PHP密碼重置

Question

我一直在重寫舊密碼重設以幫助學習PHP。

我想知道是否有一些部分我應該續訂，因爲它仍然會出現錯誤。

if(isset($_POST['reset'])){ 
    $email = $_POST['email']; 

    $stmt=$conn->prepare("SELECT email FROM users WHERE email=:email"); 
    $stmt->execute(array("email"=>$email)); 
    $userRow=$stmt->fetchColumn(); 

    if($userRow == '0'){ 
     $error[] = 'Sorry, we cannot find your account details. Please try another email address.'; 
    }else{ 
     $stmt=$conn->prepare("SELECT lname FROM users WHERE email=:email"); 
     $stmt->execute(array(":email"=>$email)); 
     $userRow1=$stmt->fetch(PDO::FETCH_ASSOC); 

     //$userRow = PDO::FETCH_ASSOC($stmt); 
     $password = substr(md5(uniqid(rand(),1)),3,10); 
     $pass = md5($password); 

     $to = "$email"; 
     $subject = "ClientCheck Account Recovery"; 
     $body = "Hi, $userRow1 \n\n Your password has been reset. \n\n Your password now is: $password \n\n Kind regards\n ClientCheck"; 

     $additionalheaders = "From: <no-reply@clientcheck.co.uk>"; 
     $additionalheaders .= "Reply-To: no-reply@clientcheck.co.uk"; 

     $stmt=$conn("UPDATE users SET password=:password WHERE email-:email"); 
     $stmt->execute(array(":password"=>$password,":email"=>$email)); 
     $userRow2=$stmt->rowCount(); 
    } 
} 

if(!empty($error)){ 
    $i = '0'; 
    while($i < count($error)){ 
     echo "$error[$i]"; 
     $i ++; 
    } 
} 

Notice: Array to string conversion in /forgottenpassword.php on line 31
Fatal error: Function name must be a string in /forgottenpassword.php on line 36

我知道有發送的復位密碼

是不是在安全性方面的最好的一步，但是，我想獲得它的權利在這個水平，然後繼續前進，以更安全的解除方法。

Answer 1

兩行必須被校正，一個在變量$體是從PDO的結果陣列，並且其中在製備語句的行：

<?php 
if(isset($_POST['reset'])){ 
    $email = $_POST['email']; 

    $stmt=$conn->prepare("SELECT email FROM users WHERE email=:email"); 
    $stmt->execute(array("email"=>$email)); 
    $userRow=$stmt->fetchColumn(); 

    if($userRow == '0'){ 
     $error[] = 'Sorry, we cannot find your account details. Please try another email address.'; 
    }else{ 
     $stmt=$conn->prepare("SELECT lname FROM users WHERE email=:email"); 
     $stmt->execute(array(":email"=>$email)); 
     $userRow1=$stmt->fetch(PDO::FETCH_ASSOC); 

     //$userRow = PDO::FETCH_ASSOC($stmt); 
     $password = substr(md5(uniqid(rand(),1)),3,10); 
     $pass = md5($password); 

     $to = "$email"; 
     $subject = "ClientCheck Account Recovery"; 
     $body = "Hi, ".$userRow1['username']."\n\n Your password has been reset. \n\n Your password now is: $password \n\n Kind regards\n ClientCheck"; // changed here 

     $additionalheaders = "From: <no-reply@clientcheck.co.uk>"; 
     $additionalheaders .= "Reply-To: no-reply@clientcheck.co.uk"; 

     $stmt=$conn->prepare("UPDATE users SET password=:password WHERE email=:email"); // changed here 
     $stmt->execute(array(":password"=>$password,":email"=>$email)); 
     $userRow2=$stmt->rowCount(); 
    } 
} 

if(!empty($error)){ 
    $i = '0'; 
    while($i < count($error)){ 
     echo "$error[$i]"; 
     $i ++; 
    } 
} 

Answer 2

檢查該行

$stmt=$conn("UPDATE users SET password=:password WHERE email-:email"); 
                  ^// this should be equals.