PHP - Session Reset?

hi everyone.

i'm wondering what the best way is to create a session variable and pass it to an iframe.
i need to do something along these lines, but it doesn't seem to pass the ID. Any hints on how i should accomplish this?

Code: [Select]
session_start();
  $_SESSION['ID']=$_GET['ID']; // id from previous page
$ID=session_id();

 <iframe src="iframepage.php?ID=<?php echo $ID; ?>" style="width:680px; height:200px;" noresize="noresize" frameborder="0" border="0" scrolling="Yes" allowtransparency="true" /> </iframe>

I'm making a simple login system with MySQL and PHP (very simple, I'm just starting with PHP). The MySQL portion is done, but I need to ensure only people who are logged in can see certain content.

To check if people are logged in, my website checks that they have the $_SESSION['user'] variable set. If it is set, then it lets them continue through the website, if not, it tells them to login. Is that enough security, or can people simply inject a session cookie into their browser to spoof that they are logged in?

My idea was to generate a session key cookie when they login (just a random string of letters and numbers) and store that in the database, then on every page, check to make sure their session key is the same thing that's in the database. Is this necessary? It seems expensive.

i have two drop down lists in a form and some text fields and then the SUBMIT and RESET button...when i click my first dropdown the values are populated in the second dropdown by ajax call. the problem i face is when i click on the reset button the values in the textfields and my first dropdown get reset to default value.but the value in the second drop down does not reset to the default value i have given instead it still has the value of the ajax call....any ideas to sort it out?

I have a login.php that has a usual login form with a username and password textbox and a login button that redirects to index.php. when I login and go to the index.php, the welcome sign is on but after I click on a link that points to index.php itself, the "welcome, <myname>" sign is replaced with "sign in" again (the cookie disappears) even though I put a checking on top of the index.php page..

here's my code in index.php:

<?php
if ($_COOKIE['activeuser'] != '#') {
} else {
setcookie('activeuser','#',time()+60*100);
}
include('connect.php'); //this code connects to my database
if (isset($_POST['bLogin'])) {
$sql = 'SELECT * FROM user WHERE username = "'.$_POST['tfUsername'].'"';
$sql .= ' AND password = "'.$_POST['tfPassword'].'"';
$result = mysql_query($sql,$con);
if($result) {
$row = mysql_fetch_array($result);
$_COOKIE['activeuser'] = $row['name'];
} else {
echo 'query error';
}
}
if ($_COOKIE['useraktif'] != '#') {
echo '<div id="welcome">Welcome, ' . $_COOKIE['activeuser'];
echo '<br/><a href="logout.php">Logout</a></div>';
} else {
echo '<div class="signIn"><a href="login.php">sign in</a></div>';
echo '<div class="signIn"><a href="#">Register</a></div>';
}

i am using countdown timer,it gets remaining time in seconds and displays cont down.but when i changed the remaining time for the countdown it displays the same old timer and did not update its countdown time. i need a deperate help for it , can some help me.

I have an app that connects to a source safe server to perform a command via shell_exec(). I had used exec(), but shell_exec seems to work better since I am on Linux.

The command connects to the server and tells it to promote a file to the next level. On Windows this ran without a hitch, but on Linux I gat an error that reads:
Quote

Socket error when reading request from [172.20.22.1]: 3537808 ; Socket closed.

I am told that the reason for this error is that PHP broke the connection to the server before the server completed the job and was able to shutdown properly.

The only way I have found around this is to place a sleep(3) to the script. This is really not ideal since that means that there is at least 3 seconds between each command, which can really extend the time it takes to perform if there are numerous files.

If PHP breaks the connection before the program can close it will leave the program open and PHP cannot perform any more commands to the server since it is stuck on the last command. If too many are given the machine will lock up due to resources being eaten up.

I'm wanting to know if there is a way to tell PHP to not let go of a connection so quickly.

I tried "nohup", but that does not help.

