Question

如果我把它放在user_id = 3或者删除where语句（WHERE user_id =“。$ user ['user_id']。”）但是然后我在db中的所有密码都改变了。

我使用get方法来获取这样的用户ID USER_ID = 3及reset_token = XXXXXXXXX

<?php

if( isset($_GET['user_id']) && isset($_GET['reset_token']) ) {
$userid = $_GET['user_id']; 
$reset_token = $_GET['reset_token']; 

// Make sure user email with matching hash exist
$req = $heidisql->prepare("SELECT * FROM users WHERE user_id='$userid' AND reset_token='$reset_token' ");

$req->execute($userid, $reset_token );

$user = $req->fetch(PDO::FETCH_ASSOC);


    if ($user) {

       if (!preg_match ('%\A(?=[-_a-zA-Z0-9]*?[A-Z])(?=[-_a-zA-Z0-9]*?[a-z])(?=[-_a-zA-Z0-9]*?[0-9])\S{8,30}\z%', $_POST['new_pass']) 
         || $_POST['new_pass'] !== $_POST['confirm_newpass'] ) {

       echo 'Your new password did not match the new confirm password or is invalid!';
       exit();

        } 

   } 

  } else {

        $newpassword = escape_data($_POST['new_pass']);
        $newpass_hash = password_hash($newpassword, PASSWORD_BCRYPT);

        $sql= "UPDATE users SET "
                . "password_hashcode='$newpass_hash', "
                . "reset_allocated_time=NULL, "
                . "reset_token=NULL "
                . "WHERE user_id=".$user['user_id']." "; //<- error here

        // Make sure user email with matching hash exist
        $result_newpass = $heidisql->prepare($sql);

        $result_newpass->execute();

        echo "Your password has been reset!";

        exit();

    }

已经尝试过user_id ='$ userid'/ $ _GET ['user_id'] 那么，我该如何定义变量user_id？

仍然无效 $ req = $ heidisql-＆gt; prepare（“SELECT * FROM users WHERE user_id ='：user_id'AND reset_token ='：reset_token'”）;

   $req->execute([':user_id'=>$userid, ':reset_token'=>$reset_token]);

   $sql= "UPDATE users SET password_hashcode=':password_hashcode', reset_allocated_time=NULL, reset_token=NULL WHERE user_id=:user_id";
   $result_newpass = $heidisql->prepare($sql); $result_newpass->execute([':user_id'=>$userid,':password_hashcode'=>$newpass_hash, ':reset_token'=>NULL, ':reset_allocated_time'=>NULL]);

- 我认为问题可能在于get方法，因为我似乎无法正确访问网址中的user_id / reset_token？

...本地主机/示例/ reset_pass.php USER_ID = XX＆安培; reset_token = XXXXXXXXX

我在user_id获取未定义的变量
任何人都知道问题是否导致我的密码验证也不起作用？

Answer 1

使用预准备语句时，实际上并未在语句中包含值。相反，您使用占位符，稍后绑定值。

变化：

$req = $heidisql->prepare(
  "SELECT * FROM users WHERE user_id='$userid' 
   AND reset_token='$reset_token' "
);
$req->execute($userid, $reset_token );

要：

$req = $heidisql->prepare(
  "SELECT * FROM users WHERE user_id=:id 
   AND reset_token=:token "
);
$req->execute([':id'=>$userid, ':token'=>$reset_token]);

See the docs

再向下，你有：

$newpassword = escape_data($_POST['new_pass']);
$newpass_hash = password_hash($newpassword, PASSWORD_BCRYPT);

在散列之前更改密码（转义）可能是一个坏主意。哈哈吧;结果将是安全的使用。如果您的转义功能在将来发生变化，则更改它会导致无法识别用户真密码的风险。

再向下，你应该改变：

$sql= "UPDATE users SET password_hashcode='$newpass_hash',"
    . "reset_allocated_time=NULL, reset_token=NULL "
    . "WHERE user_id=".$user['user_id']." "; //<- error here

$result_newpass = $heidisql->prepare($sql);

$result_newpass->execute();

要：

$sql= "UPDATE users SET password_hashcode=:newpass,"
    . "reset_allocated_time=NULL, reset_token=NULL "
    . "WHERE user_id=:id"; //<- error here

$result_newpass = $heidisql->prepare($sql);

$result_newpass->execute([':newpass'=>$newpass_hash, ':id'=>$userid]);

Answer 2

从此处更新此$sql：

$sql = "UPDATE users SET 
        password_hashcode = '$newpass_hash', 
        reset_allocated_time = NULL, 
        reset_token = NULL 
        WHERE user_id = '$user['user_id']'";

重置密码确认无效？

2 个答案: