I almost finished Pset7 but now I want to implement one of the extra's. I want to try to make a password forgotten section where you can answer your secret question and get an email with a link for resetting your password.

After adding my passwordreset.php to the config.php 'no-session-id' list I am able to get to the form where you can submit your username. But after submitting this username it redirects to login.php and I dont know why.

It doesn't seem to go to the "else if ($_SERVER["REQUEST_METHOD"] == "POST")" section at all.


    // configuration

    // if user reached page via GET (as by clicking a link or via redirect)
    // render password_reset
    render("passwordreset.php", ["title" => "Password Reset"]);

else if ($_SERVER["REQUEST_METHOD"] == "POST"){

    //check if username exists

    $rows = CS50::query("SELECT username, email, secret_question,     hash_secret_password FROM users");

    foreach($rows as $row){
        if ($row["username"] == $_POST["username"]){
    apologize("could not find username");


So the first part works (rendering the passwordreset.php) but after submitting it redirects to login.php.

Here is the config.php


 * config.php
 * Computer Science 50
 * Problem Set 7
 * Configures app.

// display errors, warnings, and notices
ini_set("display_errors", true);

// requirements

// CS50 Library
CS50::init(__DIR__ . "/../config.json");

 // enable sessions

// require authentication for all pages except /login.php, /logout.php, and /register.php /passwordreset.php /secret_question.php
if (!in_array($_SERVER["PHP_SELF"], ["/login.php", "/logout.php", "/register.php", "/passwordreset.php", "/secret_question.php"]))
    if (empty($_SESSION["id"]))


This is the passwordreset.php which is rendered correctly and is in views.

<form action="quote.php" method="post">
    <div class="form-group">
        <input autocomplete="off" autofocus class="form-control" name="username" placeholder="username" type="text"/>
    <div class="form-group">
        <button class="btn btn-default" type="submit">
            <span aria-hidden="true" class="glyphicon glyphicon-log-in"></span>

Does anybody has any idea why it redirects to login.php when request method = POST?

  • Can I see the code for passwordreset.php? – Ricardo David Antonetti Oct 20 '16 at 12:38
  • I added it! It's just a form where you can submit your username so the controller can get all the necessary data from the database. – Jorn Oct 20 '16 at 12:55
  • Thanks. By the way, I love the fact that the extra is a password reset feature but you went a step forward and made it with secret question and all! Inspiring! – Ricardo David Antonetti Oct 20 '16 at 13:06
  • thanks a lot! I hope it's gonna work. I'm now stuck on how I can make a difference between ($_SERVER["REQUEST_METHOD"] == "POST")from two different forms, rendered by the same controller. Any ideas? – Jorn Oct 20 '16 at 16:44
  • I don't know how the controller could know which form requested with post, but I have a hack idea. You could add a hidden input field with a value in both forms. Make their values different and check those first thing after else if ($_SERVER["REQUEST_METHOD"] == "POST"){ I think the hidden input field should look something like: <input type="hidden" name="country" value="Norway"> so you could do something like: <input type="hidden" name="form" value="one"> and <input type="hidden" name="form" value="two"> in the other one. I am running out of characters left. – Ricardo David Antonetti Oct 20 '16 at 17:01

I had this happening to me so many times. Your form's action is going to quote.php instead of the one you want.

<form action="quote.php" method="post">

I guess it should be something like

<form action="secret_question.php" method="post">
| improve this answer | |
  • yes of course! thanks a lot :) – Jorn Oct 20 '16 at 16:41

Since you render passwordreset.php, that implies it lives in views. So $_SERVER["PHP_SELF"] = "/views/passwordreset.php". This line if (!in_array($_SERVER["PHP_SELF"], ["/login.php", "/logout.php", "/register.php", "/passwordreset.php", "/secret_question.php"])) will evaluate to true. If $_SESSION["id"] is empty, it will redirect to login.php.

| improve this answer | |
  • Thanks for your answer. The strange thing is that the rendering itself goes well. And I use exactly the same set-up in register.php which renders register_form.php which is in views. And that all works. It is after submit/POST that it redirects to login.php instead of following the passwordreset controller php script.. – Jorn Oct 20 '16 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .