PHP Forgot password script error

[eddie]

I'm having a problem getting my forgot password retrieval script to work. Won't send an email. the MySql database is ok & contains the username that is required and the member's password & email address.

All other files work with the required script pages (conn, includes, etc) so I think the problem must be with the script below. Would appreciate it if someone could look this over & see if there is an obvious error.

Thanks!!!


<?

require_once("conn.php");

require_once("includes.php");

require_once("templates/HeaderTemplate.php");



if(isset($_POST[u2]))

{

$q1 = "select * from yellow_agents where username = '$_POST[u2]' ";

$r1 = mysql_query($q1) or die(mysql_error());



if(mysql_num_rows($r1) == '1')

{

//ok

$a1 = mysql_fetch_array($r1);



$to = $a1[email];

$subject = "Your password";



$message = "Hello $a1[FirstName] $a1[LastName],\nYour login details are:\n\nUsername: $a1[username]\nPassword: $a1[password]\n\nhttp://$_SERVER[HTTP_HOST]";



$headers = "MIME-Version: 1.0\n";

$headers .= "Content-type: text/plain; charset=iso-8859-1\n";

$headers .= "Content-Transfer-Encoding: 8bit\n";

$headers .= "From: $_SERVER[HTTP_HOST] <$aset[ContactEmail]>\n";

$headers .= "X-Priority: 1\n";

$headers .= "X-MSMail-Priority: High\n";

$headers .= "X-Mailer: PHP/" . phpversion()."\n";



////donotmail($to, $subject, $message, $headers);



require_once("templates/ForgotYes.php");

require_once("templates/FooterTemplate.php");

exit();

}

else

{

$error2 = "<center><font face=verdana size=2 color=red>There is no username <b>$_POST[u2]</b> at our database!</font></center>";



}

}



require_once("templates/ForgotTemplate.php");

require_once("templates/FooterTemplate.php");



?>

[Ryan Fait]

Do you get a message saying the email has been sent?

[eddie]

Yes, I do get a message saying the email has been sent. But no email arrives. The email address is ok in MySql. That makes me wonder as well, because now when I try to send an email through another script on the site, it doesn't work either. So perhaps the fault is with an email script? The registration script we use posts email addresses ok in the database.


Here is the email script we are using:

<?
require_once("conn.php");
require_once("includes.php");

//get the agent info
$q1 = "select * from yellow_agents where AgentID = '$_GET[AgentID]' ";
$r1 = mysql_query($q1) or die(mysql_error());
$a1 = mysql_fetch_array($r1);

if(isset($_POST[s1]))
{
$to = $a1[email];
$subject = $_POST[subject];
$message = $_POST[message];
$message .= "\n\nOffer:\nhttp://$_SERVER[HTTP_HOST]/info.php?id=$_GET[AgentID]\n\n";

$headers = "MIME-Version: 1.0\n";
$headers .= "Content-type: text/plain; charset=iso-8859-1\n";
$headers .= "Content-Transfer-Encoding: 8bit\n";
$headers .= "From: $_POST[u_name] <$aset[ContactEmail]>\n";
$headers .= "Reply-To: $_POST[u_name] <$_POST[u_email]>\n";
$headers .= "X-Priority: 3\n";
$headers .= "X-MSMail-Priority: Normal\n";
$headers .= "X-Mailer: PHP/" . phpversion();

//donotmail($to, $subject, $message, $headers);

$thankyou = "<center><b><br><br><br>Thank you for your message!<br><br><a class=RedLink href=\"info.php?id=$_GET[AgentID]\">back to the offer details</a></center>";


//get the templates
require_once("templates/HeaderTemplate.php");
require_once("templates/EmailThankyouTemplate.php");
require_once("templates/FooterTemplate.php");

}


$AgentName = "$a1[FirstName] $a1[LastName]";



//get the templates
require_once("templates/HeaderTemplate.php");
require_once("templates/EmailTemplate.php");
require_once("templates/FooterTemplate.php");

?>

[uchiha_obito]

May be helpful to you.
Here is a function of sending the mails.It needs your own email account to open the smtp port.
Good luck!