I am new to Linux and am at a loss of what my options are beyond the sleep() method. I really feel that there has to be a better way or setting that can be manipulated to fix this issue altogether.

Thanks in advance for any help.

Cy

My contact form works, but how can I reset it so that when someone fills in the required information and the send the email, I want the information from the text boxes to clear. Right now, it doesnt do that, the name,email address, and message remains in the text boxes.

Code: [Select]

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--
Author: Reality Software
Website: http://www.realitysoftware.ca
Note: This is a free template released under the Creative Commons Attribution 3.0 license,
which means you can use it in any way you want provided you keep the link to the author intact.
-->
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Contact</title>
<link href="style.css" rel="stylesheet" type="text/css" /></head>
<body>
<!-- header -->
    <div id="header">
    <div id="logo"><a href="#">Header</a></div>
        <div id="menu">
        <ul>
            <li><a href="#">Home</a></li>
            <li><a href="#">Link 1</a></li>
            <li><a href="#">Link 2</a></li>
            <li><a href="#">Link 3</a></li>
            <li><a href="#">Contact</a></li>
    <li><a href="#">Guestbook</a></li>
            </ul>
      </div>
  </div>
    <!--end header -->
    <!-- main -->
    <div id="main">
    <div id="content">

   
 <div id="text">
                <h1><strong>Contact</strong></h1>
</div>
<br/>
<br/>
<br/>
<br/>
<br/>

<br/>
<br/>
<br/>
<br/>
<br/>
<br/>
<br/>
<br/>

 <?php  
      
        if (isset($_POST['Submit'])) {  
      
            if ($_POST['name'] != "") {  
                $_POST['name'] = filter_var($_POST['name'], FILTER_SANITIZE_STRING);  
                if ($_POST['name'] == "") {  
                    $errors .= 'Please enter a valid name.<br/><br/>';  
                }  
            } else {  
                $errors .= 'Please enter your name.<br/>';  
            }  
      
            if ($_POST['email'] != "") {  
                $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);  
                if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {  
                    $errors .= "$email is <strong>NOT</strong> a valid email address.<br/><br/>";  
                }  
            } else {  
                $errors .= 'Please enter your email address.<br/>';  
            }  
      
            if ($_POST['message'] != "") {  
                $_POST['message'] = filter_var($_POST['message'], FILTER_SANITIZE_STRING);  
                if ($_POST['message'] == "") {  
                    $errors .= 'Please enter a message to send.<br/>';  
                }  
            } else {  
                $errors .= 'Please enter a message to send.<br/>';  
            }  
      
            if (!$errors) {  
                $first_name=$_POST['name'];
$email_address=$_POST['email'];
$subject = 'Email Submission'; 
$message=$_POST['message'];

mail("myemailaddress@gmail.com","$subject",
$message,"From: $first_name <$email_address>"); 
      
                echo "Thank you for your email!<br/><br/>";  
            } else {  
                echo '<div style="color: red">' . $errors . '<br/></div>';  
            }  
        }  
    ?> 

     
    <form name="form1" method="post" action="contact.php"> 
    Name: <br/> 
    <input type="text" name="name" value="<?php echo $_POST['name']; ?>" size="50" /><br/><br/> 
    Email Address: <br/> 
    <input type="text" name="email" value="<?php echo $_POST['email']; ?>" size="50"/> <br/><br/> 
    Message: <br/> 
    <textarea name="message" rows="5" cols="50"><?php echo $_POST['message']; ?></textarea> 
    <br/> 
    <input type="Submit" name="Submit" value="Submit"/> 
    <input type="Reset" name="Reset" value="Reset"/>

    </form>
         

     <!-- footer -->
<br/>
<br/>
<br/>


    <div id="footer">
    <div id="left_footer">&copy; Copyright 2011<strong> Author </strong></div>
    <div id="right_footer">

<!-- Please do not change or delete this link. Read the license! Thanks. :-) -->
Design by <a href="http://www.realitysoftware.ca" title="Website Design">Reality Software</a>

