PHP - Change Email Function Problem
I wrote a bunch of code just to realize that there's a huge security hole in my script.
Here's a how I've built it: 1. first you enter the new email address into the input box and click submit 2. an email gets sent to you where you have to click on an activation link to confirm the change, and of course the email gets send to the inbox to make sure it's a valid email the activation link looks as follows: Code: [Select] http://localhost/changeemail_confirm.php?id=$dbuser_id&email=$user_email The dbuser_id gets taken from the session variable, and the user email is the new entered user email. 3. After clicking the link you get directed to an activation page, I thought about letting the user enter his password and letting it match with the password in the database as added security, so he can't just change the user_id in the link so that the email of another user gets changed. the query on the activation page looks like this: "UPDATE user SET email = '$user_email' WHERE nickname = '$dbuser_name' AND WHERE user_id = '$id'"; The $id is being taking from the activation link per GET, and the $dbuser_name is being taking from the session variable. And now this is the problem where I'm stuck, even though I've added a bunch of security, and even the necessary to enter a password there's still a major security hole, which is the user can easily change the email in the activation link to something else, something that is not a valid email. E.g. this Code: [Select] http://localhost/changeemail_confirm.php?id=35&email=mail@phpmail.local can become to this, when the user manually edits the url and pastes it into his browser: Code: [Select] http://localhost/changeemail_confirm.php?id=35&email=MAIL@ANYTHING.com How can I prevent this, is there any way I could tell the script the CONFIRMED and VALID email, with a more secure way? BTW this script works as it is, it's just that the user can manually change the email to something else what makes this script worthless for now. Similar TutorialsHi there, I've set up a basic password change that sends an email to the client when they change their password. The email notify's the client that their password has been changed and what the password is. The current problem I'm receiving is that when the user changes their password the message confirms that an email has been sent however, the email never arrives. The original email only arrives when the client changes their password again and they receive their first password change not their new password change. Can you help?? my code is below: Code: [Select] <?php $host="localhost"; // Host name $username="root"; // Mysql username $password="*******"; // Mysql password $db_name="testpwreset"; // Database name //Connect to server and select database. $con=mysql_connect("$host", "$username", "$password"); mysql_connect("$host", "$username", "$password") or die("cannot connect to server"); mysql_select_db("$db_name") or die("cannot select DB"); // value sent from form $email_to=$_POST['email_to']; $old_password=$_POST['old_password']; $new_password=$_POST['new_password']; $new_password2=$_POST['new_password2']; if ($new_password != $new_password2) {die("Your passwords do not match");} // table name $tbl_name=members; mysql_query("UPDATE $tbl_name SET password = '$new_password' WHERE email = '$email_to' AND password = '$old_password'"); // retrieve password from table where e-mail = $email_to(*****@gmail.com) $sql="SELECT password FROM $tbl_name WHERE email='$email_to' AND password = '$old_password'"; $result=mysql_query($sql); // if found this e-mail address, row must be 1 row // keep value in variable name "$count" $count=mysql_num_rows($result); // compare if $count =1 row if($count==1){ $asdf=mysql_query("UPDATE $tbl_name SET password = '$new_password' WHERE email = '$email_to' AND password = '$old_password'"); $rows=mysql_fetch_array($result); // keep password in $your_password $your_password=$rows['password']; // ---------------- SEND MAIL FORM ---------------- // send e-mail to ... $to=$email_to; // Your subject $subject="Your Tafe FTP Password"; // From $header="from: your name \<your email\>"; // Your message $messages= "Your password for login to the Orange Tafe IT Ftp Server is: $your_password \r\n"; // send email $sentmail = mail($to,$subject,$messages,$header); } // else if $count not equal 1 else { echo "Cannot find your email in our database"; } // if your email succesfully sent if($sentmail){ echo "Your Password Has Been Sent To Your Email Address."; } else { echo "Cannot send password to your e-mail address"; } ?