PHP Password Reset Script

[gilgil2]

Hi I am trying to write a password reset script. An email with a link is sent to the user, and then if the username and a 32 character string in the link match the info in the database they can change the password for that account. Here is what I've got so far:

   <?php
    session_start();
    error_reporting(E_ALL ^ E_NOTICE);

    if (isset($_GET['x'])) {
        $x = $_GET['x'];
    } else {
        $x = 0;
    }
    if (isset($_GET['y'])) {
        $y = $_GET['y'];
    } else {
        $y = 0;
    }

    if (strlen($y) > 0) {

    echo '<form action="reset.php" method="post">

        <p><input type="password" name="password1" size="30" maxlength="40" />Password</p>

        <p><input type="password" name="password2" size="30" maxlength="40" />Confirm Password</p>

        <p><input type="submit" name="submit" value="Reset" /></p>
    </form>';

    }
    else {

        echo 'Link not valid!';

    }


    if (isset($_POST['password1']) && isset($_POST['password2'])) {
            if ($_POST['password1']=$_POST['password2']) {

    $realp = $_POST['password1'];

        $link = mysql_connect('', '', ''); 
    if (!$link) { 
        die('Could not connect: ' . mysql_error()); 
    } 
    mysql_select_db(); 

    $query = "UPDATE users SET password=$realp WHERE (username='" . $x . "'  AND password='" . $y . "') LIMIT 1";  
        $result = mysql_query($query);

        if (mysql_affected_rows() == 1) {

            echo 'Your password has been changed. You may now <a href=\"http://example.com/login.php\">log in</a>.';
        } else {
            echo 'Your password could not be changed. Please re-check the link or contact the system administrator.';
        }

            }
    }


    ?>

When I test it it says the password could not be changed...

Thanks for any help
Gilgil

[iamthwee]

I've not really looked at it but line 36 looks like you need two equal signs ==

Additionally, it would be a damn good idea to at least encrypt your passwords, one time hashes such as MD5 seem popular ATM.

[gilgil2]

Hi thanks for the reply, I tried == but it still does not work.

Ye the passwords are encrypted I just took that bit out to simplify the reset script until I get it working.

[iamthwee]

Try this:

if (isset($_POST['password1']) && isset($_POST['password2'])) 
    {
       if ($_POST['password1']== $_POST['password2']) 
       {
          $realp = $_POST['password1'];
          echo($realp);
          $link = mysql_connect('localhost', 'root', ''); 

         if (!$link) 
         { 
          die('Could not connect: ' . mysql_error()); 
         } 

        mysql_select_db(''); 

        $query = "UPDATE users SET password='$realp' WHERE (username='$x') LIMIT 1";  
        $result = mysql_query($query);


        if (mysql_affected_rows() == 1) 
        {
            echo 'Your password has been changed. You may now <a href=\"http://example.com/login.php\">log in</a>.';
        } 
        else {
            echo 'Your password could not be changed. Please re-check the link or contact the system administrator.';
        }
        }
    }