Question

I’m tryn to get the username and password by email address and send it as a Email [PASSWORD RECOVERY]…..
I can check the existance of a user by email but now I need to get the username and password by the email he/she provided before….

here is my DB_Class

public boolean getEmail(String emailNo) throws SQLException //pass the EmailNo which you want in where clause 
{                              

Cursor mCursor = db.rawQuery("SELECT Username, Passwords FROM " + USERS_TABLE + " WHERE EmailNO='"+emailNo+"'",null); 
 if (mCursor != null) {          
 if(mCursor.getCount() > 0) 
 return true; 

}
return false; 

} 

And my Activity class for checking user existance and sending email..here is below

 public void onClick(View v) {
            String EmailAddress = txtEmailAddress.getText().toString();

        try{
        if(EmailAddress.length() > 0)
        {
         DBAdapter  dbUser = new DBAdapter (RecoverPassword.this);
            dbUser.open();

        if(dbUser.getEmailAddress(EmailAddress))
            {
        Toast.makeText(RecoverPassword.this,"Email Successfully ", Toast.LENGTH_LONG).show();





 String to = txtEmailAddress.getText().toString();

         Intent email = new Intent(Intent.ACTION_SEND);
          email.putExtra(Intent.EXTRA_EMAIL, new String[]{ to});
         email.putExtra(Intent.EXTRA_SUBJECT, "Password Recovery");

         if(dbUser.getEmail(EmailAddress)){

          email.putExtra(Intent.EXTRA_TEXT,dbUser.getEmailAddr(obj.getusername(),obj.getpassword())) ;

     }else{

         Toast.makeText(RecoverPassword.this,"Email Not matching " ,Toast.LENGTH_LONG).show();
    }

      email.setType("message/rfc822");


  startActivity(Intent.createChooser(email, "gmail :"));                 

    }else{
        Toast.makeText(RecoverPassword.this,"Invalid Email", Toast.LENGTH_LONG).show();

        txtEmailAddress.setTex

Answer 1

You should never be able to recover a password from your database. If you really want to restore the original password, your security is pretty low (hope you don’t store the password as plain text?).

I highly recommend to generate a new one, store it in the database and send it to the user.

After he logs in the first time with the new password you should force him to define a new password. The password itself should be at least salted and hashed. Search for MD5 and salt for more information on that topic. That should be secure enough.