<!-- end footer --></div>
<!-- end main --></div>
</body>
</html>

Hi all

I have a form where there are three fields, category, type, colour. On the top drop down (Category) I need it to reset the form and remove the url parameters when it is selected. Here's my code:

<form id="filter" name="filter" method="get" action="product.php">
     
      <br /><strong>Categories:</strong><br /><br />
      <select name="category" id="category_filter" style="width: 200px" onChange="this.form.submit();">
         <option value="0" selected class="meter-calc-text">All Categories</option>
         <?php
         
         $fetchcategories=mysql_query("SELECT * FROM `product_categories` ORDER BY id ASC");
          while($returnedcategories=mysql_fetch_array($fetchcategories)) {
          echo "<option value=\"".$returnedcategories['id']."\"".(($returnedcategories['id']==$_GET['category']) ? ' selected="selected"':'').">".$returnedcategories['name']."</option>"; 
         }
         ?>
         </select>

How do I reset the url when the user clicks the drop down?

Many thanks for your help

Pete

Code: [Select]
function my_fav_quote_show_optin_form() {

if (!empty($_POST['my_fav_quote_email'])) {

my_fav_quote_opt_in();
}
$out2 = '';

$out = '<form action="" name="myform "method="post" id="requestQuote">';
$out .= '<table style="padding="0px" width="40px">';
$out .= '<tr><td>Name:*</td><td><input type="text" name="my_fav_quote_name" id="my_fav_quote_name"/></td></tr>';
$out .= '';
$out .= '<tr><td>Email:*</td><td><input type="text" name="my_fav_quote_email" id="my_fav_quote_email"/></td></tr>';

$out .= '';
$out .= '<tr><td>Phone:*</td><td><input type="text" name="my_fav_quote_phone" id="my_fav_quote_phone"/></td></tr>';

$out .= '';

$out .= '<tr><td>Event Date(optional):</td><td><input type="text" name="my_fav_quote_date" id="my_fav_quote_date"/></td></tr>';
$out .= '';

$out .= '<tr><td>Estimated Number of Guests(optional):</td><td><input type="text" name="my_fav_quote_guest" id="my_fav_quote_guest"/></td></tr>';
$out .= '';

$out .= '<tr><td>Desired Price Range Per Person (optional):</td><td><input type="text" name="my_fav_quote_rate" id="my_fav_quote_rate"/></td></tr>';
$out .= '';
$out .= '<tr><td style="vertical-align: middle;">Message:<br>(List your special requests, any food allergies , event description , special menu items that are not listed or any other information you think will helpful) </td><td><textarea placeholder=""  name="my_fav_quote_message" id="my_fav_quote_message"></textarea></td></tr>';
$out .= '';
$out .= '<tr><td>Security code:*</td><td><img src='.get_bloginfo('wpurl').'/wp-content/plugins/quote-cart/captcha.php?width=60&height=30&characters=5" /></td></tr>';
$out .= '';
$out .= '<tr><td>Input Above Security Code He *</td><td><input type="text" name="security_code" id="security_code" size="5"></td></tr>';
$out .= '';

$out .='<tr><td colspan="2">';
if ( function_exists( 'my_fav_quote_display' ) ){
$out .= my_fav_quote_display();
}



if ( function_exists( 'my_fav_quote_display3' ) ){
$out .= my_fav_quote_display3();
}


$out .='</td></tr>';
$out .= '<tr><td colspan=2 align=center><input type="submit" value="Request Quote" onclick="return chk_validation()" style="background-color:#000;color:#FFF;padding:5px;margin-top:10px;border:none;cursor:pointer;"/> 
<input type="button" onclick="formReset()" value="Reset form" />

</td></tr>';

