Undefined variable: adminEmail in line 50 activation email not getting sent!?

[chrismcf]

Ok so I am practically brand new to php and I have really been working at this hard. I have gotten all my issues worked out and this appears to be the last one. My admin email doesn’t seem to be getting set.
When I test it out from the website through registering a test user the email with the activation link isn’t getting sent out. And I cant figure out why other than that this is causing it.
I could sure use some help. Pretty please and thank you so so much!
I have been beating my head against this all day and I just honestly don’t know what to do to fix it. Im sure its something simple but here I am…
Undefined variable: adminEmail in /home/***/***/forgot_pass.php on line 50
this the code for my forgot password page below is the code from the connect_to_mysql.php code
$outputForUser = "";
if ( isset($_POST['email']) && $_POST['email'] != "" )
{
$email = $_POST['email'];
$email = strip_tags($email);
$email= str_ireplace("`", "", $email);
$email = mysql_real_escape_string($email);
$sql = mysql_query("SELECT * FROM myMembers WHERE email='$email' AND email_activated='1'");
$emailcheck = mysql_num_rows($sql);
if ($emailcheck == 0){
$outputForUser = '<font color="#FF0000">There is no account with that info<br />
in our records, please try again.';
} else {
$emailcut = substr($email, 0, 4); // Takes first four characters from the user email address
$randNum = rand();
$tempPass = "$emailcut$randNum";
$hashTempPass = md5($tempPass);
@mysql_query("UPDATE myMembers SET password='$hashTempPass' WHERE email='$email'") or die("cannot set your new password");
Line 50 $headers = "From: $adminEmail\n"; // $adminEmail is established in [ scripts/connect_to_mysql.php ][/COLOR]$headers .= "MIME-Version: 1.0\n";
$headers .= "Content-type: text/html; charset=iso-8859-1 \n";
$subject ="Login Password Generated";
$body="<div align=center><br>----------------------------- New Login Password --------------------------------<br><br><br>
Your New Password for our site is: <font color=\"#006600\"><u>$tempPass</u></font><br><br />
</div>";
if(mail($email,$subject,$body,$headers)) {
$outputForUser = "<font color=\"#006600\"><strong>Your New Login password has been emailed to you.</strong></font>";
} else {
$outputForUser = '<font color="#FF0000">Password Not Sent.<br /><br />
Please Contact Us...</font>';
}
}
} else {
$outputForUser = 'Enter your email address into the field below.';
}
?>
Here is the the code from my connect_to_mysql.php
<?php
mysql_connect("localhost","***","***") or die (mysql_error());
mysql_select_db("***") or die (mysql_error());?>

 

[essellar]

This is not a support issue; it belongs in the "Scripts, 3rd Party Apps and Programming" forum. This forum is for server and account problems.

When you do post for help with code, please use the appropriate BBcode tags, either PHP, HTML or CODE -- that retains your formatting and will give syntax highlighting for PHP and HTML.

It's not enough to have code available somewhere on the server, you need to run it somehow. In this case, that would mean using an include() or require() statement to include your configuration script's values in the code you are trying to run.

And keep in mind that this is a volunteer user-to-user forum for the most part; you aren't entitled to help with programming issues (although the chances are pretty good that you'll get help if you post in the correct forum -- there are a few users who know what they're doing and keep an eye on the forum I pointed to, but aren't server admins, so they don't necessarily hang out in this forum).

 

[misson]

The Scripts, 3rd Party Apps, and Programming forum is more appropriate for coding issues. The Free Hosting forum is more for administrative issues.

Please use

, [html] or [code] tags (as appropriate) to separate and format code.

If PHP says the variable is undefined, it's undefined. [url=http://sscce.org/]Sample code[/url] should be presented as a minimal test case–complete, concise and representative. Otherwise, it's impossible to say with any certainty what's wrong, as the issue may lie in code that isn't posted.

The [URL="http://x10hosting.com/forums/programming-help/162529-php-begin-deprecation-ext-mysql-start-moving-your-development-pdo-now.html"]mysql extension[/URL] is outdated and on its way to deprecation. Instead, use PDO, which has many useful improvements, such as [URL=http://www.php.net/PDO.prepared-statements]prepared statements[/URL] and support for the [url=http://php.net/Traversable]Traversable[/url] interface, so you can loop over results with [c]foreach[/c].

