I have been tearing my hair out getting this thing to do what I want it to and I think I've finally succeeded.

This is the most secure password lookup mod I can think of.

When a user logs in, he enters just his username and email address. The script sends him a random password to the email address. This assures you that the email address he entered is a real one.

The password should arrive very quickly and the user logs in.

If the user loses his password, he enters his email address again and the script generates a new password.

All passwords are encrypted on the system.

There are several optional components to the mod which you can add if you wish.

The first pulls the email address from the password file so that the user does not need to enter it again when he adds a record.

The second allows the user to change his email address. You can also set things up so that the user's email address in his record(s) will also be changed.

The third allows the user to change his password.

The admin display is also modified so that you can change the password or email address for a user yourself. Again, when an email address is changed in the password file, the user's email address is also changed in the .db file.

You can test the functions (except admin) by going to

http://www.jpdeni.com/cgi-bin/password/db.cgi

You can pick up the mod at
http://www.jpdeni.com/dbman/secure_lookup.txt

Please let me know if you have any problems. I have tried to make the mod as easy to use as I could and I have tested it. But there could be something I didn't think of.

------------------
JPD







[This message has been edited by JPDeni (edited July 13, 1999).]

I love it! Another job well done. I'm putting it on my todo list and should be able to try it on my site in about 3 months. It looks ready to me although that doesn't count for much as I'm a real novice but have learned more on this site in the last 3 days than I learned in an entire..uh..um... The creative side of my brain malfunctioned... Thanks!

Something occured to me? while looking at your password mod. What if someone signs in and is mailed a password and username and then they loose their password and you have set permissions to modify their own records only. They then send their email for a new password and a new password is issued to them... Will they still be able to modify their old records in the database since they now have a new password? Does this make sense and did you already account for this?

Everything should work fine regardless of the password. DBMan looks at the userid to identify the owner, not the password.

Great! Thanks...