$out .='</table></form>';
echo $out;
?>
<script language="javascript" type="text/javascript">
//<![CDATA[
function validate_email(field,alerttxt)
{

  apos=field.indexOf("@");
// alert(apos);
  dotpos=field.lastIndexOf(".");
   //alert(dotpos);
  if (apos<1||dotpos-apos<2)
{ return false;}
  else {return true;}
 
}
function chk_validation()
{
if(document.getElementById("my_fav_quote_name") && document.getElementById("my_fav_quote_name").value == '')
{
alert("Please Enter Name");
document.getElementById("my_fav_quote_name").focus();
return false;
}

if(document.getElementById("my_fav_quote_email").value == '')
{
alert("Please Enter Email");
document.getElementById("my_fav_quote_email").focus();
return false;
}
else
{

//alert(validate_email(document.getElementById("my_fav_quote_email").value,"Not a valid e-mail address!");
if (validate_email(document.getElementById("my_fav_quote_email").value,"Please enter valid e-mail address!")==false) {
alert("Please enter valid e-mail address!");
document.getElementById("my_fav_quote_email").focus();
return false;
}
}
if(document.getElementById("security_code").value == '')
{
alert("Please Enter Security Code");
document.getElementById("security_code").focus();
return false;
}
if(document.getElementById("quotes").value == '')
{
alert("Please add atleast one request quote");
document.getElementById("quotes").focus();
return false;
}
//return true;
}



//]]>

</script>
<?php

}

i need a form reset the actual problem is the normal reset is only reseting the fields but i need the information displayed using functions should also be reseted

I've used this update statement before, even with parameter binding, something easy is off...   I'm trying to update a hash knowing a person's user name and email combination, this is not ideal I realize or safe. I actually generate a unique random hash per person who registers, I tell them to remember this eg. keep the email.   I don't know why the update statement is being bypassed.   So they enter username, email associated with username, new password. New password is hashed, replaces old one, redirect.   I've been echoing stuff just to see the flow of the code, what is being executed and what isn't.

if(empty($errors)){

$userrname = test_input($_POST['userrname']);
$email = test_input($_POST['email']);
$newpassword = test_input($_POST['newpassword']);

$hash = password_hash($newpassword, PASSWORD_BCRYPT, array("cost" => 9));

$stmt = $link->prepare("SELECT username,hash FROM User where username=? And email=?");
$stmt->bind_param("ss",$userrname,$email);

if($stmt->execute())
{
$stmt->bind_result($username_from_db,$hash_from_db);
    if($stmt->fetch()){
        $_SESSION['user']=$username_from_db;
    $query = "UPDATE User SET hash=$hash WHERE email=$email And username=$username_from_db";
    if($result=$link->query($query)){
    $_SESSION['status_message'] = "Password has been reset";
    }
    
    }else {
    echo "no good";
    }
    $host  = $_SERVER['HTTP_HOST'];
        $uri   = $_SERVER['REQUEST_URI']; // the path/file?query string of the page
        
        header("Location: newlocation.com");
        exit;
        $link->close();
}

Edited by moose-en-a-gant, 02 February 2015 - 12:48 AM.

This works up until if (email == email2){
What is wrong? Is it a problem with the queries?

if(isset($_SESSION['rest']) || isset($_SESSION['chef'])){ header('Location:index.php');}

if (isset($_POST['submit'])) {

$errors = array();


// VALIDATION SCRIPT HERE


$newpass = generatepassword();

$link = mysql_connect("****","*****","******") or die ("Could not connect!");
mysql_select_db("****");
$query = "SELECT `username`, `type` FROM `users` WHERE `username`='$username'";
$result = mysql_query($query);
while($row = mysql_fetch_array($result))

{$type = $row['type'];}

$numrows = mysql_num_rows($result);
if ($numrows!=1){

$errors[] = 'Username not Found (Usernames are case sensitive)';}


if($email == '' || $username == ''){

$errors[] = 'Please Fill in all Fields';}


if (empty($errors)){

if ($type = 1){

$res1 = mysql_query("SELECT `username`,`email` FROM `rests` WHERE `username`='$username'");

while($row1 = mysql_fetch_array($res1))

