PHP Password Reset by Email

[@dave-hollingworth]

This is part 2. Part 1 is here: Signup and Login with PHP and MySQL: ‣ kzbin.info/www/bejne/a32chpuFo9qiqZI and part 3 is here: PHP Account Activation by Email: ‣ kzbin.info/www/bejne/oXSTcnyfpZx1rdk

[@WasifAnton]

Working on my final project and now I added this option to my project, thank you very much

[@momohezekieltrump6835]

Who else has waited for this?

[@lucascampos4237]

dave is the best of all times in php. His api course is AMAZING. the explanations are beyound the language, you learn the concepts and how implement it in practice

[@dipeshsaw]

Thank You very much for the nice tutorial, I learn something new today

[@dave-hollingworth]

What other related functionality would you like to see? Coming soon - account activation by email!

[@sujalkhatiwada2267]

Maybe a real-life project with clean coding, using API?

[@ahooton]

Hi Dave, great content! I recently decided to progress to learning Laravel and wondered if this was something you have any experience with, or were planning to cover in the future? Love your courses by the way! Cheers, Adam

[@zmOe1]

please show how to do this exactly with the env file to store the sensitive data externally

[@dave-hollingworth]

@@ahooton Thank you! I will do some Laravel tutorials at some point in the future, yes

[@dave-hollingworth]

@@zmOe1 I just published this: kzbin.info/www/bejne/gmaoY3uJfdd3oNk

[@ayodeleadeynka4195]

You are indeed a great teacher Dave

[@MohamadWyatt]

Very good php man

[@batchrocketproject4720]

Thanks, really clear coverage of a fairly complex process. 👍

[@samnako]

Thank you Dave, I've had frustrations looking for a way out with doing secured password recovery/ reset

[@NedumEze]

Shear PHP Coding Wizardry. Deep appreciation, sir. Wishing that you would make a video on the things to do to make a website scalable.

[@1PostWise]

Very much enjoying your tutorials. I am not understanding how/where to add the on-page client-side validation as was done on the process signup page mentioned at 19:08.

[@dave-hollingworth]

What exactly is your problem? Do you get any errors?

[@1PostWise]

​@@dave-hollingworth I would like to add the server side validation, like you did to signup.html, to forgot-password php. I added the "Just Validate" script and the validation js file. I also added id=signup at the beginning of form, but I don't get any validation errors and the form will not process. I suspect what I am doing wrong is obvious, but just not to me :)

[@dave-hollingworth]

@1PostWise Try looking in the browser developer tools in the js console or the network tab to see if there are any errors there

[@AbhishekBade1310]

your vid has really helped me a lot in making a good proj. and also thank you for keeping your code free to use

[@SargonsEye]

Nice explanation, understood instantly, thanks. Suscribed.

[@aloalo-ss5vl]

Living treasure Thank you for the great work

[@miguelangelperezsantiago783]

Thank you very much Sr. ¡I apreciate all your knowledge!

[@slicetv4279]

Thank you very much. God bless you.

[@tanaht23]

Thank you 😇

[@hongpair]

Thank you so much sire always love Your coding and the simple syntax you use to teach special greetings ❤❤❤❤❤

[@venomtv9066]

On the mail.php page, specify in the SMTP settings configuration, what is meant by email and password? Is it the one that belongs to the personal gmail, and what is the account added to the host? Please respond as soon as possible.

[@dave-hollingworth]

The email and password are the ones you use to authenticate with the SMTP server. In the case of Gmail, this would be your full Gmail address and application password (you have to create a specific application password to use the Gmail SMTP server)

[@sarabibrahim8312]

Can you add a video for creating admin roles Like adding super admin and admin please

[@WhiskerWhim]

great tutorial thanks :)

[@martingronek4813]

really great content, thank you for that. It may be a stupid question but wouldn't it be easier to send the user to the sign-up page and skip the check if the email is already taken? (or just delete the user and let him sign up again)

[@dave-hollingworth]

You could do, but the signup page is more complex than the password reset page, requiring more fields, more validation etc. so it's easier to let them reset their password by just supplying their email. As for deleting the user and letting them sign up again, yes you could do that, but that would require you to do that. Letting the user reset their own password requires no intervention on your part. (much better if you have many users!)