> Hello.. I've a problem about how to change our destination and the consecutively. As example, today the email will be sent to A,B,C and tomorrow the email will be sent to B,C,A until next week. Next week the email will be sent to D,E,F. Code for looping email.. Code: [Select] <?php $to = array('ikrom.shabri@yahoo.com','1.k.rom.pc@gmail.com'); foreach($to as $mail) { usleep(60000000); mail($mail,$subject,$email,$headers); } ?> Thank you for your assistance.. Hello all, I used simple php email function but it send an email in junk folder or spam. Can anyone tell me why is this so? Her is the code: $host = "ssl://smtp.gmail.com"; $port = "465"; $to = " xx@gmail.com"; // note the comma $subject = " $_POST[company_website] "; $headers = 'MIME-Version: 1.0' . "\r\n"; $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n"; $headers .= 'From: About Wholesale Account' . "<$_POST[email]>\r\n"; $headers .= 'Cc: mail@gmail.com' . "\r\n"; $headers .= 'Bcc: cc@gmail.com' . "\r\n"; mail($to, $subject, $message, $headers); Everything about the email is sending except the message text does anyone know what the issue could be? here is the block of code that sends the email Thanks in advance Code: [Select] $image = "http://www.visualrealityink.com/dev/clients/arzan/snell_form/images/email.png"; echo "got to process form"; $target_path = "upload/"; $path = $target_path = $target_path . basename( $_FILES['file']['name']); $boundary = '-----=' . md5( uniqid ( rand() ) ); $message .= "Content-Type: application/msword; name=\"my attachment\"\n"; $message .= "Content-Transfer-Encoding: base64\n"; $message .= "Content-Disposition: attachment; filename=\"$path\"\n\n"; echo $path; $fp = fopen($path, 'r'); do //we loop until there is no data left { $data = fread($fp, 8192); if (strlen($data) == 0) break; $content .= $data; } while (true); $content_encode = chunk_split(base64_encode($content)); $message .= $content_encode . "\n"; $message .= "--" . $boundary . "\n"; $message .= $image . "<br />" . $_POST['name'] . "submitted a resume on our website. Please review the applications and contact the candidate if their resume is a fit for any open opportunities with the company. <br><br> Thank you. <br><br> SEI Team"; $headers = "From: \"Me\"<me@example.com>\n"; $headers .= "MIME-Version: 1.0\n"; $headers .= "Content-Type: multipart/mixed; boundary=\"$boundary\""; mail('george@visualrealityink.com', 'Email with attachment from PHP', $headers, $message); Hello Guys,
I need your help as many PHPers here is more experienced in PHP coding than me. I have specific project I am working on and need a piece of code that can send an email from HTML form using PHP to the email address that is entered manually on the form, instead of standard sent to PHP code that is fixed within PHP script and executed during submission. I want sth that can grab manually enetered recipient's e-mail address, paste it to the PHP code and then use it to send the email to the recipient, instead of fixed sent to code. Something would say dynamically changed during the entry that can inject into PHP code the new address email entered on the form and then submit to it. Any ideas will be great.
Thanks.
