我有一个用户名和密码数据库。我需要创建一个“忘记密码”功能，让它在表中搜索用户名并返回该用户的密码。然后我希望它发送一封电子邮件说明名称和密码。
以下是我为特定用户查询数据库的工作代码：
<?php
session_start();
include "config.php";
if($_POST['nameQuery']) {
$query = "SELECT * FROM myDatabase WHERE name = '" .$_POST['nameQuery']. "'";
$result = mysql_query($query);
if (mysql_num_rows($result) > 0) {
//User exists
echo '1';
} else {
mysql_query($query);
//User does not exist
echo '0';
}
}
?>
答案 0 :(得分：13)
不要在您的数据库中存储密码。绝不应存储明文密码。您应该存储密码的哈希值，以帮助防止它们在其他站点上使用。有关详细信息，请参阅Best way to store password in database。
答案 1 :(得分：6)
您的代码不安全！ $_POST['nameQuery'] $nameQuery = mysql_real_escape_string ($_POST['nameQuery']);
是{{1}}
最低安全性是逃避和消毒所有输入
{{1}}
黄金法则：绝不信任传入数据。
答案 2 :(得分：3)
社区维基：
别。因为这意味着您将保存可检索的密码。最好将密码更改链接发送到他们的电子邮件，以便访问一次性密码重置页面。这样，在有权访问该用户的电子邮件的人完成重置周期之前，密码不会更改。
通过这种方式，您可以适当地哈希密码并仅针对哈希检查传入密码。
此外，我建议查看php的PDO，因为您当前正在创建可以通过sql-injection进行查询的SQL查询。
答案 3 :(得分：3)
第一件事是第一件事：您可能希望确保不会通过您的登录获得SQL-injected，因为您实际上是将用户输入注入您的查询...大禁忌。
交换：
$query = "SELECT * FROM myDatabase WHERE name = '" .$_POST['nameQuery']. "'";
...为此：
$query = sprintf(
'SELECT * FROM myDatabase WHERE name = \'%s\'',
mysql_real_escape_string($_POST['nameQuery'])
);
接下来是您要求的：获取用户用户名和密码的方法。虽然我不建议您实际以明文形式存储密码供所有人查看，但这是您必须自己决定的。
这段代码将完成契约：
<?php
//Get the data from the DB
$query = sprintf(
'SELECT * FROM myDatabase WHERE name = \'%s\'',
mysql_real_escape_string($_POST['nameQuery'])
);
$result = mysql_query($query);
$user_info = mysql_fetch_assoc($result);
//Check if it's valid
if( isset($user_info['name']) ) {
//Construct the message
$message = 'Your username is: ' . $user_info['name'] . "\n"
$message .= 'Your password is: ' . $user_info['password'] . "\n";
//Send it to the appropriate email
$status = mail(
$user_info['email'],
'Password recovery for ' . $user_info['name'],
$message
);
//Check if it actually worked
if( $status ) echo 'Mail sent. Check your inbox. Login again. Thank you.';
else echo 'The password recovery couldn\'nt be sent. Please try again later.';
} else {
echo 'No user found with the supplied username.',
'Please try again (with another username)';
}
?>
Edit: Adding password recovery-functionality
对于您在下面请求的密码恢复功能，您可以尝试以下方法：
recover_password.php:
<?php
session_start();
//mysql_connect()-here
//Initalize the variable
$do_update_password = false;
//Grab the token
$token = isset($_REQUEST['token'])? $_REQUEST['token'] : '';
$is_post_request = isset($_POST['update_pwd'])? true : false;
$is_recovery_request = isset($_POST['request_recovery'])? true : false;
$message = '';
//Check if we're supposed to act upon a token
if( $is_recovery_request ) {
//Grab the email
$email = isset($_POST['email'])? $_POST['email'] : '';
//Create the query, execute it and fetch the results
$sql = sprintf(
'SELECT `user_id` FROM myDatabase WHERE `email` = \'%s\'',
mysql_real_escape_string($email)
);
$result = mysql_query($sql);
$user_info = mysql_fetch_assoc($result);
//Validate the response
if( isset($user_info['user_id') ) {
//Let's generate a token
$date = date('Y-m-d H:i:s');
$token = md5($email . $date);
//Create the "request"
$sql = sprintf(
'INSERT INTO myRequests (`user_id`, `token`, `date`) VALUES (\'%s\', \'%s\', \'%s\')',
$user_info['user_id'],
mysql_real_escape_string($token),
$date
);
$result = mysql_query($sql);
//Validate
if( mysql_affected_rows($result) == 1 ) {
//Construct the message
$message = 'Your username is: ' . $user_info['email'] . "\n"
$message .= 'Please click on the following link to update your password: http://yoursite.com/request_password.php?token=' . $token . "\n";
//Send it to the appropriate email
$status = mail(
$email,
'Password recovery for ' . $email,
$message
);
//Check if it actually worked
if( $status ) {
echo 'Mail sent. Check your inbox. Login again. Thank you.';
} else {
echo 'The password recovery couldn\'nt be sent. Please try again later.';
}
} else {
$message = 'The DB-query failed. Sorry!';
}
} else {
$message = 'The specified e-mail address could not be found in the system.';
}
} elseif( $token != '' ) {
//Check so that the token is valid length-wise (32 characters ala md5)
if( !isset($token[31]) || !isset($token[32]) ) {
$message = 'Invalid token!';
} else {
//Construct the query and execute it
$sql = sprintf(
'SELECT `user_id` FROM myRequest WHERE `token` = \'%s\'',
mysql_real_escape_string($token);
);
$result = mysql_query($sql);
//Fetch the rows
$request_info = mysql_fetch_assoc($result);
//Check for a valid result
if( isset($request_info['user_id']) ) {
$message = 'Update your password below.';
$do_update_password = true;
} else {
$message = 'No record found for the following token: ' . $token);
}
}
} elseif( $is_post_request ) {
//Grab the new password
$password = isset($_POST['password'])? $_POST['password'] : '';
//Construct the query
$sql = sprintf(
'UPDATE myDatabase SET `password` = \'%s\' WHERE `user_id` = ( SELECT `user_id` FROM myRequest WHERE `token` = \'%s\' )',
mysql_real_escape_string($password),
mysql_real_escape_string($token)
);
//Execute it, and check the results
$result = mysql_query($sql);
if( $result !== false ) {
//Did we succeed?
