unable to use hidden field with sql statement - php

Question

I am working on a "forgotten username" system I'm using two forms in two different pages so the code goes as follows:-
recover_page.php:
<form action="security.php" method="post" enctype="multipart/form-data">
Please Enter your email address:<br>
<input type="text" name="email" value="<?php $_POST['email']?>">
<input type="submit" value="submit">
</form>
its php code:
<?php
include "session.php";
include "database/db.php";
$mode_allowed = array('username','password');
if(isset($_GET['mode']) === false && in_array($_GET['mode'],$mode_allowed)===false){
header('location:index.php');
}
?>
now the second page (security.php):
<form action="security.php" method="POST" enctype="multipart/form-data">
<p> Answer this question <p>
<select type="text" selected="selected" name="security_question" value="<?php $security_question?>">
<option name="security_question" value="<?php $security_question =mysql_query("SELECT `security_question` FROM `users` WHERE `email`='".mysql_real_escape_string($_POST['email'])."' ");
$array = mysql_fetch_array($security_question);
echo $array[0];
?>">
<?php $security_question =mysql_query("SELECT `security_question` FROM `users` WHERE `email`='".mysql_real_escape_string($_POST['email'])."' ");
$array = mysql_fetch_array($security_question);echo $array[0]; ?>
</option> </select> <br>
<input type="text" name="answer"/> <br>
<input type="submit" value="submit">
</form>
its php code :
// code to check if the email exists in the database or no
<?php
include "session.php";
include "database/db.php";
$mode_allowed = array('username','password');
if(isset($_POST['email']) === true && empty($_POST['email']) === false){
if(email_exists($_POST['email']) === false){
echo "Sorry, we can't find this email";
exit();
}
}
?>
//code to search for the answer in the database and compare it with the answer that the user has entered in the field "answer"
<?php
echo "<input type='hidden' name='email' value=' '".$_SESSION['email']."' '>";
if(isset($_POST['answer'])){
$answer = $_POST['answer'];
if(!empty($answer)){
$sql = mysql_query("SELECT `username` FROM `users` WHERE `email` ='".mysql_real_escape_string($_SESSION['email'])."' AND `answer`='".mysql_real_escape_string($answer)."'");
if(mysql_num_rows($sql) == 1){
header('location:last.php?success');
}else {
echo "Wrong answer";
}
}else{
echo "<script type='text/javascript'>alert('you must answer this question');</script>";
}
}
?>
Now this works fine when i write the sql statment without the hidden input like this:-
$sql = mysql_query("SELECT `username` FROM `users` WHERE `answer`='".mysql_real_escape_string($answer)."'");
and also, i can echo out the $_SESSION['email']; and it will give me the right value of the hidden field. so why is the sql unable to get this value?!

Answer 1

Editing the code for you last script (putting the code and the html together), something like this:-
<?php
include "session.php";
include "database/db.php";
$Message = "";
$mode_allowed = array('username','password');
if(isset($_POST['email']) === true && empty($_POST['email']) === false)
{
if(email_exists($_POST['email']) === false)
{
echo "Sorry, we can't find this email";
exit();
}
}
if(isset($_POST['answer']))
{
$answer = $_POST['answer'];
if(!empty($answer))
{
$sql = mysql_query("SELECT `username` FROM `users` WHERE `email` ='".mysql_real_escape_string($_SESSION['email'])."' AND `answer`='".mysql_real_escape_string($answer)."'");
if(mysql_num_rows($sql) == 1)
{
header('location:last.php?success');
}
else
{
$Message = "Wrong answer";
}
}
else
{
echo "<script type='text/javascript'>alert('you must answer this question');</script>";
}
}
?>
<form action="security.php" method="POST" enctype="multipart/form-data">
<p> Answer this question </p>
<select type="text" selected="selected" name="security_question" value="<?php $security_question?>">
<option name="security_question" value="<?php $security_question =mysql_query("SELECT `security_question` FROM `users` WHERE `email`='".mysql_real_escape_string($_POST['email'])."' ");
$array = mysql_fetch_array($security_question);
echo $array[0];
?>">
<?php $security_question =mysql_query("SELECT `security_question` FROM `users` WHERE `email`='".mysql_real_escape_string($_POST['email'])."' ");
$array = mysql_fetch_array($security_question);echo $array[0]; ?>
</option>
</select> <br>
<input type="text" name="answer"/> <br>
<input type='hidden' name='email' value='<?php $_POST['email']?>'>
<input type="submit" value="submit">
<?php if ($Message != '') echo "<br /> $Message";?>
</form>