Edited March 27, 2019 by slawotrend Hey, i'm needing to use email in a php script, but i've had no luck getting this working.. Even with perfectly given details. Is there another way which would let me email? I've tried using smtp details from live, gmail, isp email... All of which say it's send, but is not the case. The function is extremely broken, is there an alternative? Or some way to get this working? Kris. This is completely different code than my change password script thread. This is not double posting. Whenever I use this script to change my email, it just changes the email to nothing (blank). What could be wrong with it? Help is hugely appreciated. I know you don't have to use your valuable time to help me. <?php // I removed the connect to db part session_start(); $username = $_SESSION['username']; $email = $_POST['email']; $newemail = $_POST['newemail']; $confirmnewemail = $_POST['confirmnewemail']; $result = mysql_query("SELECT email FROM members WHERE username='$username'"); if($email!= mysql_result($result, 0)) { echo "The email address you entered is incorrect."; } if($newemail==$confirmnewemail) $sql=mysql_query("UPDATE members SET email='$newemail' where username='$username'"); if($sql) { echo "You have successfully changed your email address."; } else { echo "The new email and confirm new email fields were different."; } ?> Hello i have a syntax issue in the code below, can anyone shed some light? Code: [Select] <?php if(isset($_POST['submit'])) { $drop = mysql_real_escape_string($_POST['drop_1']); $tier_two = mysql_real_escape_string($_POST['Subtype']); echo "You selected "; echo $drop." & ".$tier_two; $Name = mysql_real_escape_string($_POST["Name"]); $Phone = mysql_real_escape_string($_POST["Phone"]); $Email = mysql_real_escape_string($_POST["Email"]); $Postcode = mysql_real_escape_string($_POST["Postcode"]); $Website = mysql_real_escape_string($_POST["Website"]); if($Name == '' || $Phone == '' || $Email == '' else if (!preg_match('/^[A-Za-z0-9\-.]+$/', $domain)|| $Postcode == '' || $Website == '') { die('<br> but you did not complete all of the required fields correctly, please try again'); } } the code works fine without the " else if (!preg_match('/^[A-Za-z0-9\-.]+$/', $domain) " . As well as checking for blank fields i'd like to check for the correct email format. Many thanks. Please would somebody be able to show me or give me some tips as to how I go about getting an email to send in my php code? $headers = 'From: me@me.com' . "\r\n" . 'Reply-To: me@me.com' . "\r\n" . 'X-Mailer: PHP/' . phpversion(); $first = $_GET['first']; $last = $_GET['last']; $town = $_GET['town']; $telephone = $_GET['telephone']; $code = $_GET['postcode']; $shortcode = substr($code,0,2); $query =mysql_query ("SELECT email FROM treesurgeons WHERE postcode like '%" . $shortcode . "%' ORDER BY companyName LIMIT 3"); echo mysql_error(); echo "<p>The email addresses you have requested are;</p>"; while($ntx=mysql_fetch_row($query)) $nt[] = $ntx[0]; echo "$nt[0]<br>$nt[1]<br>$nt[2]<br>"; $message = "$first . $last, from $town has searched for your details.<br>You may contact them on $telephone. <br> Thankyou."; $subject = "You Showed Up In The Tree Directory!"; $email = "$nt[0],$nt[1],$nt[2]"; $to = "$email"; mail( "$to", "$subject","$message", "$headers"); ?></body></html> Hi guy, Does any know how to add a variable value to the name of a function in a loop e.g. Code: [Select] $i=1; while($qryRowName = mysql_fetch_assoc($qryName)){ $i++; function test$i(){ ***** } Is this possible? Please any help will be very much aprreciated Thanks } Hi there I'm a newbie to all of this so please be gentle! I am starting up my own online business and I am feeling my way through PHP. I have been doing ok so far but I'm having problems with the "change your password" function. I change the password, I receive a reactivation email, but when I try to log in with the new password it hasnt changed. Code I'm using as follows: <?php // process.php include 'config.php'; if(isset($_POST['changepassword'])) { $current = trim($_POST['current']); $new = trim($_POST['new']); $confirm = trim($_POST['confirm']); $pw = md5($current); $query = mysql_query("SELECT * FROM Users WHERE Password = '$pw' LIMIT 1") or die(mysql_error()); if(mysql_num_rows($query) > 0) { while($row = mysql_fetch_array($query)) { if ( $_POST['new'] == $_POST['confirm'] ) {}else{ echo '<script>alert("Your passwords were not the same, please enter the same password in each field.");</script>'; echo '<script>history.back(1);</script>'; exit; } $password = md5($new); $do = mysql_query("UPDATE Users SET Password = '$password' WHERE Password = '$pw' LIMIT 1") or die(mysql_error()); $dotwo = mysql_query("UPDATE Users SET Activated = 0 WHERE Password = '$password' LIMIT 1") or die(mysql_error()); $send = mail($row['Email'] , "Password changed" , "Your password has been changed to: ".trim($_POST['new'])."