{$email2 = $row1['email'];}
}else{

$res2 = mysql_query("SELECT `username`,`email` 

FROM `chefs` WHERE `username`='$username'");

while($row2 = mysql_fetch_array($res2))

{$email2 = $row2['email'];}

if ($email2 == $email)
{

echo $newpass;

mysql_query("UPDATE `users` SET  `password` = '$newpass' WHERE `username`='$username'");



//SEND EMAIL

$my_email = 'enquiries@bakerdesigns.co.uk';

$email_from = 'Chef Match';

$email_subject = "Your New Password :: Chef Match";

$message = "Your new password is $newpass<br>You may change this via your control panel later.";

$referer = $_SERVER['HTTP_REFERER']; 
    $this_url = "http://".$_SERVER['HTTP_HOST'].$_SERVER["REQUEST_URI"];  
    if ($referer != $this_url) { 
        echo "You do not have permission to use this script from another URL."; 
        exit; } 

 $from = "From: $email2\r\n";
    mail($email2, $email_subject, $message, $from); 

    $thanks = 'An email has been sent to $email2 containing your new password. Please check your junk folder.'; 

}}
}else{$errors[] = 'Email did not match Username'; 
$thanks = 'Email could not be sent.';}
}

Hi, I have a php password reset script that is not updating the database, or there is some other reason the new password reset is giving me a "wrong password" error on trying to use it. Any help Greatly appreciated! Thank you.

Code: [Select]
<?php
 
define('IN_SCRIPT', true);
// Start a session
session_start();

ini_set ("display_errors", "1");
error_reporting(E_ALL);

$host = " ";
$database  = " ";
$username  = " ;
$password  = " ";
$tbl_name   = " ";

$conn = mysql_connect($host, $username, $password) or die("Could not connect: " . mysql_error());

if($conn)
{
mysql_select_db($database);
echo "connected to database!!";
 } else {
  echo "failed to select database";
}
 



//this function will display error messages in alert boxes, used for login forms so if a field is invalid it will still keep the info
//use error('foobar');
function error($msg) {
    ?>
    <html>
    <head>
    <script language="JavaScript">
    <!--
        alert("<?=$msg?>");
        history.back();
    //-->
    </script>
    </head>
    <body>
    </body>
    </html>
    <?
    exit;
}

//This functions checks and makes sure the email address that is being added to database is valid in format.
function check_email_address($email) {
  // First, we check that there's one @ symbol, and that the lengths are right
  if (!ereg("^[^@]{1,64}@[^@]{1,255}$", $email)) {
    // Email invalid because wrong number of characters in one section, or wrong number of @ symbols.
    return false;
  }
  // Split it into sections to make life easier
  $email_array = explode("@", $email);
  $local_array = explode(".", $email_array[0]);
  for ($i = 0; $i < sizeof($local_array); $i++) {
     if (!ereg("^(([A-Za-z0-9!#$%&'*+/=?^_`{|}~-][A-Za-z0-9!#$%&'*+/=?^_`{|}~\.-]{0,63})|(\"[^(\\|\")]{0,62}\"))$", $local_array[$i])) {
      return false;
    }
  } 
  if (!ereg("^\[?[0-9\.]+\]?$", $email_array[1])) { // Check if domain is IP. If not, it should be valid domain name
    $domain_array = explode(".", $email_array[1]);
    if (sizeof($domain_array) < 2) {
        return false; // Not enough parts to domain
    }
    for ($i = 0; $i < sizeof($domain_array); $i++) {
      if (!ereg("^(([A-Za-z0-9][A-Za-z0-9-]{0,61}[A-Za-z0-9])|([A-Za-z0-9]+))$", $domain_array[$i])) {
        return false;
      }
    }
  }
  return true;
}


