title: Resetting a password via a form and a unique code
body: <p>I have a small scale application that allows the admins to reset their password. I currently have it so that the admin will enter their email address and it generates a random key and emails it to them. The random key is also stored in the database for the user. The email also includes a link to a form where the user can reset their password by entering their username and the code that was sent to them. </p>
  
  <p>Below is the reset password form:</p>
  
  <pre><code>&lt;h1&gt;Reset Your Password&lt;/h1&gt;
  
  &lt;form id="reset" name="reset" method="post" action="reset-admin-password-exec.php"&gt;
  &lt;table width="365" height="147" border="0" cellpadding="0" cellspacing="5"&gt;
    &lt;tr&gt;
      &lt;td width="144"&gt;Username: &lt;/td&gt;
      &lt;td&gt;&lt;input name="username" type="text" class="textfield" id="username" /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td&gt;Code: &lt;/td&gt;
      &lt;td&gt;&lt;input name="code" type="text" class="textfield" id="code" /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td&gt;New Password: &lt;/td&gt;
      &lt;td&gt;&lt;input name="password" type="password" class="textfield" id="code" /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td&gt;Confirm Password: &lt;/td&gt;
      &lt;td&gt;&lt;input name="cpassword" type="password" class="textfield" id="cpassword" /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;input type="submit" name="Submit" value="Reset" /&gt;&lt;/td&gt;    
    &lt;/tr&gt;
  &lt;/table&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>And here is the reset-admin-password-exec.php file that processes the code:</p>
  
  <pre><code>&lt;?
      //Array to store validation errors
      $errmsg_arr = array();
  
      //Validation error flag
      $errflag = false;
  
  
      //Function to sanitize values received from the form. Prevents SQL injection
      function clean($str) {
          $str = @trim($str);
          if(get_magic_quotes_gpc()) {
              $str = stripslashes($str);
          }
          return mysql_real_escape_string($str);
      }
  
      //check for validation errors
      if (isset ($_POST['username']) &amp;&amp; !empty ($_POST['username'])) {
      $username = clean($_POST['username']);
      } else {
          $errmsg_arr[] = 'username do not match';
          $errflag = true;
      }
  
      if (isset ($_POST['code']) &amp;&amp; !empty ($_POST['code'])) {
      $code = clean($_POST['code']);
      } else {
          $errmsg_arr[] = 'code do not match';
          $errflag = true;
      }
  
      if (isset ($_POST['password']) &amp;&amp; !empty ($_POST['password'])) {
      $password = clean($_POST['password']);
      } else {
          $errmsg_arr[] = 'first do not match';
          $errflag = true;
      }
  
      if (isset ($_POST['cpassword']) &amp;&amp; !empty ($_POST['cpassword'])) {
      $cpassword = clean($_POST['cpassword']);
      } else {
          $errmsg_arr[] = 'second do not match';
          $errflag = true;
      }
  
      //Check that both password match
      if( strcmp($password, $cpassword) != 0 ) {
          $errmsg_arr[] = 'Passwords do not match';
          $errflag = true;    
      }
  
  
      //encrypt the password
      $salt1 = md5($username);
      $salt2 = md5(DB_PASSWORD);
      $password = sha1($salt1.$password.$salt2);
  
  
      //if there are input validations redirect back to main page
      if($errflag) {
          $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
          session_write_close();
          header("location: reset-admin-password-form.php");
          exit();
      }
  
      $qry = "        UPDATE  admins
                      SET password    =   '$password'
                      WHERE   randkey     =   '$code'
                                      AND     username        =       '$username'";
  
      $result = mysql_query($qry);
  
      if($result) {
          echo $result;
          //header("location: reset-admin-password-success.php");
          exit();
      }else {
          die(mysql_error());
  
      }
  
  ?&gt;
  </code></pre>
  
  <p>All of my validations work and it will redirect if any fields are empty or if the passwords do not match. However, the query will still work if the <code>code</code> field does not match the <code>randkey</code> field in my table. I have tried putting <code>randkeys</code> as the field to ensure it fails, which it does. </p>
  
  <p>When I echo out the <code>$qry</code> I get this: <code>UPDATE admins SET    password   =   'b978ac7c458d65ca31c02eb4e7dabd9aa6a8e235' WHERE    randkey  =  'CHLVQ6vfq' AND  username   =   'user.name'</code></p>
  
  <p>Can anyone help me out with this?</p>