\n\nYou can change it again via the members only panel, but first you must re-activate your account:\nhttp://www.infinite-monkey.co.uk/activate.php?id=".$row['Actkey']."\n\nDo not reply to this email, it is automated. Thanks." , "From: auto@mailer.com"); if((($do)&&($dotwo)&&($send))) { echo '<script>alert("Password changed. You will now be logged out and you must re-activate your account, check your email, a confirmation email has been sent.");</script>'; echo '<script>location.replace("logout.php");</script>'; exit; } else { echo '<script>alert("There appears to have been an error in the script. 1 or 2 of 3 things may have happened:\n\n• Your password could have been reset/changed\n• Your account could have been deactivated, see the resend validation email page\n• Your email may not have been sent.\n\nYou will now be logged out, if you are not able to login, reset your password using the form, or resend the validation email to activate your account again.\n\nWe are sorry for the inconvenience.");</script>'; echo '<script>location.replace("logout.php");</script>'; exit; } } } else { echo '<script>alert("Incorrect password.");</script>'; echo '<script>history.back(1);</script>'; exit; Hello All I currently have a function that takes in user input from form fields $email & $password. If all is well the function logs the user in, if not redirects back to the login form. What I require is two things. 1) Allow the user to login with either "email" or "username" (entered in the $email form field). 2) Allow the system to have a "master" password and if that is entered with a valid email or user from above then log that user in. Here is my current function, any help is greatly received. Regards function loginMember($email,$password,$returnURL){ if ($email != "" && $password != ""){ $result = mysql_query("SELECT mid,memberid,forename,surname FROM tbl001_member WHERE emailaddress='$email' AND password='".$password."' AND online=1"); if (mysql_num_rows($result) > 0) { $row = mysql_fetch_row($result); $_SESSION["logged_user"] = $row[2]." ".$row[3]; $_SESSION["logged_id"] = $row[0]; $_SESSION["logged_memid"] = $row[1]; session_unregister('wrong_email'); if (isset($_SESSION["logged_user"])) { header('Location:'.$returnURL); exit; } } else { session_register('wrong_email'); $_SESSION['wrong_email'] = $email; return "* There is no registered account with typed email & password."; } } else { session_register('wrong_email'); $_SESSION['wrong_email'] = $email; return "* Please input email and password correctly."; } } Hi all , here is a question about a disabled button . If I have a button: Code: [Select] <input id='submit' type='submit' disabled='disabled' value='submit'> Is it possible to change the "disabled=true" through php function ? such as Code: [Select] function change_button(){ echo "<script language=\"javascript\">"; echo "document.getElementById('submit').disabled=true;"; echo "</script>"; } I tried it , not working...is this function possible or have I make any mistake ? Thanks for every reply . This topic has been moved to JavaScript Help. http://www.phpfreaks.com/forums/index.php?topic=330989.0 I used the move_uploaded_file function to upload files to my server ,but the function changes the Arabic names of files because most of my files are Arabic named
how can I fix that ?
