Member Avatar for servis

hellow
every body, script is giving error for the following code $link = "<a href="reset-password.php?ui=$row['user_id']&ak=$upassword">Reset the Password </a>"; i have tried variables with quotes as well but result is sme.
the error is following
"Parse error: syntax error, unexpected T_STRING in C:\wamp\www\ProTest\password-forget.php on line 26"


secondly update query also giving an error

$update-password = mysql_query("update tbl_auth_user set user_password ='$upassword' where user_id = '$row['user_id']'") 
                        or die("Password reset failed");

the error is following
"Parse error: syntax error, unexpected '=' in C:\wamp\www\ProTest\reset-password.php on line 21"

  • 3 Contributors
  • 3 Replies
  • 83 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by nav33n

Dani AI

Generated

A quick diagnosis and a safer approach.

The parse errors come from two places: mismatched quoting when trying to embed an array element inside a string, and an invalid variable name (a hyphen is not allowed). and pointed these out correctly — refer to PHP variable rules for the exact naming/interpolation rules. For immediate debugging, print or var_dump the string you are building to see where quotes break.

Beyond the syntax fix, do not place a password (or any secret) in a query string. Use a single-use reset token (selector + validator), store only the hashed validator, and expire it. Example token flow (generation and storage):

$selector = bin2hex(random_bytes(8));
$validator = bin2hex(random_bytes(32));
$validatorHash = hash('sha256', $validator);
$expires = time() + 3600;

$stmt = $pdo->prepare('INSERT INTO password_resets (user_id, selector, token_hash, expires) VALUES (?, ?, ?, ?)');
$stmt->execute([$userId, $selector, $validatorHash, $expires]);

$resetUrl = "https://example.com/reset.php?sel=$selector&val=$validator";

On receipt, look up by selector and compare hash('sha256', $validator) to the stored hash using hash_equals. Use prepared statements (PDO/mysqli) — the old mysql_* API is removed in modern PHP — and store passwords with password_hash/password_verify. See PDO prepared statements, random_bytes, hash_equals, and OWASP’s for secure implementation.

Recommended Answers

All 3 Replies

Member Avatar for pritaeas 
$link = "<a href='reset-password.php?ui={$row['user_id']}&ak=$upassword'>Reset the Password </a>";

$update_password = mysql_query("update tbl_auth_user set user_password ='$upassword' where user_id = '{$row['user_id']}'") or die("Password reset failed");
Member Avatar for servis

thank you pritaeas, but problem is at its same place, any other method please, your sugesstions are always valueable.

Member Avatar for nav33n

Try this.

$link = "<a href=reset-password.php?ui=".$row['user_id']."&ak=".$upassword.">Reset the Password </a>";

and
$update-password is not a valid variable name. You can't use -. More about it here.
http://in.php.net/language.variables
So, your update query should be like this.

$update_password = mysql_query("update tbl_auth_user set user_password ='$upassword' where user_id = '".$row['user_id']."'") or die("Password reset failed");

Cheers,
Naveen

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.