I have built a website and I am now trying to create a way that allows users to reset their password whenever they forget. I have successfully created a password reset url link but anytime I click it I get an "Invalid request!" notification rather taking me to the index.php page. I would be grateful if anyone can help. My codes are below.
resetpassword.php
include ("connect.php");
//Connect to MySQL database using PDO.
$pdo = new PDO("mysql:host=$host;dbname=$dbname", $user, $pwd);
//Get the name that is being searched for.
$email = isset($_POST['email']) ? trim($_POST['email']) : '';
//The simple SQL query that we will be running.
$sql = "SELECT `id`, `email` FROM `registration` WHERE `email` = :email";
//Prepare our SELECT statement.
$statement = $pdo->prepare($sql);
//Bind the $name variable to our :name parameter.
$statement->bindValue(':email', $email);
//Execute the SQL statement.
$statement->execute();
//Fetch our result as an associative array.
$userInfo = $statement->fetch(PDO::FETCH_ASSOC);
//If $userInfo is empty, it means that the submitted email
//address has not been found in our users table.
if(empty($userInfo)){
echo 'That email address was not found in our system!';
exit;
}
//The user's email address and id.
$userEmail = $userInfo['email'];
$userId = $userInfo['id'];
//Create a secure token for this forgot password request.
$token = openssl_random_pseudo_bytes(16);
$token = bin2hex($token);
//Insert the request information
//into our password_reset_request table.
//The SQL statement.
$insertSql = "INSERT INTO password_reset_request
(user_id, date_requested, token)
VALUES
(:user_id, :date_requested, :token)";
//Prepare our INSERT SQL statement.
$statement = $pdo->prepare($insertSql);
//Execute the statement and insert the data.
$statement->execute(array(
"user_id" => $userId,
"date_requested" => date("Y-m-d H:i:s"),
"token" => $token
));
//Get the ID of the row we just inserted.
$passwordRequestId = $pdo->lastInsertId();
//Create a link to the URL that will verify the
//forgot password request and allow the user to change their
//password.
$verifyScript = 'http://localhost/trial/pages/createpassword.php';
//The link that we will send the user via email.
$linkToSend = "<a href='$verifyScript'?
uid='.$userId.'&id='.$passwordRequestId.'&t='.$token'>$verifyScript.'?
uid='.$userId.'&id='.$passwordRequestId.'&t='.$token</a>";
//Print out the email for the sake of this tutorial.
echo $linkToSend;
?>
createpassword
<form id="resetpasswordForm" action="verifypassword.php" class="loading-form"
method="POST">
<div class="form-group">
<label for="email-input">Email</label>
<input required name="email" type="email" class="form-control" id="email"
title="An email is required">
</div>
<div class="form-group">
<label for="password-input">Password</label>
<input required type="password" name="password" class="form-control"
id="pwd">
</div>
<div class="form-group">
<label for="password-input">Confirm Password</label>
<input required type="password" name="confirmpassword" class="form-control"
id="conpwd">
</div>
<div class="form-group">
<!-- Do NOT use name="submit" or id="submit" for the Submit button -->
<button type="submit" name="ResetPasswordForm" class="btn btn-success">Reset
Password</button>
</div>
<input type="hidden" name="uid" value="<?php echo $_GET['uid'];?>" />
<input type="hidden" name="t" value="<?php echo $_GET['t'];?>" />
<input type="hidden" name="id" value="<?php echo $_GET['id'];?>" />
</form>
verifypassword
include ("connect.php");
//Connect to MySQL database using PDO.
$pdo = new PDO("mysql:host=$host;dbname=$dbname", $user, $pwd);
//The user's id, which should be present in the GET variable "uid"
$userId = isset($_GET['uid']) ? trim($_GET['uid']) : '';
//The token for the request, which should be present in the GET variable "t"
$token = isset($_GET['t']) ? trim($_GET['t']) : '';
//The id for the request, which should be present in the GET variable "id"
$passwordRequestId = isset($_GET['id']) ? trim($_GET['id']) : '';
//Now, we need to query our password_reset_request table and
//make sure that the GET variables we received belong to
//a valid forgot password request.
$sql = "
SELECT id, user_id, date_requested
FROM password_reset_request
WHERE
user_id = :user_id AND
token = :token AND
id = :id
";
//Prepare our statement.
$statement = $pdo->prepare($sql);
//Execute the statement using the variables we received.
$statement->execute(array(
"user_id" => $userId,
"id" => $passwordRequestId,
"token" => $token
));
//Fetch our result as an associative array.
$requestInfo = $statement->fetch(PDO::FETCH_ASSOC);
//If $requestInfo is empty, it means that this
//is not a valid forgot password request. i.e. Somebody could be
//changing GET values and trying to hack our
//forgot password system.
if(empty($requestInfo)){
echo 'Invalid request!';
exit;
}
//The request is valid, so give them a session variable
//that gives them access to the reset password form.
$_SESSION['user_id_reset_pass'] = $userId;
//Redirect them to your reset password form.
header('Location: index.php');
exit;
?>
