Solved

How can I use unencrypted password in mail() function

Posted on 2009-07-08
13
253 Views
Last Modified: 2012-05-07
I have set up a script to fetch the username and password from the database and pass it to an email -- confirmation of registration.
The problem is this....
I have successfully saved the unencrypted password into a $_SESSION variable fine.
I want to pull it out of the $_SESSION variable and send it to a variable so that the unencrypted password shows in the email, instead of the encrypted one.  Right now, all I see is the MP5 encrypted password.
Any ideas?
THANKS SO MUCH!
0
Comment
Question by:digigirl1124
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 5
13 Comments
 
LVL 19

Expert Comment

by:Michael701
ID: 24810049
you should be able to reference it by $_SESSION['password'] (or whatever name you assigned it)

Remember $_SESSION variables are not available until the NEXT page load. Are you trying to set and use the $_SESSION['password'] in the same page?
0
 

Author Comment

by:digigirl1124
ID: 24810203
Michael, thanks for responding so quickly!!
Below is the code.  What I am I doing wrong?

//processing page #1, processes the username and password (Registration page form)
//I have this code at the end of the form processing page:

if(isset($_POST['submit']))
{
//This makes sure they did not leave any fields blank  
    if(empty($_POST['d_email']) | empty($_POST['d_pass']) | empty($_POST['dpassword_confirm']))
    {
            die('Please complete all of the required fields. Use your [Back] button to return and try again.');
    }
    // checks if the username is in use
    if (!get_magic_quotes_gpc())
    {
      $_POST['d_email'] = addslashes($_POST['d_email']);
      }
      $usercheck = $_POST['d_email'];
      $check = mysql_query("SELECT d_email FROM dealer_user WHERE d_email = '$usercheck'")
      or die(mysql_error());
      $check2 = mysql_num_rows($check);
      //if the name exists it gives an error
      if ($check2 != 0)
      {
      die('Sorry, the Email '.$_POST['d_email'].' is already in use. Use your [Back] button to return and try again!');
      }
      // this makes sure both passwords entered match
      if ($_POST['d_pass'] != $_POST['dpassword_confirm'])
      {
      die('Your passwords did not match. Use your [Back] button to return and try again! ');
      }
    // *************check e-mail format**OK******************
      if (!preg_match("/.*@.*..*/", $_POST['d_email']) | preg_match("/(<|>)/", $_POST['d_email']))
      {
      die('Invalid e-mail address.');
      }
   
    //SET COOKIE
      $_POST['d_email'] = stripslashes($_POST['d_email']);
      $_POST['d_pass'] = stripslashes($_POST['d_pass']);
      $hour = time() + 0;
      //SET TO EXPIRE WHEN BROWSER IS CLOSED at 0 closed or 3600 for 1 hour
      setcookie(BBBeCookie, $_POST['d_email'], $hour, '/', '.badboydealerportal.com');
      setcookie(BBBpCookie, $_POST['d_pass'], $hour, '/', '.badboydealerportal.com');
   // SET SESSION VARIABLES
    $_SESSION['d_email'] =  $_POST['d_email'];  
      $_SESSION['d_pass'] =  $_POST['d_pass'];
    // here we encrypt the password and add slashes if needed
      $_POST['d_pass'] = md5($_POST['d_pass']);
      if (!get_magic_quotes_gpc())
      {
      $_POST['d_pass'] = addslashes($_POST['d_pass']);
      $_POST['d_email'] = addslashes($_POST['d_email']);
      }
     