if (isset($_POST['submit'])) {

if ($_POST['forgotpassword']=='') {
error('Please Fill in Email.');
}
if(get_magic_quotes_gpc()) {
$forgotpassword = htmlspecialchars(stripslashes($_POST['forgotpassword']));
}
else {
$forgotpassword = htmlspecialchars($_POST['forgotpassword']);
}
//Make sure it's a valid email address, last thing we want is some sort of exploit!
if (!check_email_address($_POST['forgotpassword'])) {
  error('Email Not Valid - Must be in format of name@domain.tld');
}
    // Lets see if the email exists
    $sql = "SELECT COUNT(*) FROM users WHERE email = '$forgotpassword'";
    $result = mysql_query($sql)or die('Could not find member: ' . mysql_error());
    if (!mysql_result($result,0,0)>0) {
        error('Email Not Found!');
    }

//Generate a RANDOM MD5 Hash for a password
$random_password=md5(uniqid(rand()));

//Take the first 8 digits and use them as the password we intend to email the user
$emailpassword=substr($random_password, 0, 8);

//Encrypt $emailpassword in MD5 format for the database
$newpassword = md5($emailpassword);

        // Make a safe query
        $query = sprintf("UPDATE `users` SET `password` = '%s'
  WHERE `email` = '$forgotpassword'",
                    mysql_real_escape_string($newpassword));

mysql_query($query)or die('Could not update members: ' . mysql_error());

//Email out the infromation

$site_name = "MYSITECOM";
$site_email = "noreply@MYSITE.COM";
$subject = "Your New Password";
$message = "Your new password is as follows:
----------------------------
Password: $emailpassword
----------------------------
Please make note this information has been encrypted into our database

This email was automatically generated.";
                       
          if(!mail($forgotpassword, $subject, $message,  "FROM: $site_name <$site_email>")){
             die ("Sending Email Failed, Please Contact Site Admin! ($site_email)");
          }else{
                error('New Password Sent!.');
         }

}

else {
?>
      <form name="forgotpasswordform" action="" method="post">
        <table border="0" cellspacing="0" cellpadding="3" width="100%">
          <caption>
          <div>Forgot Password</div>
          </caption>
          <tr>
            <td>Email Address:</td>
            <td><input name="forgotpassword" type="text" value="" id="forgotpassword" /></td>
          </tr>
          <tr>
            <td colspan="2" class="footer"><input type="submit" name="submit" value="Submit" class="mainoption" /></td>
          </tr>
        </table>
      </form>
      <?
}
?>

Hi all

I have a filter system on a website I am creating and there are three forms each sends a value to the url using get.

Every time a user selects the drop down on the first form it send to the url and then a SQL query is run to select items from a database which works great for all three forms.

However, the problem I have is when the user goes and re-selects a category from the first form it needs to reset the other two below it and emptying the url parameter for both so it just asks the SQL to select the items from that category again.

Please help

Many thanks
Pete

What would be a good way to reset a password ?   I was thinking 1 user requests reset password page or after faulty login suggest reset password page 2 fill in email address 3 check if email address exists 4 if address exist insert a random key into database 5 create a password reset url with random key and send to registered email address 6 after user clicks url in mail use $_GET to retrieve random key from password reset url 7 check if url exists in database 8 let user choose new password 9 check that password strenght is valid 10 encrypt password 11 write password in db 12 confirm page that password has been changed   Are there any obvious mistakes in this logic ?   This application will be aimed at 70-80 years old people so it has to be as easy to use as possible. security questions and captcha's will be not really possible I am afraid.   thank you very much anatak
Edited by anatak, 07 June 2014 - 08:08 PM.

is there a way to reset the array keys? to 0,1,2,3,...

also for example that i have something like this:

$array['dog']='dog';
$array['mouse']='mouse';
$array['cat']='cat';

and i want it like this:

$array[0]='dog';
$array[1]='mouse';
$array[2]='cat';

is there a function for that already in php?