PHP Forum

**sith717** · 12-06-2009, 11:08 AM

I currently have this script:

PHP Code:


			
<?php

// This is displayed if all the fields are not filled in
$empty_fields_message = "<p>Please go back and complete all the fields in the form.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back";
// Convert to simple variables  
$email_address = $_POST['email_address'];
if (!isset($_POST['email_address'])) {
?>

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" AUTOCOMPLETE = "off" method="POST"> 

<span style="float: left;">
Email Address:
</span>
<span style="float: right;">
<input size="40" class="only" style="border:solid 1px #675f39; padding:4px 2px; font-size:12px;" type="text" name="email_address">
</span>
<br><br>
<hr>
<center>

<input id="submit" class="submit-button" type="submit" value="Reset Password" >
</center>

</form>



<?php
}
elseif (empty($email_address))
  {
    echo $empty_fields_message;
  }
else 
{
require_once("inc/config.php");
$email_address = mysql_real_escape_string($email_address);
$status = "OK";
$msg="";
//error_reporting(E_ERROR | E_PARSE | E_CORE_ERROR);
if (!stristr($email_address,"@") OR !stristr($email_address,"."))
{
$msg="<p>Your email address is not in the correct format.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back"; 
$status= "NOTOK";
}
if($status=="OK")
{ 
$query = "SELECT email, username FROM admin WHERE admin.email = '$email_address'";
$st = mysql_query($query);
$recs = mysql_num_rows($st);
$row = mysql_fetch_object($st);
$em = $row->email_address;// email is stored to a variable



 if ($recs == 0)
{  
echo "<p>Sorry your address is not there in our database. Please try again.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back"; exit;
}

function makeRandomPassword() 
{ 
          $salt = "abchefghjkmnpqrstuvwxyz0123456789"; 
          srand((double)microtime()*1000000);  
          $i = 0; 
          while ($i <= 7) 
          { 
                $num = rand() % 33; 
                $tmp = substr($salt, $num, 1); 
                $pass = $pass . $tmp; 
                $i++; 
          } 
          return $pass; 
    } 
    $random_password = makeRandomPassword(); 
    $db_password = md5($random_password); 
     
    $sql = mysql_query("UPDATE admin SET password='$db_password' WHERE email='$email_address'"); 
     
    $subject = "Your New Password"; 
    $message = "Hello, you have chosen to reset your password. 
     
    New Password: $random_password 
     
    http://www.yoursite.com/login
    Once logged in you can change your password 
     
    Thanks! 
    Site admin 
     
    This is an automated response, please do not reply!"; 
     
    mail($email_address, $subject, $message, "From: yoursite.com Webmaster<admin@jyoursite.com>\n 
        X-Mailer: PHP/" . phpversion()); 
echo "<p>Your new password has been send! Please check your email!";
 } 
 else 
 {
 echo $msg;
 }
}
?>

It works perfectly fine, but when I insert put in a email, that is not in the database it says: Sorry your address is not there in our database. Please try again.

When it shows that, it cuts of the footer.

Look at the pics:

Main form:

Error message when not valid email:

Code:

See how it cuts of the footer?

Now when I put in a valid email that is found in the database it shows it perfectly.

Picture

**lynxus** · 12-06-2009, 12:58 PM

I might be being stupid, But could it be the " exit; " at the end of that message?

-G

**sith717** · 12-06-2009, 01:17 PM

Nope, I already tried it.

This is what happens when I remove it,

**lizciz** · 12-06-2009, 05:10 PM

Yes, it is because of the exit at that line. So yes, you need to remove it. Then add an else statement after that if statement, so it looks like

PHP Code:


			
if ($recs == 0) {
   // echo your error message
} else {
   // rest of code here
}

**sith717** · 12-06-2009, 06:57 PM

Hello, I currently have this page:

http://rune-host.info/accounts-forgot2.php

When you load it, its a fan site, the page is for a forgotten password script and you will see a form.

Type in any email address in the correct (ex: your@site.com) format and you will see that the page gets cut off once you submit.

You will notice the footer of the page is cut off.

Pictures if you don't want to load the page:

Front page. loads perfectly.