 /* INSERT INTO DATABASE NOW, INSTEAD OF HOLD THE VARIABLES IN THE SESSION VARIABLES AND WAIT TO POST THEM ON THE NEXT PAGE ****************/
    /*now we insert it into the database ********OK**********/
      $insert = "INSERT INTO dealer_user (d_email, d_pass, signup_date, trackerID) VALUES ('".$_POST['d_email']."', '". $_POST['d_pass']."', now(), '".$_SESSION['trackerID']."')";
      $addNewDealer = mysql_query($insert);
      if (!$addNewDealer)
        {
        echo 'There has been a database error. Please contact the webmaster.' . mysql_error();
        }
        else
        {
        /****THIS SETS THE dealer_id auto increment # to trackerID and is saved to database*****
    $dealer_id = mysql_insert_id(); //this would be the dealer_id autoincremented for this dealer row
    $_SESSION['trackerID'] = $dealer_id;
        }
        session_write_close();
        echo header("Location: Register2.php" );
        /**********************************/
 }
As you can see I saved the password to the Session variable before it was encrypted and it shows fine in the print_r function as the non-encrypted password.

Then on the next page, the user enters other Registration information (contact info)
The session variables are passed from page to page correctly.

This form is then processed with processRegister2.php
On this processing page, once the user enters all of his/her information, an email confirmation is sent.
I want to be able to pull the $_SESSION [password] and make it = to a $variable to be used in the mail() function, instead of pulling the encrypted password from the database.
Is this possible?? Can you pass Session variables into functions?
THANKS SO MUCH!!
0
 
LVL 19

Expert Comment

by:Michael701
ID: 24810489
can i ask if you missed the obvious?

it's not called $_SESSION['password'], but $_SESSION['d_pass']

you should be able to use

$email_message = "Your password is ".$_SESSION['d_pass'];
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:digigirl1124
ID: 24810566
Yes, I have it as d_pass!  Thank you for noticing this.  I just used password as a reference.

...instead of putting it directly into the mail function, ($email_message = "Your password is ".$_SESSION['d_pass'];) I want to set it as a $variable to pass to the mail function.
If I want to use a variable in the mail function like this:

$dname = $rowName["name"];
$varFrom = "warrantyrequest@company.com";
$emailTo1 = $rowEmail["d_email"];
$emailTo2 = "myname@gmail.com";  //copy of email
//THIS PASSWORD IS THE ENCRYPTED PASSWORD ---------- NEED TO FIX THIS *****************
$pass1 = $rowPass["d_pass"];
$varTo = "$emailTo1 , $emailTo2";
$varSubject = "Dealer Registration";
$msgBody.......... etc...
-
-
$mailsend = mail($varTo, $varSubject, $msgBody, $varMailHeader);
================

My Question is: How should it be structured?:  The mail() function requires "" double quotes for some reason.  The single quotes do not work in mail() for the variables listed above.!

$pass1 =  "$_SESSION['d_pass']"; (double quotes outside and single inside curly brackets)
OR
$pass1 = "$_SESSION[d_pass]; (double quotes outside and no quotes inside brackets)
OR
$pass1 = "{$_SESSION['d_pass']}"; (single quotes inside brackets and double outside curly braces - or double inside curly braces)
or.....???

this always confuses me!!

Thank you so much!!!
-digi
0
 
LVL 19

Expert Comment

by:Michael701
ID: 24810569
$pass1 = $_SESSION['d_pass'];
0
 

Author Comment

by:digigirl1124
ID: 24810827
Thank you!!  I will try this..
just curious about one thing... why is it the only one in the list with single quotes?
the others in mail() require double quotes?

Again!! Thank you!!!
0
 
LVL 19

Expert Comment

by:Michael701
ID: 24811025
Single or double shouldn't matter in that case. I personally use single.

double quotes do have some special meaning.

$variable_a = "World.";

echo "Hello ".$variable_a." This is fun.";
// Hello World. This is fun.

// when double quotes are used php will look inside for variable names.
echo "Hello $variable_a This is fun.";
// Hello World. This is fun.

// not so when single quotes are used.
echo 'Hello $variable_a This is fun.';
// Hello $variable_a This is fun.
0
 

Author Comment

by:digigirl1124
ID: 24811043
$pass1 = $_SESSION['d_pass']; with single quotes inside the brackets did not work!!