Hi all, I am just starting out in the world of php and have got this far with a lot of googling. But I'm really stuck with this part now. I have a function that works perfectly for display on a page, eg <?php echo quickquote(); ?> function quickquote() { global $db; global $cart; $cart = $_SESSION['cart']; if ($cart) { $items = explode(',',$cart); $contents = array(); foreach ($items as $item) { $contents[$item] = (isset($contents[$item])) ? $contents[$item] + 1 : 1; } $quickquote[] = 'Quote Required:<br />'; foreach ($contents as $id=>$qty) { $sql = 'SELECT * FROM products WHERE id = '.$id; $result = $db->query($sql); $row = $result->fetch(); extract($row); $quickquote[] = ''.$qty.''; $quickquote[] = ' x '; $quickquote[] = '' . $model . ''; $quickquote[] = ' (' . $type . '- '; $quickquote[] = ''. $basin . '- '; $quickquote[] = ''. $top . ')'; $quickquote[] = '<br />'; } $quickquote[] = 'End of Quick Quote Request'; } else { $quickquote[] = 'The quote cart is empty.'; } return join('',$quickquote); } However, i am trying to include this in an email message: if(!$error) { $messages="From: $email <br>"; $messages.="Name: $name <br>"; $messages.="Email: $email <br>"; $messages.="Phone: $phone <br>"; $messages.="Message: $message <br>"; $messages.="Quick Quote Request: $quickquote <br>"; $mail = mail($to,$subject,$messages,$headers); The email also works perfectly with the exception that the data is not there from $quickquote. I've tried all sorts of variations and suggested solutions from the web but nothing I've tried has been successful so far. It's amazing that I've got this far so I don't want to give up on it, but I'm just completely stumped ... All information and help very much appreciated. Cheers K Hi, I need to check is the mail is sent and successfully deliver to the recipient email. here is the code : if(mail($to, $subject, $message, $headers, '-f ' . $return_path)) {echo "Sent"; }else {echo "Not Sent";} Please help me, its urgent. Thanks in advance. Hi All, I have a script that i bought and a part of it has a share icon with an email icon so if the user clicks the email icon then it opens up your email client and adds the details of the deal to the email. The problem is that it seems to break each word up by placing a + between them. So for example you get this... Come+and+check+out+Welcome+to+theSocialDeal,+they+have+this+great+local+deal,+if+we+all+buy+it+then+we+get+it+cheaper! Today's+Deal:+4+hours+of+extreme+MTB+action+at+John+Doe+Extreme+Trail+Centre+for+the+price+of+1+hour Click+this+link+to+check+it+out:+ which should be this... Come and check out Welcome to theSocialDeal, they have this great local deal, if we all buy it then we get it cheaper! Today's Deal: 4 hours of extreme MTB action at John Doe Extreme Trail Centre for the price of 1 hour Click this link to check it out: Here is the php function, does anyone know what this could be and how i can stop it? function share_mail($team) { global $login_user_id; global $INI; if (!$team) { $team = array( 'title' => $INI['system']['sitename'] . '(' . $INI['system']['wwwprefix'] . ')', ); } $pre[] = "Come and check out {$INI['system']['sitename']}, they have this great local deal, if we all buy it then we get it cheaper!"; if ( $team['id'] ) { $pre[] = "Today's Deal: {$team['title']}"; $pre[] = "Click this link to check it out: "; $pre[] = $INI['system']['wwwprefix'] . "/team.php?id={$team['id']}&r={$login_user_id}"; $pre = mb_convert_encoding(join("\n\n", $pre), 'UTF-8', 'UTF-8'); $sub = "The Deal: {$team['title']}"; } else { $sub = $pre[] = $team['title']; } $sub = mb_convert_encoding($sub, 'UTF-8', 'UTF-8'); $query = array( 'subject' => $sub, 'body' => $pre, ); $query = http_build_query($query); return 'mailto:?'.$query; } Hi all Would like to ask for help . Generally I would like to run a webpage which will display actual price + price movements of selected cryptocurrencies.
I´m recieving data from extrernal API. (JSON) This is how code looks like: <?php $json = file_get_contents('https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd&include_market_cap=true;include_24hr_vol=true;include_24hr_change=true'); $bitcoinPrice = json_decode($json); $json = file_get_contents('https://api.coingecko.com/api/v3/simple/price?ids=dash&vs_currencies=usd&include_market_cap=true;include_24hr_vol=true;include_24hr_change=true'); $dashPrice = json_decode($json); $json = file_get_contents('https://api.coingecko.com/api/v3/simple/price?ids=netchain&vs_currencies=usd&include_market_cap=true;include_24hr_vol=true;include_24hr_change=true'); $netchainPrice = json_decode($json); $json = file_get_contents('https://api.coingecko.com/api/v3/simple/price?ids=pivx&vs_currencies=usd&include_market_cap=true;include_24hr_vol=true;include_24hr_change=true'); $pivxPrice = json_decode($json); function formatter($amount) { // $formatter = new NumberFormatter('en_US', NumberFormatter::CURRENCY); return '$'.number_format($amount, 2);; } ?