PHP密码重置

Question

我一直在重写旧密码重设以帮助学习PHP。

我想知道是否有一些部分我应该续订，因为它仍然会出现错误。

if(isset($_POST['reset'])){ 
    $email = $_POST['email']; 

    $stmt=$conn->prepare("SELECT email FROM users WHERE email=:email"); 
    $stmt->execute(array("email"=>$email)); 
    $userRow=$stmt->fetchColumn(); 

    if($userRow == '0'){ 
     $error[] = 'Sorry, we cannot find your account details. Please try another email address.'; 
    }else{ 
     $stmt=$conn->prepare("SELECT lname FROM users WHERE email=:email"); 
     $stmt->execute(array(":email"=>$email)); 
     $userRow1=$stmt->fetch(PDO::FETCH_ASSOC); 

     //$userRow = PDO::FETCH_ASSOC($stmt); 
     $password = substr(md5(uniqid(rand(),1)),3,10); 
     $pass = md5($password); 

     $to = "$email"; 
     $subject = "ClientCheck Account Recovery"; 
     $body = "Hi, $userRow1 \n\n Your password has been reset. \n\n Your password now is: $password \n\n Kind regards\n ClientCheck"; 

     $additionalheaders = "From: <no-reply@clientcheck.co.uk>"; 
     $additionalheaders .= "Reply-To: no-reply@clientcheck.co.uk"; 

     $stmt=$conn("UPDATE users SET password=:password WHERE email-:email"); 
     $stmt->execute(array(":password"=>$password,":email"=>$email)); 
     $userRow2=$stmt->rowCount(); 
    } 
} 

if(!empty($error)){ 
    $i = '0'; 
    while($i < count($error)){ 
     echo "$error[$i]"; 
     $i ++; 
    } 
} 

Notice: Array to string conversion in /forgottenpassword.php on line 31
Fatal error: Function name must be a string in /forgottenpassword.php on line 36

我知道有发送的复位密码

是不是在安全性方面的最好的一步，但是，我想获得它的权利在这个水平，然后继续前进，以更安全的解除方法。

Answer 1

两行必须被校正，一个在变量$体是从PDO的结果阵列，并且其中在制备语句的行：

<?php 
if(isset($_POST['reset'])){ 
    $email = $_POST['email']; 

    $stmt=$conn->prepare("SELECT email FROM users WHERE email=:email"); 
    $stmt->execute(array("email"=>$email)); 
    $userRow=$stmt->fetchColumn(); 

    if($userRow == '0'){ 
     $error[] = 'Sorry, we cannot find your account details. Please try another email address.'; 
    }else{ 
     $stmt=$conn->prepare("SELECT lname FROM users WHERE email=:email"); 
     $stmt->execute(array(":email"=>$email)); 
     $userRow1=$stmt->fetch(PDO::FETCH_ASSOC); 

     //$userRow = PDO::FETCH_ASSOC($stmt); 
     $password = substr(md5(uniqid(rand(),1)),3,10); 
     $pass = md5($password); 

     $to = "$email"; 
     $subject = "ClientCheck Account Recovery"; 
     $body = "Hi, ".$userRow1['username']."\n\n Your password has been reset. \n\n Your password now is: $password \n\n Kind regards\n ClientCheck"; // changed here 

     $additionalheaders = "From: <no-reply@clientcheck.co.uk>"; 
     $additionalheaders .= "Reply-To: no-reply@clientcheck.co.uk"; 

     $stmt=$conn->prepare("UPDATE users SET password=:password WHERE email=:email"); // changed here 
     $stmt->execute(array(":password"=>$password,":email"=>$email)); 
     $userRow2=$stmt->rowCount(); 
    } 
} 

if(!empty($error)){ 
    $i = '0'; 
    while($i < count($error)){ 
     echo "$error[$i]"; 
     $i ++; 
    } 
} 

Answer 2

检查该行

$stmt=$conn("UPDATE users SET password=:password WHERE email-:email"); 
                  ^// this should be equals.