[url=http://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html]MD5 is considered broken[/url] by security professionals. No less than Bruce Schneier wrote back in 2008:
[quote]But -- come on, people -- no one should be using MD5 anymore.[/quote]
Use a newer hashing function, such as whirlpool or something from the SHA2 family (SHA256, SHA512) or (better still) Blowfish (using [url=http://php.net/crypt][color=green]crypt()[/color][/url]). Any of these hashing functions can in turn be the basis of a tunable [url=http://x10hosting.com/forums/scripts-3rd-party-apps-programming/177621-problem-encrypting-passwords.html#post880241]key derivation function[/url] (see also essellar and Callum's discussion on "[url=http://x10hosting.com/forums/scripts-3rd-party-apps-programming/162841-create-user-accounts.html]Create User Accounts[/url]"). There's currently a [url=https://wiki.php.net/rfc/hash_pbkdf2]proposal to add PBKDF2[/url] to PHP's [url=http://php.net/hash]hash extension[/url], which is built as part of the core. It won't be available until PHP 5.5 at the earliest (barring custom PHP builds), but if you write your own PBKDF2 function, give it the same API as in the proposal so yours can be replaced with the standard. You can even use [url=http://php.net/function_exists][c]function_exists[/c][/url] to conditionally define your function, so that yours will be used only if a native version doesn't exist. Be aware that though the proposal has reached the vote-phase, there may yet be changes to the API.

Your password scheme is also vulnerable to [URL=http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html]rainbow tables[/URL]. Add [URL=http://www.ciphersbyritter.com/NEWS6/SALT.HTM]salt[/URL] to fix this. Give each user a unique salt (a "[URL=http://en.wikipedia.org/wiki/Cryptographic_nonce]nonce[/URL]") and store that in a column in table `users`.

To update your code without impacting existing users:
[list=1]
[*]Add a new column to your users table indicating which hash function was used. It could be a BOOLEAN value indicating that the p/w needs updating, or a string naming the hash function:[list=1]
[*][c]`md5` BOOLEAN NOT NULL DEFAULT TRUE,[/c]
[*][c]`hash` VARCHAR(16) NOT NULL DEFAULT 'md5',[/c]
[/list]
The latter option allows you to easily support whatever hashing functions are available on the host.
[*]Register new users using the newer hashing function.
[*]When a user logs in, check whether their password is hashed using MD5 or not. If it is, expire their password (this is a good chance to have users enter new passwords). Alternatively, if the validation succeeds, re-hash the password and update the database.
[*]If using the 1st column option, drop the column when there are no more MD5 hashed passwords ([c]SELECT COUNT(*) FROM users WHERE `md5`=TRUE[/c] is 0)
[/list]

Note that [c]or die(mysql_error())[/c] should never appear in production code, as [URL="http://www.phpfreaks.com/blog/or-die-must-die"][c]die[/c][/URL] breaks HTML output and database error messages should never be revealed to non-admin users as it [URL="http://msdn.microsoft.com/en-us/library/ms995351.aspx#securityerrormessages_topic2"]discloses too much information[/URL]. A better approach would be to properly implement error handling.

[URL="http://brainstormsandraves.com/articles/semantics/structure/#br"]<br/>[/URL] (as it's being used), [c]<font>[/c] and the [c]align[/c] attribute are [URL="http://htmldog.com/guides/htmlintermediate/badtags/"]presentational HTML[/URL]. Moreover, [c]<font>[/c] is [URL="http://www.w3.org/TR/html5/obsolete.html#obsolete"]obsolete[/URL] and [c]align[/c] is completely absent in HTML5. Replace them with [URL="http://webstyleguide.com/wsg3/5-site-structure/2-semantic-markup.html"]semantic HTML[/URL] and use CSS for styling in the web page. HTML e-mails are a different matter, as mail clients lag behind in HTML support.

Instead of overwriting the user's password, it would be more usable to have a separate table of password reset requests with the necessary info (such as the temporary password and submit date & time). That way, you can expire password reset requests and easily force the user to enter a new password if you don't have a password expiration feature. Also, it sometimes happens that a user remembers her password shortly after submitting the request and doesn't need (or want) to use the temporary password.

[c]rand()[/c] is not suitable for security purposes, such as password generation. For that, you need a cryptographically secure random number generator, which (these days) means reading from a device such as /dev/urandom. Since [URL="http://en.wikipedia.org/wiki/Pseudorandom_number_generator"]PRNG[/URL]s are deterministic, they aren't cryptographically secure. [c]rand()[/c] is particularly bad.

 

[SierraAR]

Moved to the proper section