I’m trying to put together a form whereby users can update their ’email address’ and ‘password’.
I’m trying to incorporate the following scenarios:
- If the user changes their email address, then I want the existing ‘password’, ‘password hint’, and salt fields to be left with their current values.
- If the user changes their password, I need a new ‘salt’ value to be created, added to the password field and encrypted with sha1
- Lastly, if the user changes all fields then the ’email adresss’, ‘password’, ‘password’ hint and ‘salt’ fields all need to be updated.
This is the code I’ve tried to put together:
if (isset($_POST["amendyourdetails"]))
{
$password = $_POST["password"];}
$confirmpassword = $_POST["confirmpassword"];
$passwordhint = $_POST["passwordhint"];
if ($password >=0){
$salt = uniqid(mt_rand());
$encrypted = sha1($password . $salt);
if ($emailaddress >=0){
$emailaddress = $_POST['emailaddress'];
mysql_query("UPDATE `userdetails` SET `emailaddress` = '$emailaddress',`password` = '$encrypted', `passwordhint` = '$passwordhint', `salt` = '$salt' WHERE `userid` = 1");
$msg = "Your password has been successfully reset.";
}
}
else if ($password == 0 ){
if (emailaddress > 0){
mysql_query("UPDATE `userdetails` SET `emailaddress` = '$emailaddress' WHERE `userid` = 1");
$msg = "Your password has been successfully reset.";
}
}
}
?>
<html>
<head>
<title>Amend Your Details</title>
<style type="text/css">
<!--
.style1 {font-family: Calibri
}
.style9 { font-family: Calibri;
font-size: 24px;
background-color: #78AFC5;
}
.style7 {
font-family: Calibri;
font-size: 16px;
background-color: #FFFFFF;
}
.style10 {color: #FF0000}
-->
</style>
<script src="gen_validatorv4.js" type="text/javascript"></script>
</head>
<body>
<div align="center"><span class="style9">Amend Your Details </span></div>
<p class="style7"><span class="style10">
<?php
if (isset($msg)) // this is special section for
// outputing message
{
?>
</span>
<p class="style7">
<span class="style10">
<?=$msg?>
</span>
<p class="style7"><span class="style10">
<?php
}
?>
</span>
<form name="amendyourdetails" id="amendyourdetails" action="amendyourdetails.php" method="post">
<table width="418" border="1">
<tr>
<td width="195"><span class="style1">Email Address:</span></td>
<td width="220"><span class="style1">
<input name="emailaddress" type="email" value="<?php echo $emailaddress;?>" size="25"/>
</span></td>
</tr>
<tr>
<td><span class="style1">New Password:</span></td>
<td><span class="style1">
<input name="password" id="password" type="password" size="30"/>
</span></td>
</tr>
<tr>
<td><span class="style1">Confirm New Password:</span></td>
<td><span class="style1">
<input name="confirmpassword" id="confirmpassword" type="password" size="30"/>
</span></td>
</tr>
<tr>
<td><span class="style1">New Password Hint:</span></td>
<td><span class="style1">
<input name="passwordhint" id="passwordhint" type="text" size="30"/>
</span></td>
</tr>
</table>
<p>
<input name="amendyourdetails" type="submit" value="Amend Your Details">
</p>
</form>
<script language="JavaScript" type="text/javascript">
var frmvalidator = new Validator("amendyourdetails");
frmvalidator.addValidation("emailaddress","email","Please enter a valid email address");
// frmvalidator.addValidation("password","minlen=6", "Minimum length for a password is 6 characters");
frmvalidator.addValidation("confirmpassword","eqelmnt=password", "The confirmed password is not the same as the password");
// frmvalidator.addValidation("passwordhint","req","Please provide a hint for your password");
</script>
</body>
</html>
The biggest problem I have is that as soon as the page is run, the ‘update’ action takes place, but values from my ’email address’ and ‘passwordhint’ fields have been deleted and I’m not sure why.
UPDATED CODE
if (isset($_POST["amendyourdetails"]))
{
$emailaddress = $_POST['emailaddress'];
$password = $_POST["password"];}
$confirmpassword = $_POST["confirmpassword"];
$passwordhint = $_POST["passwordhint"];
if ($_POST["password"] isset()
{
$salt = uniqid(mt_rand());
$encrypted = sha1($password . $salt);
mysql_query("UPDATE `userdetails` SET `emailaddress` = '$emailaddress',`password` = '$encrypted', `passwordhint` = '$passwordhint', `salt` = '$salt' WHERE `userid` = 1");
$msg = "Your password has been successfully reset.";
}
}
You’re detecting if $password is more than or equal to 0. This will evaluate to true if it is not defined. You want to check if $_POST[“password”] isset().