[@frankkaundamukhuni]

Thanks for your knowledge and your code I used them in signups and they worked for me perfect. And when are you planning to record a tutorial on how to create avater image

[@ninjaGhost34786]

bro plz tell me didi the domains worked correctly

[@pavelivanov-bd3sf]

Such situation I made the reset password structure by your video, the main problem that google account now vanished the opportunity to make less app secure in google/account/security, out there I made password app in 2 factor authentication and use it in my project, but, have been always when try to reset the password, have the same error *SMTP Error: Could not authenticate* , someone speaks it point on incorrect credentials, however, credentials fine 100%, someone speak the structure of the project now does not fit for google requirements and therefore we have always the error, someone know how to resolve it? as long as someone have faced with the same issue ?

[@robertosintos8844]

same

[@ackinito]

Great content David, part 3 with 2FA with option to enable or disable it?

[@AbhishekBade1310]

could you please make a video on search algo like in a social media website where we can find people to connect with?

[@slamanaim1837]

really you are good

[@jamestrey3049]

13:39 it appears: Message could not be sent. Mailer error: SMTP Error: Could not connect to SMTP host. Failed to connect to serverSMTP server error: Failed to connect to server Additional SMTP info: php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolutionMessage sent, please check your inbox. Can you guys please help me to fix this problem now? I extremely appreciate, thank you very much

[@jamestrey3049]

Message could not be sent. Mailer error: SMTP Error: Could not authenticate.

[@dave-hollingworth]

@@jamestrey3049This is an issue with the SMTP server hostname (e.g. smtp.example.com) or the authentication credentials (the username and password you use to connect to the server)

[@jamestrey3049]

@@dave-hollingworth Yes, I already changed its statement. But eventually It appears SMTP Error: Could not authenticate. Please help me

[@jamestrey3049]

Do you mean the password we use is the app password of Google?

[@dave-hollingworth]

@@jamestrey3049 If it's saying you could not authenticate, this is usually a problem with the username and password. If you're using Gmail, this will be your email address and application-specific password.

[@faridajepkosgei7066]

thank you so much .

[@bisdakhydroponics2732]

Thanks sir

[@parinthakkar752]

BEST!!

[@ademineshat]

Great as always 👍 I know videos are made so that they can be easy to understand but, Maybe It would be better and more practical, instead of using files and require them like: $var = require.....;, we can just create functions in one file and use them everywhere we need. 😊

[@dave-hollingworth]

Yes you're right. I try to avoid adding code that would distract from the lesson being taught in the video, so I keep it as simple as possible, but a different way to organise the code would be better as the codebase builds.

[@dwaynekeane3758]

I love his tutorials but he did it in his first video and I was a bit confused. $mysqli = require __DIR__ . "/database.php"; What does this mean. This variable is for the database connection in the databse.php file.

[@hamdikelil939]

i was able to update the token but when I click the link sent to the email, it keep says token not found

[@flaasher]

the PHP script may generate a token that already exists ...

[@manaskanrarwedigitalhub]

sir, please help my reset-password.php page not working mail massage click with example domain show

[@markkinnedyanda767]

Hello dave, i have a problem about your tutorial did you made some clarification or double checking the reset password?, because when i try to submit a form it didn't clarify the confirmation password neither if the password length was correct or have some numbers on it. Please i need to fix this issues.

[@dave-hollingworth]

Are you referring to the client-side or server-side validation?

