2012-01-14 49 views
2

我想知道是否有人可以幫助我。密碼重置鏈接有效日期

我一直在對「密碼重置」過程進行相當多的研究,並且從我發現的教程之一中,我已經能夠將以下代碼放在一起提供此功能。

忘記密碼

<?php 

// Connect to MySQL 
$c = mysql_connect("host", "user", "password"); 
mysql_select_db("database", $c); 

// Was the form submitted? 
if ($_POST["ForgotPasswordForm"]) 
{ 
    // Harvest submitted e-mail address 
    $emailaddress = mysql_real_escape_string($_POST["emailaddress"]); 

    // Check to see if a user exists with this e-mail 
    $userExists = mysql_fetch_assoc(mysql_query("SELECT `emailaddress` FROM `userdetails` WHERE `emailaddress` = '$emailaddress'")); 
    if ($userExists["emailaddress"]) 
    { 
       // Create a unique salt. This will never leave PHP unencrypted. 
       $salt = "KEY"; 

     // Create the unique user password reset key 
$password = md5($salt . $userExists["emailaddress"]); 


     // Create a url which we will direct them to reset their password 
     $pwrurl = "phpfile.php?q=" . $password; 

     // Mail them their key 
     $mailbody = "Dear user,\n\nIf this e-mail does not apply to you please ignore it. It appears that you have requested a password reset at our website \n\nTo reset your password, please click the link below. If you cannot click it, please paste it into your web browser's address bar.\n\n" . $pwrurl . "\n\nThanks,\nThe Administration"; 
     mail($userExists["emailaddress"], "", $mailbody); 
     echo "Your password recovery key has been sent to your e-mail address."; 
    } 
    else 
     echo "No user with that e-mail address exists."; 
} 

?> 

重置密碼

<?php 

// Connect to MySQL 
$c = mysql_connect("host", "user", "password"); 
mysql_select_db("database", $c); 

// Was the form submitted? 
if ($_POST["ResetPasswordForm"]) 
{ 
    // Gather the post data 
    $emailaddress = mysql_real_escape_string($_POST["emailaddress"]); 
    $password = md5(mysql_real_escape_string($_POST["password"])); 
    $confirmpassword = md5(mysql_real_escape_string($_POST["confirmpassword"])); 

    $q = $_POST["q"]; 

    $passwordhint = $_POST["passwordhint"]; 

    // Use the same salt from the forgot_password.php file 
    $salt = "KEY"; 

    // Generate the reset key 
    $resetkey = md5($salt . $emailaddress); 

    // Does the new reset key match the old one? 
    if ($resetkey == $q) 
    { 
     if ($password == $confirmpassword) 
     { 
      // Update the user's password 
      mysql_query("UPDATE `userdetails` SET `password` = '$password', `passwordhint` = '$passwordhint' WHERE `emailaddress` = '$emailaddress'"); 
      echo "Your password has been successfully reset."; 
     } 
     else 
      echo "Your password's do not match."; 
    } 
    else 
     echo "Your password reset key is invalid."; 
} 

?> 

現在,我想補充一點,我發送給用戶的鏈接的定時到期。我一直在看Stackoverflow社區和其他許多人的帖子,但我一直沒能找到我一直在尋找的東西。

我只是想知道是否有人可以幫助我,請給我一點指導,告訴我如何完成此任務。

非常感謝。

+0

你真的有*你的PHP文件中的數據庫連接數據? – ThiefMaster 2012-01-14 15:38:35

+0

嗨,不,我只是在我將腳本放在一起的時候使用它。然後他們被改變去處理一個文件。親切的問候 – IRHM 2012-01-14 16:37:37

回答

1

當請求密碼重置時,用時間戳添加字段到users表。 當您檢查密鑰是否匹配時,查看時間戳以查看它的年齡。

這是你的意思嗎?

+0

嗨,是的,這是我想要實現的。親切的問候 – IRHM 2012-01-14 16:38:41

0

我這樣做的方式是同時存儲您發送給用戶的散列值和從用戶表中生成時的時間戳。

當他們訪問重置頁面時,檢查它們對數據庫中的哈希值的哈希值,而不是再次生成哈希值(這樣做可以使用真正的隨機哈希值,因爲您不必記住它是如何創建的第一個地方),並檢查時間戳。

相關問題