How can I use unencrypted password in mail() function

Posted on 2009-07-08
Last Modified: 2012-05-07
I have set up a script to fetch the username and password from the database and pass it to an email -- confirmation of registration.
The problem is this....
I have successfully saved the unencrypted password into a $_SESSION variable fine.
I want to pull it out of the $_SESSION variable and send it to a variable so that the unencrypted password shows in the email, instead of the encrypted one.  Right now, all I see is the MP5 encrypted password.
Any ideas?
Question by:digigirl1124
  • 8
  • 5
LVL 19

Expert Comment

ID: 24810049
you should be able to reference it by $_SESSION['password'] (or whatever name you assigned it)

Remember $_SESSION variables are not available until the NEXT page load. Are you trying to set and use the $_SESSION['password'] in the same page?

Author Comment

ID: 24810203
Michael, thanks for responding so quickly!!
Below is the code.  What I am I doing wrong?

//processing page #1, processes the username and password (Registration page form)
//I have this code at the end of the form processing page:

//This makes sure they did not leave any fields blank  
    if(empty($_POST['d_email']) | empty($_POST['d_pass']) | empty($_POST['dpassword_confirm']))
            die('Please complete all of the required fields. Use your [Back] button to return and try again.');
    // checks if the username is in use
    if (!get_magic_quotes_gpc())
      $_POST['d_email'] = addslashes($_POST['d_email']);
      $usercheck = $_POST['d_email'];
      $check = mysql_query("SELECT d_email FROM dealer_user WHERE d_email = '$usercheck'")
      or die(mysql_error());
      $check2 = mysql_num_rows($check);
      //if the name exists it gives an error
      if ($check2 != 0)
      die('Sorry, the Email '.$_POST['d_email'].' is already in use. Use your [Back] button to return and try again!');
      // this makes sure both passwords entered match
      if ($_POST['d_pass'] != $_POST['dpassword_confirm'])
      die('Your passwords did not match. Use your [Back] button to return and try again! ');
    // *************check e-mail format**OK******************
      if (!preg_match("/.*@.*..*/", $_POST['d_email']) | preg_match("/(<|>)/", $_POST['d_email']))
      die('Invalid e-mail address.');
      $_POST['d_email'] = stripslashes($_POST['d_email']);
      $_POST['d_pass'] = stripslashes($_POST['d_pass']);
      $hour = time() + 0;
      //SET TO EXPIRE WHEN BROWSER IS CLOSED at 0 closed or 3600 for 1 hour
      setcookie(BBBeCookie, $_POST['d_email'], $hour, '/', '');
      setcookie(BBBpCookie, $_POST['d_pass'], $hour, '/', '');
    $_SESSION['d_email'] =  $_POST['d_email'];  
      $_SESSION['d_pass'] =  $_POST['d_pass'];
    // here we encrypt the password and add slashes if needed
      $_POST['d_pass'] = md5($_POST['d_pass']);
      if (!get_magic_quotes_gpc())
      $_POST['d_pass'] = addslashes($_POST['d_pass']);
      $_POST['d_email'] = addslashes($_POST['d_email']);
    /*now we insert it into the database ********OK**********/
      $insert = "INSERT INTO dealer_user (d_email, d_pass, signup_date, trackerID) VALUES ('".$_POST['d_email']."', '". $_POST['d_pass']."', now(), '".$_SESSION['trackerID']."')";
      $addNewDealer = mysql_query($insert);
      if (!$addNewDealer)
        echo 'There has been a database error. Please contact the webmaster.' . mysql_error();
        /****THIS SETS THE dealer_id auto increment # to trackerID and is saved to database*****
    $dealer_id = mysql_insert_id(); //this would be the dealer_id autoincremented for this dealer row
    $_SESSION['trackerID'] = $dealer_id;
        echo header("Location: Register2.php" );
As you can see I saved the password to the Session variable before it was encrypted and it shows fine in the print_r function as the non-encrypted password.

Then on the next page, the user enters other Registration information (contact info)
The session variables are passed from page to page correctly.

This form is then processed with processRegister2.php
On this processing page, once the user enters all of his/her information, an email confirmation is sent.
I want to be able to pull the $_SESSION [password] and make it = to a $variable to be used in the mail() function, instead of pulling the encrypted password from the database.
Is this possible?? Can you pass Session variables into functions?
LVL 19

Expert Comment

ID: 24810489
can i ask if you missed the obvious?

it's not called $_SESSION['password'], but $_SESSION['d_pass']

you should be able to use

$email_message = "Your password is ".$_SESSION['d_pass'];

Author Comment

ID: 24810566
Yes, I have it as d_pass!  Thank you for noticing this.  I just used password as a reference.

...instead of putting it directly into the mail function, ($email_message = "Your password is ".$_SESSION['d_pass'];) I want to set it as a $variable to pass to the mail function.
If I want to use a variable in the mail function like this:

$dname = $rowName["name"];
$varFrom = "";
$emailTo1 = $rowEmail["d_email"];
$emailTo2 = "";  //copy of email
$pass1 = $rowPass["d_pass"];
$varTo = "$emailTo1 , $emailTo2";
$varSubject = "Dealer Registration";
$msgBody.......... etc...
$mailsend = mail($varTo, $varSubject, $msgBody, $varMailHeader);

My Question is: How should it be structured?:  The mail() function requires "" double quotes for some reason.  The single quotes do not work in mail() for the variables listed above.!