[@markkinnedyanda767]

@@dave-hollingworth i already check the code its just i missed this ';" to insert. thank you for your tutorial I'm still learning about php. 😁

[@TestAccountEmail]

Thankyou for this tutorial I am learning in your videos but is there another way? PHP mailer doesnt work now if you use gmail cause google disabled the function less secure apps in gmail😕

[@dave-hollingworth]

Search for "smtp server" (there are free and paid ones available)

[@TestAccountEmail]

@@dave-hollingworth Im truly grateful for your assistance!

[@th3godfather64]

Which IDE are you using?

[@dave-hollingworth]

Visual Studio Code

[@pkkumar3415]

Sir please tell how to send email using codeigniter 3

[@donatellodonini3147]

I have a security question: What happens if an hacker ipotetically puts 0 as the password recovery token? Would the program recognise it as a valid recovery token and let the hacker change the password of the first entry of an user with a recovery token not set (set to null) or worse change the passwords of all the users with a recovery token not defined?

[@donatellodonini3147]

sorry in advance for the bad english

[@dave-hollingworth]

Good question - the user record is found based on the hash of the supplied token. If you hash "0", you still get a full hexadecimal string. So when the user record is searched for that matches that string, none will be found, and therefore none will be updated. So this shouldn't be a problem.

[@mohammedelhossiny]

Perfect ❤❤❤❤❤❤

[@projetistajunior6881]

Hello Dave. Everything works properly but the email, it doesn't create an hyperlink but instead write out the whole

[@dave-hollingworth]

You need to set the email format to HTML: $mail->isHTML(true);

[@projetistajunior6881]

@@dave-hollingworth Thanks brother it works fine now. 🤝

[@34_kabilan14]

The Hash Code also created on the php table.I have installed the phpmailer in the composer. But I cannot get the Vendor Folder and Autoload. Sir how can i get the vendor folder also autoload file

[@dave-hollingworth]

Make sure you ran the composer install command from the root folder

[@slamanaim1837]

please in reset-password. php i don't understand if we must put $token_hash in the place of ? in the query $sql="select * from user where reset_token_hash=?"; because i think ? will replace $_get['token'] and in the table user we store reset token hash and not the token help please just i want a clarification thx in advance

[@chainenaimslama1870]

i think this : $stmt->bind_param("s", $token_hash); in the script reset-password.php will put $token_hash in place of ? so because i don't know this ligne of code do you confirm me? thx in advance

[@jodhaniarpit8949]

Hii how to download vendor/autoload.php please give me link

[@dave-hollingworth]

This file is generated automatically when you install packages using Composer

[@flavoredtears3898]

@@dave-hollingworth im saving the same issue it didnt load in the vendor/autoload.php idk what to do here

[@dave-hollingworth]

@@flavoredtears3898 When you run the "composer install" command, it will create the vendor folder in the same folder you run it from - check the output of that command to make sure there were no errors

[@joshblank4579]

I am trying to reset the "reset_token_hash" and "reset_token_expires_at" to null after I successfully reset my password but the values are not turning null. I checked the database and the code and all were copied perfectly. Is there any idea on how to fix this?

[@dave-hollingworth]

Could it be that the database columns don't accept null values?

[@fgtoon2959]

amazing , if u can help upload photo and can edit it .please

[@jaybeedelacruz8279]

Why does mine display "Token not Found" even though the token is correct for the given URL?

[@dave-hollingworth]

Hard to say without seeing the code - try debugging by printing out the values of the $_GET variable etc. at different stages using var_dump

[@Marsden]

Mine is exactly the same, did you manage to fix this?

[@promango7745]

i got email has already taken on sign up but email doesnt taken

[@dave-hollingworth]

Please have a look at some of the other comments where people have had a similar problem and posted a solution

[@1623maz]

Message sent, please check your inbox. but not sending the message. What is the errors..?

[@dave-hollingworth]

Try adding this to your code before the redirect happens: $mail->SMTPDebug = 2; exit; This will show the debug errors from the SMTP server.

