forgot password php form

[kev wood]

i have created a forgot password form to go with my web site a mysql table holds all the login details and i have i have set up a query to retrieve what i need.

 

the problem i am having is that no matter what registered name i put in i get the message saying the email address could not be found in the db.  if anyone can see where it has gone wrong please point it out my eyes are sore from looking at 

 

the code is

$query="SELECT password FROM merc_users WHERE first_name = '$first_name' AND email_address = '$email_address'";
$st=mysql_query($query);
$recs=mysql_num_rows($st);
$row=mysql_fetch_object($st);
$em=$row->email_address;// email is stored to a variable
if ($recs == 0) {  echo "<span class=style3>Sorry Your $email_address is not in our database.<br />
Please make sure you have entered it in correctly and <a href=\"javascript:history.go(-1)\">try again.</a></span>"; exit;}

[.josh]

first off, try putting an

 

echo $first_name . '<br>';
echo $email_address; 

 

above your $query = ....

 

to see if your variables are holding what they're  supposed to be holding.  If they aren't...

 

[kev wood]

no it echo's out the correct values for the variables.  could it be the way the query is written  ???

[kev wood]

i have just created a page to print out the contents of the mysql db merc_users and the user name an email address are in side the table.  it has to be something wrong with the sql. but what that is i am stuck on.  ???

[.josh]

well, to be honest, I'm not 100% certain of your querying style there...I mean, there's many ways to do the same thing, but that's not how I would do it, so I'm unfamiliar with the inner workings of for instance mysql_fetch_object etc.. however...

 

Right off the bat though I would say your actual query string is only going to return a password. I guess that's what you're shooting for, but then you have:

 

$row=mysql_fetch_object($st);
$em=$row->email_address;// email is stored to a variable

 

$em isn't going to be assigned anything, because you only queried for a password, based on the name/email.  The only info that $st is going to hold is the password. 

 

 

Here's how I personally would code getting the  password:

 

<?php 

// connect to database
$conn = mysql_connect('localhost', 'db_username', 'db_password') or die(mysql_error());
$db = mysql_select_db('db_name',$conn) or die(mysql_error());

//dummy vars
$name = "John";
$email = "John@doe.com";

$query = "select password from tablename where name = '$name' and email = '$email'";
$rs = mysql_query($query, $conn) or die(mysql_error());

if ($info = mysql_fetch_array($rs)) {
    $pass = $info['password']; // here is the password
} else {
   echo "no password found.";
}
?>

 

But that's assuming you just want a straight forward query based on the user putting in his name and email, and then he gets his password retrieved.