$pass1 =  "$_SESSION['d_pass']"; (double quotes outside and single inside curly brackets)
$pass1 = "$_SESSION[d_pass]; (double quotes outside and no quotes inside brackets)
$pass1 = "{$_SESSION['d_pass']}"; (single quotes inside brackets and double outside curly braces - or double inside curly braces)

this always confuses me!!

Thank you so much!!!
LVL 19

Expert Comment

ID: 24810569
$pass1 = $_SESSION['d_pass'];

Author Comment

ID: 24810827
Thank you!!  I will try this..
just curious about one thing... why is it the only one in the list with single quotes?
the others in mail() require double quotes?

Again!! Thank you!!!
DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

LVL 19

Expert Comment

ID: 24811025
Single or double shouldn't matter in that case. I personally use single.

double quotes do have some special meaning.

$variable_a = "World.";

echo "Hello ".$variable_a." This is fun.";
// Hello World. This is fun.

// when double quotes are used php will look inside for variable names.
echo "Hello $variable_a This is fun.";
// Hello World. This is fun.

// not so when single quotes are used.
echo 'Hello $variable_a This is fun.';
// Hello $variable_a This is fun.

Author Comment

ID: 24811043
$pass1 = $_SESSION['d_pass']; with single quotes inside the brackets did not work!!

Using the mail() function is crazy!!
I have spent days trying to figure how how to set this up so it would work properly on a Windows Server.  I saw example after example of how it did work... but it does not work on the server I am using with IIS7.  

I have also tried "$_SESSION[d_pass]"; (phpadmin shows an error if single quotes are used inside [ ] with this example)

I have also tried $_SESSION["d_email"]; but  none of these work to pass it to the mail function.

I know the session variable is available, because I use the print_r function at the top of each page to test it and it is showing up fine.  That is how I know it is not encrypted.

Any other suggestions?

Author Comment

ID: 24811054
This is the email message I receivet... without the password -- all of the other variables pass through using double quotes (as shown above in the 4th post)

Dear: at
Thank you for registering for an account with our Dealer Portal!
To activate your membership, please go to: to Log In
Once you Login, your account will activate.
Your Email is  :
- Hide quoted text -
Your Password is:
Thank You!

Author Comment

ID: 24811167
BELOW IS THE BODY OF THE EMAIL.  I even tried putting the Session Variable sentence within the message body and it DOES NOT WORK!!!  so frustrating!!!

$msgBody .= "Thank you for registering for an account with our Dealer Portal!"."\r\n";
$msgBody .= "To activate your membership, please go to:" ."\r\n";
$msgBody .= " to Log In" ."\r\n";
$msgBody .= "Once you Login, your account will activate." ."\r\n";
$msgBody .= "Your Email is  :  " .$emailTo1."\r\n";
$msgBody .= "Your Password is:" .$pass1. "\r\n";
$msgBody .= "Your password is ".$_SESSION['d_pass']."\r\n";
$msgBody .= "Thank You! " ."\r\n";

There has got to be a way to make this work!!!  All of the other variables pass ok, except the Session variable!!!  Any suggestions???
Thank you so much for your patience!!!

Author Comment

ID: 24813475
I decided to put all of the information into one form and then send the email and it works fine.  I hate that I had to cram it into one reg form, but it works, so be it!!  The unencrypted password now passes from the registration page, to the registration process page, and then to the mail script.  Now, I get the "real" password in the email, instead of the encrypted one!!!  Yeah!!!!
LVL 19

Expert Comment

ID: 24814295
paste the output (session data) from the print_r  command? this is odd, if it's available there then it should be available in $_SESSION

Accepted Solution

digigirl1124 earned 0 total points
ID: 24819172
Yea, tell me about odd!!  Everything I have done with PHP / IIS7 has been odd, to say the least!!  I have spent hours, weeks, on this and nothing I did would pass the session variables to the mail client.  In fact, the only session variables that pass from page to page are the ones called directly after an insert-into, no matter what!  However, now, that they are all on ONE coded page, insert-into using two different tables, I can call the session variables and passs them however I like.  not sure what the problem is, but this works, so that's what we're going to have to do for now.
Thank you for trying!!
Not sure what the answer is, but maybe someone else has this same challenge and can tell us!
- digi

Featured Post

3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Popularity Can Be Measured Sometimes we deal with questions of popularity, and we need a way to collect opinions from our clients.  This article shows a simple teaching example of how we might elect a favorite color by letting our clients vote for …
Things That Drive Us Nuts Have you noticed the use of the reCaptcha feature at EE and other web sites?  It wants you to read and retype something that looks like this.Insanity!  It's not EE's fault - that's just the way reCaptcha works.  But it is …
Learn the basics of lists in Python. Lists, as their name suggests, are a means for ordering and storing values. : Lists are declared using brackets; for example: t = [1, 2, 3]: Lists may contain a mix of data types; for example: t = ['string', 1, T…
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now