[@Riri-hh7ej]

how to set up composer?

[@dave-hollingworth]

Follow the instructions for your operating system here: getcomposer.org/doc/00-intro.md

[@charlemagnearispe3614]

I installed composer but it only downloads vendor/phpmailer without anything inside it

[@dave-hollingworth]

Check your file explorer isn't hiding certain files, and you have enough disk space. Also see if there were any error messages when you ran the Composer command

[@duhaylungsodsamroldan4202]

theres an error whenever i click the link on mail: Not Found The requested URL was not found on this server. Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.3.30 Server at localhost Port 80

[@dave-hollingworth]

Check the URL matches your hostname (e.g. localhost, example.com etc.) and the path to the file (/reset-password.php, or /subfolder/reset-password.php etc.) and the filename matches it

[@Marsden]

Hello, I've tried everything to get this to work however I'm struggling. I keep getting "token not found' after running the process-reset-password.php. I can confirm that the token is there, on the email and is being displayed in the "hidden" form when visible but still I get this error. I thought it might have been an issue with the hash, and so I have completely removed the hash and the checks for the hash, but I'm in the same boat. Can anyone help?

[@dave-hollingworth]

Try debugging by printing out the values of the token at various points, to see if it's getting lost somewhere. You can also compare your code to the code from the video in the repository.

[@baldryanebale8106]

Message could not be sent. Mailer error: SMTP Error: Could not authenticate. What is the problem?

[@dave-hollingworth]

Check the user and password you're using to authenticate with the SMTP server

[@Doyleur]

Getting the same error, as far as I know my username and password for the SMTP server is correct as well as the settings for the SMTP server. Can I ask what server you're using? Or if you fixed it?

[@baldryanebale8106]

@@Doyleur the same as on the video, but i didn't fix it :

[@dave-hollingworth]

@@Doyleur I use mailgun. You can always try the SMTP settings in a regular email client (e.g. Thunderbird) to see if they work there

[@q.m.vandersnoek3899]

Dear Dave, thank you so much for this tutorial. It is great. Very clear explanation and nice voice. I do have a problem. When I run your script on my computer, locolhost, everything works fine.But when I FTP it to my site I get an error. When I klick the send-button, i get: the page could not be processed. HTTP ERROR 500. When I choose another file, (forgotmail.php, ipv send-password-reset.php) it loads the page (forgotmail.php. When I paste the code from send-password.php insode forgotmail.php, iit does not work anymore. Can you understand this? Kind regards and thank you in advance

[@dave-hollingworth]

A 500 error means an error is occurring on the server - to see error details you need to add this to your code: ini_set('display_errors', 1); ini_set('display_startup_errors', 1); error_reporting(E_ALL); This will tell you where the error is occurring

[@q.m.vandersnoek3899]

​@@dave-hollingworth It was a problem with the authorisation ... problem solved. Now it works like charm. Thanks again Dave!

[@louieknowstech]

wheres the tutorial to set up smtp ?

[@dave-hollingworth]

kzbin.info/www/bejne/nHq8qpijprCFa5o

[@tv44-alternative23]

I'm now getting this "Message could not be sent. Mailer error: SMTP Error: Could not authenticate.Message sent, please check your inbox." Is it a firewall issue with smtp server?

[@rale3r]

Hello Dave. First, thanks for your lessons. They are great! For me, the reset-password.php file does not work on my domain, PHP version 7.4 Reports an error: Failed to load resource: the server responded with a status of 500 () An error occurs when executing this line: $stmt->bind_param('s', $token_hash);

[@dave-hollingworth]

PHP 7.4 no longer receives security updates, I recommend updating it as soon as you can. A 500 error is an error on the server - see this video on how to see the actual error message: kzbin.infot6KpIfHPFGw?feature=share

[@rale3r]

Thanks for your reply. It didn't help me. If I change the PhP version, then other things don't work for me. I am not familiar with PhP. The above error occurs when executing this line:> $result = $stmt->get_result();@@dave-hollingworth

[@rale3r]

Can you suggest an alternative method ?

