Indie-Resource.com

Code: Select all

/**
	* Generates a hash
	* @param $password password to hash
	* @return hashed password
	*/
	public function generateHash($password, $salt, $rounds = 12)
	{
		// return the password hash using crypt
		return crypt($password, sprintf('$2a$%02d$', $rounds) . $salt);
	}

	/**
	* Generates a random password
	* @return generated random password
	*/
	public function generateRandomPassword($length)
	{
		// list the characters valid in the salt
		$validcharacters = array_merge(range('A', 'Z'), range('a', 'z'), range('0', '9'), range('!', ')'));
		
		// repeat the loop 22 times cause the salt is 22 characters
		for($i = 0; $i < $length; $i++)
		{
			// generate the salt
			$password .= $validcharacters[array_rand($validcharacters)];
		}

		// return the new password
		return $password;
	}

/**
	* changes the users password 
	* @param $username username to check
	* @param $email user email tied to user
	* @return true if login is successful otherwise false
	*/
	public function resetPassword($username, $email)
	{
		// prepare the sql statement
		$statement = $this->db->prepare('SELECT salt FROM ' . TABLE_USERS . ' WHERE USERNAME = ? AND EMAIL = ? LIMIT 1');

		// bing the variables
		$statement->bind_param('ss', $username, $email);

		// if the statement executed successfully
		if ($statement->execute())
		{
			// get the number of results
			$statement->bind_result($resultsalt);

			// fetch the results
			$statement->fetch();

			// if a result exists
			if($resultsalt)
			{
				// generate a new password
				$password = $this->generateRandomPassword(10);

				// DEBUG
				echo "PASSWORD = $password<br />";

                // hash the password using the stored hash
                $passwordhash = $this->generateHash($password, $resultsalt);

				// DEBUG
				echo "PASSWORD HASH = $passwordhash<br />";

				// prepare the sql statement to change the password
				$statement = $this->db->prepare('UPDATE ' . TABLE_USER . ' SET PASSWORD = ? WHERE USERNAME = ? AND EMAIL = ? LIMIT 1');

				echo "STATEMENT = $statement<BR />";

				// bing the variables
				$statement->bind_param('sss', $passwordhash, $username, $email);

				// if the statement executed successfully
				if ($statement->execute())
				{
					// get the number of results
					$statement->bind_result($result);

					// fetch the results
					$statement->fetch();

					// if a result exists
					if($result)
					{
						echo "New Password: $password<br />";
						
						// return success
						return true;
					}
        		}
				else
				{
					// otherwise the query couldn't be run so return false
					return false;
				}
			}
		}
		else
		{
			// otherwise the query couldn't be run so return false
			return false;
		}
	}

Code: Select all

// prepare the sql statement to change the password
$statement = $this->db->prepare('UPDATE ' . TABLE_USER . ' SET PASSWORD = ? WHERE USERNAME = ? AND EMAIL = ? LIMIT 1');

Code: Select all

            $statement->bind_param('sss', $passwordhash, $username, $email);