Can mail() function b used with the pset7 code?

Question

i was playing with the code of pset7 and have edited it in such a way that during registration the user is asked to provide his email id and I am saving the email id and the original password that he typed in into a table. Then I have added a forgotten password page link into the login page where the user can type in his email and if its there in the db then I have used the mail function to mail him his original password.But on giving my working email id I am getting this error Fatal error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FROM users WHERE email = 'furrukh@hotmail\.com'' at line 1 in /home/ubuntu/workspace/project/wall/vendor/library50-php-5/CS50/CS50.php on line 352

I have two questions 1. Why am I getting this error and how to solve the issue?

2. If I somehow fix this have I implemented the mail function correctly and will I receive a mail with my password in it.

The relevant code is as follows

<?php

// configuration
require("../includes/config.php");

// check to see if user came via GET(by clicking a link)
if($_SERVER["REQUEST_METHOD"] == "GET")
{
    render("forgotpasswordform.php", ["title" => "Forgotten Password"]);
}
else if ($_SERVER["REQUEST_METHOD"] == "POST")
{
    if (empty($_POST["email"]))
    {
        apologize("You did not submitted a valid email");
    }

    //removing the dot with \.
    //$email = str_replace(".", "\.", $_POST["email"]);

    // check to see if email exsists in the db
    $rows = CS50:: query("SELECT FROM users WHERE email = ?", $_POST["email"]);



    if ($rows != 1)
    {
        apologize("The email you entered is not a registered email at the wall");
    }
    else
    {
        // mail the user his password
        $password = $rows[0]["originalpass"] ;
        $mailid = $rows[0]["email"];

        $subject = "Your password for The Wall";

        $message = "This is a auto generated message plz do not reply to it.\r\n Your password is {$password}";

        $message = wordwrap($message, 70, "\r\n");

        $header = "From: [email protected]";

        mail($mailid, $subject, $message, $header);

        redirect("/");

    }
}
// Added 4 spaces to include line in code block
?>

EDIT

the answer is very helpful, just one more thing how would I send a link thru php mailer?

$mail->Body = 
        "Reset your password at http://www.myweb.php?query =".$query;

or do I have to include a <a href> tag with in $mail ->Body to display it as a link in the mail?

Answer 1

To answer your second question: you cannot use the PHP mail() function to send mail from the CS50 IDE because Cloud 9 blocks outgoing SMTP traffic on port 25 by firewall policy, to prevent spammers from using free Cloud 9 accounts to broadcast unsolicited bulk email.

Instead, you must use PHPMailer, which can be configured to authenticate with an external email account (at GMail or wherever) and send mail from this external mail server. Luckily, if you go back to the froshims studio, David Malan will show you how to set up PHPMailer.

In other news, you are making a big mistake by attempting to send a password in clear text via email. This makes your first question a moot point, because you should not use this approach.

Why not?

First of all, it's a big security no-no. Plaintext email is like a postcard: as the message is sent across the network, anyone can intercept it and read its contents.

But even if you think you don't care about security, there's another reason to avoid this approach: it won't work, because a password hash is a one-way encryption which cannot be reversed (at least, not in normal usage).

And if you are not hashing passwords before storing them in the database (as you apparently are not) that's another major security problem.

In fact, it's arguably worse, because an intercepted email will only compromise one user account, while a data breach due to SQL injection could compromise every user account at once!

This answer will give you more details, and hint at a better approach.

Since you asked for more info about creating an ephemeral URL, you should already be familiar with the idea of appending an HTTP GET query to a URL.

For example:

http://example.com?query=foo

And you should know how to write PHP code that checks to see the value of $_GET["query"] and conditionally does something if it matches:

    if ($_GET["query"] == "foo")
    {
        // do something cool
    }

So what you want to do here is write a PHP Controller (for example, reset_forgotten.php) that will display a form saying "Forgot your password? Enter your userid in this box, or your e-mail address in this other box, and we will email you a link to reset your password." -- unless a certain long random string happens to be passed as an HTTP GET query string, in which case it will display a reset_forgotten_form.php View.

This long random string is something that you can safely email in plaintext as part of a password reset URL:

http://example.com/reset_forgotten.php?q=fhqwhgadshgnsdhjsdbkhsdabkfabkveybvf

In this case, you would need to create a new table in the database where each row would contain a Primary Key (auto-increment), a user_id for the user who wants to reset their password, and a reset VARCHAR containing "fhqwhgadshgnsdhjsdbkhsdabkfabkveybvf" (or whatever).

To make it a one-time link that expires after it is used once, you would delete the row from the table after showing the password reset form.

Finally, to generate a long pseudo-random string programmatically, take a look at cryptographic hash functions like MD5 and SHA.

Hope this helps!