[@sakuralee9800]

Hi sir, i tried and success to run it but after a month a open it got this error. can you help me please? Fatal error: Uncaught Error: Call to a member function setFrom() on int in C:\xampp\htdocs\fyp\send-password-reset.php:28 Stack trace: #0 {main} thrown forgot password

[@dave-hollingworth]

What is on that line of code? (line 28)

[@sakuralee9800]

I saw my smtp account is disabled restricted access just now, is it the issue why I got error?😮

[@sakuralee9800]

Hmm I write the code for u just now but I don't know why it didn't show here...

[@dave-hollingworth]

@@sakuralee9800 Try putting the code on something like pastebin and posting the URL here

[@sakuralee9800]

​@@dave-hollingworth I can fix it already, thank you sir 😁

[@sarabibrahim8312]

👏👏👏

[@bhaskar_veeraragavaneditz1891]

Where is Autoload.php

[@dave-hollingworth]

In the vendor folder

[@igu642]

❤❤

[@rafaelrodrigues-gq3mo]

Hi @dave-hollingworth. In the last step of the "process_reset_password" I'm comming across a following problem: Fatal error: Uncaught Error: Call to a member function bind_param() on bool in C:\xampp\htdocs\TCC\TCC\process-reset-password.php:39 Stack trace: #0 {main} thrown in. Could you help me to solve it out!?

[@dave-hollingworth]

This means $stmt contains false - check the SQL is valid

[@rafaelrodrigues-gq3mo]

@@dave-hollingworth thanks Dave, I’ve found the error 👍

[@slamanaim1837]

thx a lot all work well however the only problem for me is when i click on signup and i write name ,email,...and i click send always show me this message:email alreay taken although the email is not used so in this case i insert manually id,name,email..into the table user and i succeed to do all the other things. help please thx in advance

[@dave-hollingworth]

Try adding this line: mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

[@chainenaimslama1870]

@@dave-hollingworth you know i went to cafee and now i return to my laptop and i try again however in this all works well without adding anything thx very much best friend

[@davidsondavid4988]

please I am getting an error, Message could not be sent. Mailer error: SMTP Error: Could not authenticate. Massage sent, please check your inbox

[@dave-hollingworth]

Check the username and password you're using for your SMTP server

[@davidsondavid4988]

thanks you are the best@@dave-hollingworth

[@DoniaAhmedRizkMohamed]

Fatal error: Maximum execution time of 120 seconds exceeded in C:\xampp\htdocs\projects\test\template\demo\vendor\phpmailer\phpmailer\src\SMTP.php on line 1269

[@noone_fromwinterfell]

Hello dave, thank you for the great video however, It shows here that in my code Warning: Undefined array key "email" in C:\xampp\htdocs\dms\send-password-reset.php on line 3 pls help me

[@dave-hollingworth]

What code is on line 3?

[@user-fl5gu8pw4f]

send-password.php code its not working its not updating reset_token_hash and the reset_token_expires_at any help ?

[@dave-hollingworth]

Do you get any error messages? Try temporarily stopping the script before it redirects so you can see them

[@user-fl5gu8pw4f]

Thanks for your reply , i really appreciate your Code the problem was at the DB Connection yours is a Prepared statement mine was a Normal connection , what do u think Prepared Statement is more secure or both are good , also there was an bug at your Register Process the client can use someone elses data to register for example you forgot to prevent duplicated inserts :)@@dave-hollingworth

[@slamanaim1837]

please in reset-password. php i don't understand if we must put $token_hash in the place of ? in the query $sql="select * from user where reset_token_hash=?"; because i think ? will replace $_get['token'] and in the table user we store reset token hash and not the token help please just i want a clarification thx in advance