if( mysql_affected_rows($result) === 1 ) {
//Remove the old recovery-request
$sql = sprintf(
'DELETE FROM myRequests WHERE `token` = \'%s\'',
mysql_real_escape_string($token)
);
$result = mysql_query($sql);
//^We don't actually need to validate it, but you can if you want to
$message = 'Password updated. Go have fun!';
} else {
$message = 'Could not update the password. Are you sure that the token is correct?';
}
} else {
$message = 'Error in the SQL-query. Please try again.';
}
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Password recovery</title>
<style>
form > * { display: block; }
</style>
</head>
<body>
<h1><?php echo $message; ?></h1>
<?php if( $do_update_password ): ?>
<form method="post">
<label for="token">Token:</label>
<input type="text" name="token" id="token" value="<?php echo $token; ?>" />
<label for="password1">Password:</label>
<input type="text" name="password[]" id="password1" />
<label for="password2">Password (again):</label>
<input type="text" name="password[]" id="password2" />
<input type="submit" name="update_pwd" value="Update your password!" />
</form>
<?php elseif($is_post_request && $token != ''): ?>
<h2>Request that might've updated your password. Exciting!</h2>
<?php else: ?>
<form method="post">
<label for="email">E-mail address:</label>
<input type="text" name="email" id="email" />
<input type="submit" name="request_recovery" value="Request a new password" />
</form>
<?php endif; ?>
</body>
</html>
请注意，我没有时间对代码进行实际测试，但我认为通过一些小的调整可以正常工作。哦，在我忘记之前，你需要将下表添加到DB中：
表myRequests的表结构
CREATE TABLE IF NOT EXISTS `myRequests` (
`request_id` int(6) NOT NULL AUTO_INCREMENT,
`token` varchar(32) NOT NULL,
`user_id` int(6) NOT NULL,
`date` datetime NOT NULL,
PRIMARY KEY (`request_id`),
UNIQUE KEY `token` (`token`,`user_id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
答案 4 :(得分：2)
我有一些建议
答案 5 :(得分：1)
虽然与原始问题相关，但我想指出以纯文本格式存储密码是一个坏主意。您应该在数据库中存储密码的散列版本。然后，您可以哈希用户输入并将其与数据库中用于登录的内容进行比较。
相反，您的忘记密码应该创建一个新的（临时）密码，并将该密码存储在数据库中，同时将纯文本密码发送到存档的电子邮件帐户。
答案 6 :(得分：1)
请阅读结果：
/* ... */
if (mysql_num_rows($result) > 0) {
// User exists
$row = mysql_fetch_row($result);
print_r($row);
}
/* ... */
更一般地说：您的代码中存在SQL注入漏洞，请查看该主题，否则攻击者将能够读取您所有用户的密码。
此外，建议不要在您的数据库中以明文形式存储密码。请使用像sha1或sha256这样的散列算法来存储密码。
答案 7 :(得分：0)
<?php
session_start();
include "config.php";
if($_POST['nameQuery']) {
$query = "SELECT * FROM myDatabase WHERE name = '" .mysql_real_escape_string($_POST['nameQuery']). "'";
$result = mysql_query($query) or die ('Error: '.mysql_error());
if (mysql_num_rows($result) > 0) {
$row = mysql_fetch_assoc($result);
$message = 'Your password is: '.$row['password'];
if(mail($row['user_email'], 'Lost password', $message)){
echo 'Password sent';
}
} else {
echo 'Nu such user';
}
}
?>
答案 8 :(得分：0)
我建议您将表格设计更改为
登录时，请根据哈希密码检查用户，如下所示
$_POST['password']=sha1($_POST['password']);
当登录时，然后使用像 从tbl中选择col1，col2，..其中user =？和密码=？然后使用$ _POST ['username']，$ _POST ['password']
填充参数所以使用准备好的声明或PDO
当用户忘记密码时使用相同的逻辑
答案 9 :(得分：-3)
您必须从mysql_query结果中检索用户名和密码（存储在$result变量中），如下所示：
$row = mysql_fetch_array($result);
$username = $row['username'];
$password = $row['password'];
然后使用php的mail()函数发送电子邮件。