userId.'&id='.$passwordRequestId.'&t='.$token</a>";

答案 1 :(得分:-1)

据我了解,您的变量没有传递任何信息,因此可能是由于您的sql语句所致:

$requestInfo = $statement->fetch(PDO::FETCH_ASSOC);

我从没使用过PDO,所以不能100%确定,但是请尝试一下:

$id = htmlentities($connect->real_escape_string($_GET['id']));
$userid = htmlentities($connect->real_escape_string($_GET['uid']));
$token = htmlentities($connect->real_escape_string($_GET['token']));

$sql = " SELECT * FROM password_reset_request WHERE user_id = '$userid' AND token = '$token' AND id = '$id' ";