尝试在 PHP 中创建重置密码页面时,GET 变量上的未定义索引

Undefined index on GET variables when trying to create reset password page in PHP

提问人:Bernard 提问时间:11/22/2011 最后编辑:Bernard 更新时间:11/22/2011 访问量:1717

问:

我正在开发一个允许用户重置密码的PHP页面。我已经到了输入用户名并发送一封电子邮件的地步,其中包含更改密码的链接。

但是,当我去更改密码时,我收到以下错误

Notice: Undefined index: email in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\reset-password.php on line 112

Notice: Undefined index: hash in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\reset-password.php on line 112

这是我的重置密码.php代码...

<?php
$msg = "";

    // If user is visiting using the link provided in the email
    if(isset($_GET['email']) && !empty($_GET['email']) AND isset($_GET['hash']) && !empty($_GET['hash']))
        {  
        $email = checkInput($_GET['email']); // Set email variable  
        $hash = checkInput($_GET['hash']); // Set hash variable  

        $search = mysql_query("SELECT email, hash FROM users WHERE email='".$email."' AND hash='".$hash."'") or die(mysql_error());  
        $match  = mysql_num_rows($search);  


        if($match > 0)
            {  
            // There is a match -> show change password form
            changePassForm();
            }
        else
            {  
            // No match -> dont show password form (invalid url)
            $msg .= '<div class="success" align="center">An email with a link to reset your password has been sent to your registered email account. Please click the link to reset your password.</div>';
            }  

        }
    // Else user is not visting from a link provided in an email.
    else
        // First check if user has already submitted form to send change password link
        {
        if(isset($_POST['submit-request']))
            {
            $username = checkInput($_POST['username']); 
            $query = "SELECT username FROM users WHERE username = '$username'";
            $result = mysql_query($query);
            $search = mysql_num_rows($result);
            // Checks if the username they entered exists - if so, call sendResetMail function. 
            if($search > 0)
                {
                $msg .= '<div class="success" align="center">An email with a link to reset your password has been sent to your registered email account. Please click the link to reset your password.</div>';  
                sendResetMail(); // Calls the sendMail function - sends the activation email to the user.
                }
            // Else username does not exist in database
            else
                {
                $msg .= '<div class="error" align="center">That username does not exist. Please try again.</div>';
                requestForgotPassEmail();
                }
            }
        // If user has not already submitted form, show them form.
        else
            {
            requestForgotPassEmail();
            $msg .= "request email";
            }
        }





    /* Initialize  empty containers for the errors */
    $rpnewpass_errors = "";
    $rpnewpasschk_errors = "";
    $msg = "";


    // If changePassForm has been submitted
    if(isset($_POST['submit-change']))
        {
        $newpass=isset($_POST['newpass']) ? checkInput($_POST['newpass']) : '';
        $newpasschk=isset($_POST['newpasschk']) ? checkInput($_POST['newpasschk']) : '';


        /* Checks all fields were entered */  
        if(!$_POST['newpass'] || !$_POST['newpasschk'])
            {
            $msg .= '<div class="error" align="center">You didn\'t a required field - please complete all the fields</div>';
            }

        else
            {
            /* Once all fields are entered - perform form validation */

            /* Checks the new password field is entered */      
            if(empty($newpass))
                {
                $newpass=false;
                $rpnewpass_errors .= "You didn't enter a new password";
                }

            /* Checks if the password contains at least 8 characters, lower/upper case letters and a number. */
            if(preg_match("/^.*(?=.{8,})(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z]).*$/", $newpass) === 0)
                {
                $msg .= '<div class="error" align="center">Password must be at least 8 characters and contain at least one lower case letter, one upper case letter and a number</div>';
                }

            /* Checks the verify new password field is entered */
            if(empty($newpasschk))
                {
                $msg .= '<div class="error" align="center">You didnt verify your new password.</div>';
                }

            /* Checks if the new password and verify new password match */
            if($newpass != $newpasschk)
                {
                $msg .= '<div class="error" align="center">Sorry, your passwords do not match.</div>';
                }

            /* Checks if all error containers are empty, then proceeds with password change */
            if(empty($rpnewpass_errors) && empty($rpnewpasschk_errors))
            {
            $query="SELECT username FROM users WHERE email = '$email' AND hash = '$hash'";
            echo $query; // for troubleshooting purposes, variables are echoing empty
            $result=mysql_query($query);
            $num=mysql_num_rows($result);

            if($num == 1)
                {
                $row=mysql_fetch_array($result);
                $md5newpass=md5($newpass);
                $query="UPDATE users SET password = '$md5newpass' WHERE username = '$row[0]'";
                $result=mysql_query($query);

                if(mysql_affected_rows() == 1) 
                    {
                    $msg .= '<div class="error" align="center">Your password has been changed successfully</div>';
                    }

                else
                    {
                    $msg .= '<div class="error" align="center">Your password could not be changed. Please try again</div>';
                    }
                    }
                else
                    {
                    $msg .= '<div class="error" align="center">Your username and password do not match our records</div>';
                    }
                }
            }
        }





?>

我想我在某个地方/不知何故从链接中丢失了 GET 变量,但不确定我该如何解决这个问题 - 这是漫长的一天,我已经坚持了一段时间,所以对于任何明显的错误,我们深表歉意!

谢谢。

PHP 变量 获取 undefined-index

评论

0赞 Aurelio De Rosa 11/22/2011
你泄露了很多信息。32号线是什么?checkInput() 是什么?
0赞 Bernard 11/22/2011
对不起,那行错了,应该是 142
0赞 Bernard 11/22/2011
再次对不起,那应该是 112 - 忘了我省略了一些评论

答:

0赞 Kai Qing 11/22/2011 #1

你对这条线设置了积极的$email和$hash?

    $query="SELECT username FROM users WHERE email = '$email' AND hash = '$hash'";
    echo $query; // for troubleshooting purposes, variables are echoing empty

你在这里设置它,但只是在一个条件中:

if(isset($_GET['email']) && !empty($_GET['email']) AND isset($_GET['hash']) && !empty($_GET['hash']))

如果用户名不存在,您可能不应该告诉用户,并且还应该根据单个令牌将请求写入单独的数据库表,而不是依赖电子邮件和哈希的 get var。只是我的意见。