I am trying to generate a password reset token but getting the error:
Fatal error: Can't use function return value in write context in /path/to//test2.php on line 9
I have a form on page test.php that asks users to enter their email address, then I am trying to check if that email address already exists in my database in the user table, and if so, generate a random token and store in the users table to use in a password reset URL AND set a date column in the DB to today to use for token expiration.
Here is my test.php file:
<?php
// Include config file
require_once '../../db_connect.php';
// Define variables and initialize with empty values
$user_email = "";
$user_email_err = "";
// Processing form data when form is submitted
if(isset($_POST["user_email"])) {
$user_email = trim($_POST["user_email"]);
include 'test2.php';
//End if statement checking to see if form has been submitted
}
?>
<html>
<head></head>
<body>
<!-- html form -->
<form action="<?php echo htmlspecialchars(basename($_SERVER['REQUEST_URI'])); ?>" method="post" name="resetform">
<!-- the user name input field uses a HTML5 pattern check -->
<!-- the email input field uses a HTML5 email type check -->
<div class="form-group <?php echo (!empty($user_email_err)) ? 'has-error' : ''; ?>">
<label for="login_input_email">User email </label>
<input id="login_input_email" class="login_input" type="email" name="user_email" required />
<span class="help-block"><?php echo $user_email_err;?></span>
</div>
<input type="submit" name="reset_submit" value="Reset password" />
</form>
</body>
</html>
Here is what is in test2.php
<?php
//Select posts
$sqlcheck = "SELECT * FROM users WHERE user_email = '$user_email'";
if($stmt = mysqli_prepare($conn, $sqlcheck)){
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "s", $param_user_email);
// Set parameters
$param_user_email = $user_email;
// Attempt to execute the prepared statement
if(mysqli_stmt_execute($stmt)){
// Records selected - now query the DB
if($result2 = mysqli_query($conn, $sqlcheck)) {
if(mysqli_num_rows($result2) == 0) {
//email address is not found
$user_email_err = "User email not found.";
} elseif (mysqli_num_rows($result2) == 1){
//email address is in the database - request password reset
$token = bin2hex(openssl_random_pseudo_bytes(150));
$sqlsetrequest = "UPDATE users SET reset_code = '$token', reset_date = NOW() WHERE user_email = '$user_email'";
if ($conn->query($sqlsetrequest) === TRUE) {
echo "Password reset request submitted successfully"."<br>";
//email link to user email
//redirect to generic success page???
} else {
echo "Error updating record: " . $conn->error;
}
} else {
//This scenario should not happen -- looks like the email address has been found more than once
echo "Oooops,some crazy error just happened.";
}
}
}
// Close statement
mysqli_stmt_close($stmt);
}
?>
Any help would be hugely appreciated.
