在php中忘记密码页面

Question

I wanted to create a forgot password page. To avoid mailing the user with his details, I decided to display his details in an alert box, although I know that it is much less secure!

So, here's my code in the php file "forgotdetails.php".

//Here are my database details, which I can't show.

$conn= mysql_connect($dbhost, $dbuser, $dbpass);
    // Check connection

    if(!$conn){
        die('Could not connect'.mysql_error() );  
    }

    $db_selected = mysql_select_db('users');  

    if(!$db_selected){
        die('wrong'.mysql_error() );
    }



    $post_username = $_POST['email']; // the ajax post username


    $query = "SELECT * FROM users WHERE id='". $post_username. "'";
    $results= mysql_query($query);
    $row=mysql_fetch_assoc($results);
    $username=$row['id'];
    $password=$row['pass'];
    if(mysql_num_rows($results)==0)
    {
        echo "pass= " . $password;
        echo "You haven't registered yet! Go to the Home-Page to Register!";
    /*$query = "SELECT * FROM users WHERE id='$post_username' AND pass='$post_password'";*/

    }
    else
    {   
        echo $password;
    echo "Your Login details are-:"."
User ID- ". $username . "
Password- ". $password . "
Login to your account, to change your password. ";

    }

And here's my ajax function (inside the html file) which is getting called as the forgot password button is clicked-:

<script lang="javascript" type="text/javascript">


    function ajaxFunction1() {
        var ajaxRequest;  // The variable that makes Ajax possible!

        try {
            // Opera 8.0+, Firefox, Safari
            ajaxRequest = new XMLHttpRequest();
        } catch (e) {
            // Internet Explorer Browsers
            try {
                ajaxRequest = new ActiveXObject("Msxml2.XMLHTTP");
            } catch (e) {
                try {
                    ajaxRequest = new ActiveXObject("Microsoft.XMLHTTP");
                } catch (e) {
                    // Something went wrong
                    alert("Your browser broke!");
                    return false;
                }
            }
        }
        // Create a function that will receive data 
        // sent from the server and will update
        // div section in the same page.
            ajaxRequest.onreadystatechange = function () 
            { if (ajaxRequest.readyState == 4) 
                { var ajaxDisplay = document.getElementById('results'); 
                alert (ajaxRequest.responseText); 
                ajaxDisplay.innerHTML = "<br/><br/><h2><font color='#18E618'>"+ajaxRequest.responseText+"</font></h2>"; } }


        // Now get the value from user and pass it to
        // server script.
        var email = document.getElementById('email').value;
        //var bitsmailid = document.getElementById('bitsmailid').value;

        if ( email== "" ||  email== null ||  email== '') {

            alert("BITS ID Not Filled");

            exit();
        }
        /*if ( bitsmailid== "" ||  bitsmailid== null ||  bitsmailid== '') {

            alert("BITS Mail ID Not Filled");

            exit();
        }*/


        var queryString = "?email=" + email;
        ajaxRequest.open("POST", "forgotdetails.php" +queryString, true);

        ajaxRequest.send(null);
    }

</script>

My query is that, the I need to check whether the query returned through SQL in the PHP File ($results) is empty or not and then I need to perform the functions as i have mentioned in my code. I have used mysql_num_rows($results)==0 condition (which I got to know after reading similar posts on Stack Overflow). Although it doesn't seems to evaluate correctly. It evaluates true always, even though there are entries in the database.

I have read all the posts concerning this type of questions on Stack Overflow, and after 12+ hours of testing the code with many different possibilities, still I am still unable to solve my query. I have provided all the details necessary for my query, however If anyone needs anything, I will provide them with you.

I am a newbie into Web Development, so please help me to solve my query. Thank You in advance for your Help!

I am sorry if you feel that this question has already been answered earlier, however I posted this again because those posts sadly couldn't help me. I have read all of them. Sorry!

Answer 1

It should be

 $sql = "SELECT * FROM users WHERE id='". $post_username. "'";
 $result = mysql_query($sql, $conn);
 if ($result && (mysql_num_rows($result) > 0)) {
     // user exists
     // here you get row
     $row = mysql_fetch_assoc($result);
 }

I know it is without pdo and it is insecure.