ERROR PAGE: see the missing footer:

---

SOURCE:

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="en, English">
<meta name="keywords" content="Runescape, Jagex, free, games, online, multiplayer, magic, spells, java, MMORPG, MPORPG, gaming">
<meta name="description" content="RuneScape is a massive 3d multiplayer adventure, with monsters to kill, quests to complete, and treasure to win. You control your own character who will improve and become more powerful the more you play.">
<title>RuneScape - the massive online adventure game by Jagex Games Studio</title>
<style type="text/css">/*\*/@import url(css/global-17.css);/**/</style>

<script type="text/javascript">
function getPages(loc) {
  if (loc=="top") {
    var item=document.myformtop;
    var toupdate=document.myformbottom;
  }
  else {
    var item=document.myformbottom;
    var toupdate=document.myformtop;
  }
  var pagetoget=parseInt(item.page.value);
  var numpages=parseInt(item.numpages.value);
  if (pagetoget<=numpages) item.submit();
  else {
    try {
     item.page.value=item.currentpage.value;
     toupdate.page.value=item.currentpage.value;
    }catch(err){}
 }
}
</script>
<style type="text/css">/*\*/@import url(css/news-2.css);/**/</style>

</head>

<body id="nav">
<a name="top"></a>


<div id="scroll">

<div id="head"><div id="headBg">
<div id="headOrangeTop"></div>
<img src="img/main/layout/head_image_mob.jpg" alt="RuneScape">
<div id="headImage"><a href="title.php" id="logo_select"></a>

<div id="lang">

<a href="" title="English"><img src="img/main/layout/union_flag.png" alt="English"></a>

<a href="#" title="Deutsch"><img src="img/main/layout/german_flag.png" alt="Deutsch"></a>
<a href="#" title="Fran&ccedil;ais"><img src="img/main/layout/french_flag.png" alt="Fran&ccedil;ais"></a>
<a href="#" title="Portugu&ecirc;s (BR)"><img src="img/main/layout/brazilian_flag.png" alt="Portugu&ecirc;s (BR)"></a>
</div>

<div id="sessionText">
You are logged in as <span id="accountName">

l8er
</span>
</div>



</div>


<div id="headOrangeBottom"></div>

<div class="navigation">
<div class="location">

<b>Location: </b> <a href="accounts.php">Home</a> &gt; <a href="accounts-settings.php">Settings</a> &gt; Forgotten Password


</div>

</div>
</div></div>
<div id="content">
<div id="article">
<div class="sectionHeader">
<div class="left">

<div class="right">

<div class="plaque">
Forgotten Password
</div>
</div>
</div>
</div>
<div class="section">

<div class="article">

<div class="topshadow">
<div class="bottombordershad">
<div class="leftshadow">
<div class="rightshadow">
<div class="leftcorner">
<div class="rightcorner">
<div class="bottomleftshad">
<div class="bottomrightshad">

<div class="pagepad">
<div class="centre" id="newsitemMenu">

<script type="text/javascript" language="Javascript">
<!--
//Simple Switch Image Bucket Inc.
//Made By Bucket

if (document.images) {
     button1 = new Image
     button2 = new Image

     button1.src = 'img/logout_off.gif'
     button2.src = 'img/logout_on.gif'
 }
if (document.images) {
     button3 = new Image
     button4 = new Image

     button3.src = 'img/btl_off.gif'
     button4.src = 'img/btl_on.gif'
 }
//-->
</script>
<img src="img/spacer.gif" alt="This is spacer.gif" height="37">
<hr>


</div>

<div class="newsJustify">



<?php

// This is displayed if all the fields are not filled in
$empty_fields_message = "<p>Please go back and complete all the fields in the form.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back";
// Convert to simple variables  
$email_address = $_POST['email_address'];
if (!isset($_POST['email_address'])) {
?>

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST"> 

<span style="float: left;">
Email Address:
</span>
<span style="float: right;">
<input size="40" class="only" style="border:solid 1px #675f39; padding:4px 2px; font-size:12px;" type="text" name="email_address">
</span>
<br><br>
<hr>
<center>

<input id="submit" class="submit-button" type="submit" value="Reset Password" >
</center>

</form>



<?php
}
elseif (empty($email_address))
  {
    echo $empty_fields_message;
  }
else 
{
require_once("inc/config.php");
$email_address = mysql_real_escape_string($email_address);
$status = "OK";
$msg="";
//error_reporting(E_ERROR | E_PARSE | E_CORE_ERROR);
if (!stristr($email_address,"@") OR !stristr($email_address,"."))
{
$msg="<p>Your email address is not in the correct format.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back"; 
$status= "NOTOK";
}
if($status=="OK")
{ 
$query = "SELECT email, username FROM admin WHERE admin.email = '$email_address'";
$st = mysql_query($query);
$recs = mysql_num_rows($st);
$row = mysql_fetch_object($st);
$em = $row->email_address;// email is stored to a variable



 if ($recs == 0)
{  
echo "<p>Sorry your address is not there in our database. Please try again.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back"; exit;
}



function makeRandomPassword() 
{ 
          $salt = "abchefghjkmnpqrstuvwxyz0123456789"; 
          srand((double)microtime()*1000000);  
          $i = 0; 
          while ($i <= 7) 
          { 
                $num = rand() % 33; 
                $tmp = substr($salt, $num, 1); 
                $pass = $pass . $tmp; 
                $i++; 
          } 
          return $pass; 
    } 
    $random_password = makeRandomPassword(); 
    $db_password = md5($random_password); 
     
    $sql = mysql_query("UPDATE admin SET password='$db_password' WHERE email='$email_address'"); 
     
    $subject = "Your New Password"; 
    $message = "Hello, you have chosen to reset your password. 
     
