forgot password help

[slj90]

I have a form where the user puts their email in, if its found, then they are sent their password.

 

The action script I am using to do this is below..

 

<?php
  //Include the connection details, open $connection and select database
include ("connection.php");
   
// value sent from form
$Email=$_POST['Email'];

// table name
$Customer;

// retrieve password from table where e-mail = $email_to([email protected])
$sql="SELECT Password FROM $Customer WHERE Email='$Email'";
$result=mysql_query($sql);

// if found this e-mail address, row must be 1 row
// keep value in variable name "$count"
$count=mysql_num_rows($result);

// compare if $count =1 row
if($count==1){

$rows=mysql_fetch_array($result);

// keep password in $your_password
$your_password=$rows['Password'];

// ---------------- SEND MAIL FORM ----------------

// send e-mail to ...
$to=$email_to;

// Your subject
$subject="Your password here";

// From
$header="from: your name <your email>";

// Your message
$messages= "Your password for login to our website \r\n";
$messages.="Your password is $your_password \r\n";
$messages.="more message... \r\n";

// send email
$sentmail = mail($to,$subject,$messages,$header);

}

// else if $count not equal 1
else {
echo "Not found your email in our database";
}

// if your email succesfully sent
if($sentmail){
echo "Your Password Has Been Sent To Your Email Address.";
}
else {
echo "Cannot send password to your e-mail address";
}

?>

 

 

 

I currently get the error

 

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /study_D/undergrad/c3221281/webpages/my_iis_website/forgotpassaction.php on line 17
Not found your email in our databaseCannot send password to your e-mail address

 

Line 17 is...

 

$count=mysql_num_rows($result);

 

 

Any ideas?

 

 

Also, the form code..

 

<form action = 'forgotpassaction.php' method="GET"> 
   <p>Email:<br /> <input type="text" name="Email" value=<?php print $row["Email"] ?> ></p> 
      </p> 
    <p><input type="submit" value="Get Password" name="GetPass" > </p> 
  </form>         

 

 

Thanks alot guys

 

 

 

 

[deansatch]

This does nothing:

 

$Customer;

 

It makes your mysql query no table.

 

\it should be something like this:

$Customer = 'customer_table';

 

EDIT: You really need to sanitise things first e.g. mysql_real_escape_string(), check valid email types etc...

[slj90]

I don't really understand what it should be then?

 

My table is just called 'Customer'

 

Thanks

[deansatch]

EITHER:

 

$Customer = 'Customer';

 

OR

 

$sql="SELECT Password FROM Customer WHERE Email='$Email'";

[slj90]

I changed it to $Customer = 'Customer';

 

It now says the message... Not found your email in our databaseCannot send password to your e-mail address

 

Even when the email is in the database!

 

 

Thanks for your help.

[deansatch]

Is it in there more than once?

Try:

if($count>0)