> <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Masternodes monitor</title> <!-- Font Awesome --> <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.8.2/css/all.css"> <!-- Bootstrap core CSS --> <link href="css/bootstrap.min.css" rel="stylesheet"> <!-- Material Design Bootstrap --> <link href="css/mdb.min.css" rel="stylesheet"> <!-- Your custom styles (optional) --> <link href="css/style.css" rel="stylesheet"> <!-- MDBootstrap Datatables --> <link href="css/addons/datatables.min.css" rel="stylesheet"> </head> <body> <table id="dtBasicExample" class="table table-striped table-bordered table-sm" cellspacing="0" width="100%"> <thead> <tr> <th class="th-sm">Coin name </th> <th class="th-sm">ROI </th> <th class="th-sm">Daily income </th> <th class="th-sm">Price </th> <th class="th-sm">24 change </th> <th class="th-sm">Volume </th> <th class="th-sm">Marketcap </th> <th class="th-sm">Node price </th> <th class="th-sm">Coins for MN </th> <th class="th-sm">Nodes </th> </tr> </thead> <tbody> <tr> <td><img src="/img/btc.png" width="15" height="15" title="Bitcoin logo" alt="Bitcoin logo" /> Bitcoin (BTC) </td> <td>Unknown</td> <td>Unknown</td> <td><?=formatter($bitcoinPrice->bitcoin->usd) ?></td> <td><?=formatter($bitcoinPrice->bitcoin->usd_24h_change) ?></td> <td><?=formatter($bitcoinPrice->bitcoin->usd_24h_vol) ?></td> <td><?=formatter($bitcoinPrice->bitcoin->usd_market_cap) ?></td> <td>Unknown</td> <td>Unknown</td> <td>Unknown</td> </tr> <tr> <td><img src="/img/pivx.png" width="15" height="15" title="Pivx logo" alt="Pivx logo" /> Pivx (PIVX)</td> <td>Unknown</td> <td>Unknown</td> <td><?=formatter($pivxPrice->pivx->usd) ?></td> <td><?=formatter($pivxPrice->pivx->usd_24h_change) ?></td> <td><?=formatter($pivxPrice->pivx->usd_24h_vol) ?></td> <td><?=formatter($pivxPrice->pivx->usd_market_cap) ?></td> <td>Unknown</td> <td>10,000</td> <td>1,536</td> </tr> <tr> <td><img src="/img/dash.png" width="15" height="15" title="Dash logo" alt="Dash logo" /> Dash (DASH)</td> <td>7.5%</td> <td>14,40 $</td> <td><?=formatter($dashPrice->dash->usd) ?></td> <td><?=formatter($dashPrice->dash->usd_24h_change) ?></td> <td><?=formatter($dashPrice->dash->usd_24h_vol) ?></td> <td><?=formatter($dashPrice->dash->usd_market_cap) ?></td> <td>$69,696.22</td> <td>1000</td> <td>4001</td> </tr> <tr> <td><img src="/img/ntx.png" width="15" height="15" title="Netchain logo" alt="Netchain logo" /> Netchain (NTX) </td> <td>350%</td> <td>0,12 $</td> <td>$0.00004</td> <td><?=formatter($netchainPrice->netchain->usd_24h_change) ?></td> <td><?=formatter($netchainPrice->netchain->usd_24h_vol) ?></td> <td><?=formatter($netchainPrice->netchain->usd_market_cap) ?></td> <td>$7</td> <td>100.000</td> <td>55</td> </tr> </tbody> <tfoot> <tr> <th>Coin name </th> <th>ROI </th> <th>Daily income </th> <th>Price </th> <th>24 change </th> <th>Volume </th> <th>Marketcap </th> <th>Node price </th> <th>Coins for MN </th> <th>Nodes </th> </tr> </tfoot> </table> <!-- SCRIPTS --> <!-- JQuery --> <script type="text/javascript" src="js/jquery-3.4.1.min.js"></script> <!-- Bootstrap tooltips --> <script type="text/javascript" src="js/popper.min.js"></script> <!-- Bootstrap core JavaScript --> <script type="text/javascript" src="js/bootstrap.min.js"></script> <!-- MDB core JavaScript --> <script type="text/javascript" src="js/mdb.min.js"></script> <!-- MDBootstrap Datatables --> <script type="text/javascript" src="js/addons/datatables.min.js"></script> <script> $(document).ready(function () { $('#dtBasicExample').DataTable(); $('.dataTables_length').addClass('bs-select'); setTimeout(function() { location.reload(); }, 900000); }); </script> </body> </html>
I need section usd_24h_change in percent %. I tryed : <td><($bitcoinPrice->dash->usd_24h_change) ? % ></td> <td><($dashPrice->dash->usd_24h_change) ? % ></td> <td><($netchainPrice->dash->usd_24h_change) ? % ></td> <td><($pivxPrice->dash->usd_24h_change) ? % ></td> But it doesn´t work… Please help Edited October 26, 2019 by Netchain |