Retaining the $_GET url in the link when the user returns to the same page.in mysql php - php

Question

When the user reset the password by sending their email id. The mail which they receive, is something like this.
Email
http://localhost/folder/folder/reset.php?email=foobar#foo.com&hash=07c5807d0d927
When the above link is clicked, the user fills the New password and Confirm password. We are getting the email and the has from the url. The code below.
reset.php
if( isset($_GET['email']) && !empty($_GET['email']) AND isset($_GET['hash']) && !empty($_GET['hash']) ) {
$email = $con->escape_string($_GET['email']);
$hash = $con->escape_string($_GET['hash']);
$result = $con->query("SELECT * FROM users WHERE email='$email' AND hash='$hash'");
if ( $result->num_rows == 0 ) {
$_SESSION['message'] = "Invalid URL for password reset!";
header("location: ../error.php");
}
}
else {
$_SESSION['message'] = "Verification failed, try again!";
header("location: ../error.php");
}
<!-- form goes here -->
We are using the code below to check the matching password.
resetpassword.php
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
// Make sure the two passwords match
if ( $_POST['newpassword'] == $_POST['confirmpassword'] ) {
$new_password = password_hash($_POST['newpassword'], PASSWORD_BCRYPT);
// We get $_POST['email'] and $_POST['hash'] from the hidden input field of reset.php form
$email = $con->escape_string($_POST['email']);
$hash = $con->escape_string($_POST['hash']);
$sql = "UPDATE users SET password='$new_password', hash='$hash' WHERE email='$email'";
if ( $con->query($sql) ) {
$_SESSION['message'] = "Your password has been reset successfully! <a href='login.php'>Login</a>";
header("location: ../success.php");
}
}
else {
$_SESSION['message'] = "Passwords did not match, try again!";
header("location: ../reset.php");
}
}
Now the problem is here. If the users password did not match they goes to reset.php page and when they need to come back to to try again again. When that happens how do we get their email and hash back.
else {
$_SESSION['message'] = "Passwords did not match, try again!";
header("location: ../reset.php");
}
This is what we get, when they come back.
http://localhost/folder/folder/reset.php

Answer 1

Using sessions is your best option here.
Currently the code has another problem which you might want to avoid. Your user can go to resetpassword.php page with ANY email and reset the password for that email, which would result in a very unpleasant security issue.
The proper way of doing what you intend to do would be
reset.php
<?php
$email = array_key_exists('email', $_GET) && !empty($_GET['email']) ? $_GET['email'] : null;
$hash = array_key_exists('hash', $_GET) && !empty($_GET['hash']) ? $_GET['hash'] : null;
session_start();
if( $email !== null && $hash !== null) {
$email = $con->escape_string($email);
$hash = $con->escape_string($hash);
$result = $con->query("SELECT * FROM users WHERE email='$email' AND hash='$hash'");
if ( $result->num_rows == 0 ) {
$_SESSION['message'] = "Invalid URL for password reset!";
header("location: ../error.php");
} else {
$_SESSION['reset_email'] = $email;
$_SESSION['reset_hash'] = $hash;
// do redirect to your new password page or smth
}
}
else {
$_SESSION['message'] = "Verification failed, try again!";
header("location: ../error.php");
}
and resetpassword.php
<?php
session_start();
if ($_SERVER['REQUEST_METHOD'] == 'POST' && array_key_exists('reset_email', $_SESSION) && !empty($_SESSION['reset_email'])) {
// Make sure the two passwords match
if ( $_POST['newpassword'] == $_POST['confirmpassword'] ) {
$new_password = password_hash($_POST['newpassword'], PASSWORD_BCRYPT);
// not sure why you would need to update password reset hash there, so i removed it
$sql = "UPDATE users SET password='$new_password' WHERE email='{$_SESSION['reset_email']}'";
if ( $con->query($sql) ) {
$_SESSION['message'] = "Your password has been reset successfully! <a href='login.php'>Login</a>";
$_SESSION['reset_email'] = null;
$_SESSION['reset_hash'] = null;
header("location: ../success.php");
} else {
// error probably a good thing here (for the user)
$_SESSION['message'] = "Verification failed, try again!";
header("location: ../error.php");
}
}
else {
$_SESSION['message'] = "Passwords did not match, try again!";
header("location: ../reset.php?email={$_SESSION['reset_email']}&hash={$_SESSION['reset_hash']}");
}
}