Using the mail() function is crazy!!
I have spent days trying to figure how how to set this up so it would work properly on a Windows Server.  I saw example after example of how it did work... but it does not work on the server I am using with IIS7.  

I have also tried "$_SESSION[d_pass]"; (phpadmin shows an error if single quotes are used inside [ ] with this example)

I have also tried $_SESSION["d_email"]; but  none of these work to pass it to the mail function.

I know the session variable is available, because I use the print_r function at the top of each page to test it and it is showing up fine.  That is how I know it is not encrypted.

Any other suggestions?
 THANKS AGAIN!!!
0
 

Author Comment

by:digigirl1124
ID: 24811054
This is the email message I receivet... without the password -- all of the other variables pass through using double quotes (as shown above in the 4th post)

Dear: anna@tech.com at Tech.com
Thank you for registering for an account with our Dealer Portal!
To activate your membership, please go to:
http://www.companyname.com to Log In
Once you Login, your account will activate.
Your Email is  :  anna@tech.com
- Hide quoted text -
Your Password is:
Thank You!
0
 

Author Comment

by:digigirl1124
ID: 24811167
BELOW IS THE BODY OF THE EMAIL.  I even tried putting the Session Variable sentence within the message body and it DOES NOT WORK!!!  so frustrating!!!

$msgBody .= "Thank you for registering for an account with our Dealer Portal!"."\r\n";
$msgBody .= "To activate your membership, please go to:" ."\r\n";
$msgBody .= "http://www.companyname.com to Log In" ."\r\n";
$msgBody .= "Once you Login, your account will activate." ."\r\n";
$msgBody .= "Your Email is  :  " .$emailTo1."\r\n";
$msgBody .= "Your Password is:" .$pass1. "\r\n";
$msgBody .= "Your password is ".$_SESSION['d_pass']."\r\n";
$msgBody .= "Thank You! " ."\r\n";

There has got to be a way to make this work!!!  All of the other variables pass ok, except the Session variable!!!  Any suggestions???
Thank you so much for your patience!!!
0
 

Author Comment

by:digigirl1124
ID: 24813475
I decided to put all of the information into one form and then send the email and it works fine.  I hate that I had to cram it into one reg form, but it works, so be it!!  The unencrypted password now passes from the registration page, to the registration process page, and then to the mail script.  Now, I get the "real" password in the email, instead of the encrypted one!!!  Yeah!!!!
0
 
LVL 19

Expert Comment

by:Michael701
ID: 24814295
paste the output (session data) from the print_r  command? this is odd, if it's available there then it should be available in $_SESSION
0
 

Accepted Solution

by:
digigirl1124 earned 0 total points
ID: 24819172
Yea, tell me about odd!!  Everything I have done with PHP / IIS7 has been odd, to say the least!!  I have spent hours, weeks, on this and nothing I did would pass the session variables to the mail client.  In fact, the only session variables that pass from page to page are the ones called directly after an insert-into, no matter what!  However, now, that they are all on ONE coded page, insert-into using two different tables, I can call the session variables and passs them however I like.  not sure what the problem is, but this works, so that's what we're going to have to do for now.
Thank you for trying!!
Not sure what the answer is, but maybe someone else has this same challenge and can tell us!
- digi
0

Featured Post

SharePoint Admin?

Enable Your Employees To Focus On The Core With Intuitive Onscreen Guidance That is With You At The Moment of Need.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Developers of all skill levels should learn to use current best practices when developing websites. However many developers, new and old, fall into the trap of using deprecated features because this is what so many tutorials and books tell them to u…
Part of the Global Positioning System A geocode (https://developers.google.com/maps/documentation/geocoding/) is the major subset of a GPS coordinate (http://en.wikipedia.org/wiki/Global_Positioning_System), the other parts being the altitude and t…
Learn the basics of strings in Python: declaration, operations, indices, and slicing. Strings are declared with quotations; for example: s = "string": Strings are immutable.: Strings may be concatenated or multiplied using the addition and multiplic…
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question