Question

So I have this code:

<?php

    if (!isset($_GET['email']) && !isset($_GET['key'])) {

        echo 'NOT ALLOWED TO ACCESS PAGE';

    }

    if (isset($_GET['email']) && isset($_GET['key'])) {

        $email      = $_GET['email'];
        $regKey     = $_GET['key'];

        $query      = mysql_query("SELECT * FROM `users` WHERE `email`='$email' AND `regRandom`='$regKey'");

        if ($query == $regKey) {

            mysql_query("UPDATE `users` SET `activated`=1 WHERE `email`='$email'");

            if (mysql_query("SELECT activated FROM users WHERE activated='1'")) {

                echo file_get_contents("http://TheMegaHouse.com/pageContent/head.php");

                echo file_get_contents("http://TheMegaHouse.com/pageContent/notLoggedIn/topNavBar.php");

                echo file_get_contents("http://TheMegaHouse.com/pageContent/header.php");

                echo 'PASSED';

                footer();

            } else {

                activationFail();
            }

        } else if ($regKey !== $query) {

            echo 'FAIL';
        }


    }


?>

The thing is that in my database, the value that is in the regRandom column is in fact equal to the value in the key variable in the url but for some reason it is echoing out “FAIL” instead of “PASSED”.

Any suggestions on what I am doing wrong, a better way of doing what I want to do or any suggestions?

Answer 1

Always read manual first:

• http://php.net/manual/en/function.mysql-query.php

This line of code:

mysql_query("SELECT * FROM `users` WHERE `email`='$email' AND `regRandom`='$regKey'");

Is returning you resource, instead of variable you are lookng for.

Small fix for you:

list($regRandom) = mysql_fetch_row(mysql_query("SELECT regRandom  FROM `users` WHERE `email`='$email' AND `regRandom`='$regKey'"));
if ($regRandom == $regKey) {
  // magic

And another two things:

• mysql_* functions are deprecated
• i strongly recommend you to read about SQL Injections.