Easy Password: Coders Please read.

[noj75]

Hi all,

I have nothing but problems on my board with people using the default Lost Password system and then emailing me as it has not worked.

I therefor wrote the following script to make my life a little simpler.

If there are any professional coders amongst you that would like to review and critique this script I would very much appreciate your view as I am by no means a pro. I am just a person interested in PHP.

PHP Code:

I HAVE REMOVED THE CODE 


I have tested this script and it is running fine.

Your views are appreciated.

Kind regards

[Marco van Herwaarden]

This script is very insecure and is vulnerable to SQL-Injections. Please see our articles section on how to write secure scripts.

PS Why would the default recover password not work?

[noj75]

Hi Marco,

Thanks for the prompt reply.

My default system either defaults the user to the login page or does not recognise the password that is sent in the email.

P.S. Any pointers on making this script more secure? Would appreciate your input.

Regards

[Dismounted]

Why not try fixing the current system? Try disabling any modifications running.

[Marco van Herwaarden]

Please provide a link to your board so i can see what is going wrong with the default system.

P.S. Any pointers on making this script more secure? Would appreciate your input.

See the articles on writing secure modifications in our articles section.

[noj75]

Originally Posted by Marco van Herwaarden

Please provide a link to your board so i can see what is going wrong with the default system.

See the articles on writing secure modifications in our articles section.

Sent you a PM Marco

--------------- Added [DATE]1217425598[/DATE] at [TIME]1217425598[/TIME] ---------------

Does this improve things?

PHP Code:

I HAVE REMOVED THE CODE 


Regards

[Marco van Herwaarden]

I have tested the (default vBulletin) lost password feature on your site, and i had no problem at all getting a new password. You might want to delete the account created for testing: vBTest

Also i suggest that you remove your own script (really remove from disk) ASAP as it is very insecure and could very easily be used to destroy your database or such.

[noj75]

Well, thats strange. It did not work for me this morning, but it does now?

I have though, taken your advice and removed the script from my server. Thank you very much for the advice Marco, very much appreciated.

Kindest regards