PHP電子郵件更改腳本

Question

我試圖做一些小腳本在我的免費服務更改電子郵件。用戶註冊名稱，密碼等。我想要的是使用PHP腳本添加網頁表單，以便在數據庫中更改其電子郵件，這使得他們可以通過確認過程將其電子郵件更改爲舊電子郵件。它應該如何工作？

用戶進入一些網站（登錄到它）點擊更改電子郵件會有舊的電子郵件，NEWEMAIL並再次newemail2領域。將會檢查舊電子郵件是否真的是databse中的舊電子郵件，newemail與newemail2相同。我做了一些檢查電子郵件等這裏的有效性：

$login_db_new_connect = mysql_connect($logindb[db_host],$logindb[db_username],$logindb[db_password]); 
$selectdb = mysql_select_db($logindb[db_name],$login_db_new_connect); 
    if ($_GET[h] && $_GET[h] != '' && $_GET[h] != '0') 
    { 
     $emailz = $newemail1; 
     $query = mysql_query("SELECT username FROM `account` WHERE reset_email='$_GET[h]'"); 
     $res = mysql_fetch_array($query); 
     $check = mysql_query("SELECT email FROM `account` WHERE reset_email='$_GET[h]'"); 
     $ress = mysql_fetch_array($check); 
     $check1 = mysql_query("SELECT reset_email2 FROM `account` WHERE reset_email='$_GET[h]'"); 
     $resss = mysql_fetch_array($check1); 
     $emailz = $resss[reset_email2]; 

     if (mysql_num_rows($query) == 1) 
     { 
      echo "<b>E-mail was changed.</b>"; 
      $to = $ress[email]; 
      $headers = "Headers here"; 
      $message = "Email has been Changed (more text to come later)"; 
      mail($to, '', $message, $headers); 
      mysql_query("UPDATE account SET email='$emailz' WHERE reset_email='$_GET[h]'") or die ('query change ...'); 
      mysql_query("UPDATE account SET reset_email='', reset_email2='' WHERE username='$res[username]'") or die ('query ...'); 
     } 
     else 
     { 
      echo "<b>Error not changed.</b>";  
     } 
    } 
    else 
    { 
     $oldemail = addslashes($_POST["oldemail"]); 
     $newemail1 = addslashes($_POST["newemail1"]); 
     $newemail2 = addslashes($_POST["newemail2"]); 
     if ($oldemail == "" || $newemail1 == "" || $newemail2 == "") 
     { 
      $reason = " 
      <form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\"> 
      <table width=\"310\"> 
      <tr><td>Old e-mail:</td><td><input type=\"email\" name=\"oldemail\"></td></tr> 
      <tr><td>New e-mail:</td><td><input type=\"email\" name=\"newemail1\"></td></tr> 
      <tr><td>New e-mail again:</td><td><input type=\"email\" name=\"newemail2\"></td></tr> 
      <tr><td align=\"center\" colspan=\"2\"><br><input type=\"submit\" value=\"Change e-mail\"> 
      </table> 
      </form>"; 
     } 
     else 
     { 
      $login_db_new_connect = mysql_connect($logindb[db_host],$logindb[db_username],$logindb[db_password]); 
      $selectdb = mysql_select_db($logindb[db_name],$login_db_new_connect); 
      $queryy = mysql_query("SELECT username FROM `account` WHERE id='$id'"); 
      $resu = mysql_fetch_array($queryy); 
      $sql = "SELECT * FROM account WHERE email='$oldemail' AND username='$resu[username]'"; 
      $result = mysql_query($sql); 
      $result2 = mysql_num_rows($result); 

      if ($result2 !== 1) 
      { 
       $reason = "Something is wrong"; 
      } 
      else 
      { 
       if ($newemail1 == $newemail2) 
       { 
        $emailz = $newemail1;  
        $rand = random_string(40); 
        $sql1 = "UPDATE `account` SET reset_email='$rand' WHERE id='$id'"; 
        mysql_query($sql1) or die ('query ...'); 
        $sql2 = "UPDATE `account` SET reset_email2='$newemail1' WHERE id='$id'"; 
        mysql_query($sql2) or die ('query ...'); 
        $to = $_POST["oldemail"]; 
        $headers = ""; 
        $message = "Activation link: $config[path_to_thisfile]?h=$rand\n\n\n"; 
        mail($to, '', $message, $headers); 
        echo "<b>activation link has been sent</b>"; 
       } 
       else 
       {                     
        echo "<b>wrong input data</b>"; 
       } 
      } 
     } 
    } 
?> 

但是：

if ($auth->isLogged()) 
{ 
    if(!empty($email)) 
    { 
     if ($this->checkEmail($mail)) 
     {   
      $this->db->selectDb("login");    
      if (!mysql_result(mysql_query("SELECT COUNT(id) FROM account WHERE email='".$mail."'"), 0) > 0) 
      { 

我用PHP自身的功能，如這創造腳本 - 它使用PHP的改變與數據庫和網站的電子郵件在一個頁面上我希望有更多的檢查就像我上面提到的用於檢查電子郵件的完整性和驗證，檢查用戶是否在線...也許我的腳本不完全確定：d

所以我現在願意接受你的想法:)謝謝。

Answer 1

約使用電子郵件驗證，IM：

// returns TRUE if 'email' is valid 
function email_valid($email) 
{ 
    return eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email); 
} 

也可以考慮使用寫用戶的文本直接進入數據庫之前mysql_real_escape_string; 。 他們可能會在文本中有引號」，」

也有一個分貝爛攤子各地;考慮減少這類電話的安全性，如果可能的

還考慮將內嵌HTML塊，如：

$reason = " 
<form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\"> 
<table width=\"310\"> 

到其他文件，並呼籲他們喜歡：

include("template.php"); 

，以避免重複報價和減少未來的混亂