PHP: Select all

<?php
function send_mail($to, $subject = 'No subject', $body) {
 $loc_host = "21cn_user";            //The sender name
 $smtp_acc = "username"; //Smtp user name
 $smtp_pass="password";          //Smtp user password
 $smtp_host="smtp.XXX.com";    //SMTP server Address
 $from="username@xxx.com";       //The receiver Email address
    $headers = "Content-Type: text/plain; charset=\"iso-8859-1\"\r\nContent-Transfer-
Encoding: base64";
    $lb="\r\n";                    //linebreak
 $hdr = explode($lb,$headers);     //hdr
    if($body) {$bdy = preg_replace("/^\./","..",explode($lb,$body));}//Body
 $smtp = array(
  //1、EHLO，back 220 or 250
  array("EHLO ".$loc_host.$lb,"220,250","HELO error: "),
  //2、Send Auth Login，back 334
  array("AUTH LOGIN".$lb,"334","AUTH error:"),
  //3、Send the username incoded by Base64，back 334
  array(base64_encode($smtp_acc).$lb,"334","AUTHENTIFICATION error : "),
  //4、Send the Password incoded by Base64，back 235
  array(base64_encode($smtp_pass).$lb,"235","AUTHENTIFICATION error : "));
 //5、Send Mail From，back 250
 $smtp[] = array("MAIL FROM: <".$from.">".$lb,"250","MAIL FROM error: ");
 //6、Send Rcpt To。back250
 $smtp[] = array("RCPT TO: <".$to.">".$lb,"250","RCPT TO error: ");
 //7、send DATA，back 354
 $smtp[] = array("DATA".$lb,"354","DATA error: ");
 //8.0、send From
 $smtp[] = array("From: ".$from.$lb,"","");
 //8.2、send To
 $smtp[] = array("To: ".$to.$lb,"","");
 //8.1、Send title
 $smtp[] = array("Subject: ".$subject.$lb,"","");
 //8.3、Send Header
 foreach($hdr as $h) {$smtp[] = array($h.$lb,"","");}
 //8.4、Send blank row，end send Header
 $smtp[] = array($lb,"","");
 //8.5、send the main body
 if($bdy) {foreach($bdy as $b) {$smtp[] = array(base64_encode
($b.$lb).$lb,"","");}}
 //9、Send “.” indicates the end of the body，back 250
 $smtp[] = array(".".$lb,"250","DATA(end)error: ");
 //10、send Quit，exit，back 221
 $smtp[] = array("QUIT".$lb,"221","QUIT error: ");
 //Open the smtp server port
 $fp = @fsockopen($smtp_host, 25);
 if (!$fp) echo "<b>Error:</b> Cannot conect to ".$smtp_host."<br>";
 while($result = @fgets($fp, 1024)){if(substr($result,3,1) == " ") { break; }}
 $result_str="";
 //Send the commands/datas in smtp arrays
 foreach($smtp as $req){
  //Send messages
  @fputs($fp, $req[0]);
  //if needs the message returned by servers,then:
  if($req[1]){
   //receive the messages
   while($result = @fgets($fp, 1024)){
    if(substr($result,3,1) == " ") { break; }
   };
   if (!strstr($req[1],substr($result,0,3))){
    $result_str.=$req[2].$result."<br>";
   }
  }
 }
 //close the link
 @fclose($fp);
 return $result_str;
}
?>

[masonbarge]

Code: Select all

$q1 = "select * from yellow_agents where AgentID = '$_GET[AgentID]' ";

You really need to qualify this and restate the GET variable to a new variable name. I'd really suggest regex for a database query, but at least strip out html, slashes and dashes.

This is the least I'd want to do.

Code: Select all

$t = NULL;
if (isset($_GET['AgentID']))  {
$t=$_GET['AgentID'];
} else {
(your error handling);
}
if (!preg_match("/^your regex$/", $t)) {
    your error message;
    exit();
}

Then you can use $t in your query.