Reset password link not working - php

Question

I have a reset password link that seemingly won't process $_GET('variable'). The forgot password form:
<?php
$error = $email = "";
if (isset($_POST['email']))
{
$email = sanitizeString($_POST['email']);
$com_code = md5(uniqid(rand()));
if ($email == "")
$error = "Not all fields were entered<br>";
else if (!filter_var($email, FILTER_VALIDATE_EMAIL))
$error='Email is invalid';
else
{
$resultE = queryMySQL("SELECT email FROM users WHERE email='$email'");
if ($resultE->num_rows == 0)
{
$error = "<span class='error'>Email
error</span><br><br>";
}else
{
queryMysql("UPDATE users SET com_code='$com_code' WHERE email='$email'");
$mail_to = $email;
$subject = 'Reset your password ';
$body_message = 'Please click on this link to reset password ';
$body_message .= 'Activate';
$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
$mail_status = mail($mail_to, $subject, $body_message, $headers);
if(isset($_SESSION['url']))
$url = $_SESSION['url'];
else
$url = "../../index.php";
header("Location:$url");
}
}
}
?>
The reset password form:
<?php
$error = $pass ="";
if (isset($_POST['pass']))
{
$pass = sanitizeString($_POST['pass']);
$salt1 = "qm&h*";
$salt2 = "pg!#";
$token = hash('ripemd128', "$salt1$pass$salt2");
$passkey = $_GET['passkey'];
if ($pass == "")
$error = "Enter all fields";
//put if else statements here
else if (preg_match("/[^a-zA-Z0-9_-]/", $pass)){
$error='Remove spaces,numbers,special characters';
}
else
{
$resultpassw = queryMysql("SELECT * FROM users WHERE com_code='$passkey' ");
if ($resultpassw->num_rows == 0)
$error = " ✘ Confirmation not sent";
else
{
queryMysql("UPDATE users SET pass='$token', updated=CURRENT_TIMESTAMP WHERE com_code='$passkey'");
header("Location:../../profile.php");
}
}
}
?>
The error that keeps occurring is the 'confirmation not sent' implying that the table 'users' has no com_code inserted previously, but when I look at the table via phpmyadmin the com_code is there. Where I'm I going wrong

Answer 1

In forgot passaword form try below.
<?php
$error = $email = "";
if (isset($_POST['email']))
{
$email = sanitizeString($_POST['email']);
$com_code = md5(uniqid(rand()));
if ($email == "")
$error = "Not all fields were entered<br>";
else if (!filter_var($email, FILTER_VALIDATE_EMAIL))
$error='Email is invalid';
else
{
$resultE = queryMySQL("SELECT email FROM users WHERE email='$email'");
if ($resultE->num_rows == 0)
{
$error = "<span class='error'>Email
error</span><br><br>";
}else
{
queryMysql("UPDATE users SET com_code='$com_code' WHERE email='$email'");
$mail_to = $email;
$subject = 'Reset your password ';
$body_message = 'Please click on this link to reset password ';
$body_message .= 'Activate';
$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
$mail_status = mail($mail_to, $subject, $body_message, $headers);
if(isset($_SESSION['url']))
$url = $_SESSION['url'];
else
$url = "../../index.php";
header("Location:$url");
}
}
}
?>
I changed one line here.
$body_message .= 'Activate';
As $com_code is dynamic value so you need to pass it in way, so php can fetch its value, and not take it as a static value.

Answer 2

Think I'll just use sessions. forgot_pass.php:
$com_code = md5(uniqid(rand()));
$_SESSION["com_code_sesh"] = $com_code;
reset_pass.php:
$passkey = $_SESSION["com_code_sesh"];