    New Password: $random_password 
     
    http://www.yoursite.com/login
    Once logged in you can change your password 
     
    Thanks! 
    Site admin 
     
    This is an automated response, please do not reply!"; 
     
    mail($email_address, $subject, $message, "From: yoursite.com Webmaster<admin@jyoursite.com>\n 
        X-Mailer: PHP/" . phpversion()); 
echo "<p>Your new password has been send! Please check your email!</p>";
 } 
 else 
 {
 echo $msg;
 }
}
?>



<hr>

</div>
<div class="clear"></div>
</div>
</div>

</div>
</div>
</div>

</div>
</div>
</div>
</div>
</div>
</div>

</div>
</div>

<div id="footer">
<div class="contain">
<div class="footerdesc">

This website and its contents are copyright 1999 - 2009 Bucket Ltd<br>

Use of this website is subject to our <a href="terms/terms.ws">Terms &amp; Conditions</a> and <a href="privacy/privacy.ws">Privacy Policy</a>.

</div>
<a class="jagex.com" href="http://www.jagex.com" target="_blank">

<img src="img/main/layout/jagex2.png?5">

</a>
</div>
</div>

</div>

</body>
</html>

**sith717** · 07:19 PM

Did that:

But it does the same thing:

PHP Code:


			
<?php

// This is displayed if all the fields are not filled in
$empty_fields_message = "<p>Please go back and complete all the fields in the form.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back";
// Convert to simple variables  
$email_address = $_POST['email_address'];
if (!isset($_POST['email_address'])) {
?>

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" AUTOCOMPLETE = "off" method="POST"> 

<span style="float: left;">
Email Address:
</span>
<span style="float: right;">
<input size="40" class="only" style="border:solid 1px #675f39; padding:4px 2px; font-size:12px;" type="text" name="email_address">
</span>
<br><br>
<hr>
<center>

<input id="submit" class="submit-button" type="submit" value="Reset Password" >
</center>

</form>



<?php
}
elseif (empty($email_address))
  {
    echo $empty_fields_message;
  }
else 
{
require_once("inc/config.php");
$email_address = mysql_real_escape_string($email_address);
$status = "OK";
$msg="";
//error_reporting(E_ERROR | E_PARSE | E_CORE_ERROR);
if (!stristr($email_address,"@") OR !stristr($email_address,"."))
{
$msg="<p>Your email address is not in the correct format.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back"; 
$status= "NOTOK";
}
if($status=="OK")
{ 
$query = "SELECT email, username FROM admin WHERE admin.email = '$email_address'";
$st = mysql_query($query);
$recs = mysql_num_rows($st);
$row = mysql_fetch_object($st);
$em = $row->email_address;// email is stored to a variable



 if ($recs == 0) {
echo "<p>Sorry your address is not there in our database. Please try again.</p>Click <a class=\"two\" href=\"javascript:history.go(-1)\">here</a> to go back";
}

else
 {


function makeRandomPassword() 
{ 
          $salt = "abchefghjkmnpqrstuvwxyz0123456789"; 
          srand((double)microtime()*1000000);  
          $i = 0; 
          while ($i <= 7) 
          { 
                $num = rand() % 33; 
                $tmp = substr($salt, $num, 1); 
                $pass = $pass . $tmp; 
                $i++; 
          } 
          return $pass; 
    } 
    $random_password = makeRandomPassword(); 
    $db_password = md5($random_password); 
     
    $sql = mysql_query("UPDATE admin SET password='$db_password' WHERE email='$email_address'"); 
     
    $subject = "Your New Password"; 
    $message = "Hello, you have chosen to reset your password. 
     
    New Password: $random_password 
     
    http://www.yoursite.com/login
    Once logged in you can change your password 
     
    Thanks! 
    Site admin 
     
    This is an automated response, please do not reply!"; 
     
    mail($email_address, $subject, $message, "From: yoursite.com Webmaster<admin@jyoursite.com>\n 
        X-Mailer: PHP/" . phpversion()); 
echo "<p>Your new password has been send! Please check your email!";

}  

 } 
 else 
 {
 echo $msg;
 }
}
?>

**Brian07002** · 12-06-2009, 09:16 PM

make sure you added the <div id="footer"> to the page that doesn't show the footer

**treyk4** · 12-06-2009, 10:13 PM

This looks an awful lot like an attempt to steal runescape passwords. In fact, I believe that's just what this is.

What do you have to say for yourself?

**lizciz** · 12-07-2009, 01:43 AM

"Same thing" as in the header is still cut off, or as in you still get both the error and success messages?

**chrishirst** · 12-07-2009, 03:10 PM

two threads on same topic merged.