[PHP] Password Retrieval .. Small Issue

Hey guys, I just have a small issue here - when I try to use the password retrieval script it keeps saying that the account is invalid while its not, I checked up with all the tables and everything seems right - so i cant really find whats wrong here, would be nice if one of you guys can tell me whats wrong, tnx alot.. heres the script:

edit; my DB is located on localhost, no pass .. username is root and uhh, the DB = ascent :P

Code:

---

<?php include("./template.php"); ?>
        <tr class=listlabel>
        <td>
        <b>Lost your Password?</b>   
        <td colspan=2 align=center>
        </td>
        </tr>
        <tr>   
        <?php
$from = "Sunfury WoW";
$subject = "Password Retrieval";

if(isset($_POST['submit']))
{
    //account database info
    $aHost = "localhost";
    $aDatabase = "ascent";
    $aPort = "3306";
    $aUsername = "root";
    $aPass = "";


    $con = mysql_connect($aHost.":".$aPort, $aUsername, $aPass) or die(mysql_error());
    mysql_select_db($aDatabase) or die(mysql_error());

        $account = mysql_real_escape_string($account);
    $password = mysql_real_escape_string($password);

    $query = "SELECT email and '".$password."' FROM accounts WHERE login = '".$account."'";


    $account = $_POST['account'];
    $password = $_POST['password'];

    $result = mysql_query($query) or die(mysql_error());
    $numrows = mysql_num_rows($result);

    echo "<tr class=list1><td colspan=2><center>";

    if($numrows == 0)
    {
        die("Invalid account name!<br><a href=./password.php>Go Back!</a>");
    }

    $row = mysql_fetch_array($result);
    $email = $row[0];

    $body = "Hello Sunfury Member, You're request account and password names are: \n\n";
    $body .= "Account Name: ".$account."\n";
    $body .= "Password: ".$password."\n\n";
    $body .= "If you did not request the login information please ignore this email, Thank you.<br>Enjoy your stay on Sunfury WoW.";

    mail($email,$subject,$body,"From: ".$from);

    echo "Your password has been emailed to you!<br><a href=./password.php>Go Back!</a>";

    echo "</td></tr>";

    //close mysql connection
    mysql_close();
}
//if page is loaded, display unstuck form
else
{
    echo "<form name=myform method=post action='./password.php'>";

    //echo "<tr><td colspan=2><hr></td></tr>";
    //echo "<tr><td colspan=2><hr></td></tr>";

    echo "<tr class=list1><td width=125>Account Name: </td><td><input type=text name=account value=''></td></tr>";
    echo "<tr class=list2><td colspan=2 align=center>\n<input type=submit name=submit value=Submit></td></tr>";
    echo "</form>";
}

?>
</table>
</tr>
<?php include("./footer.php"); ?>

---

What does $account and $password hold in the first query? Nothing.

Replace:

PHP Code:

---

$account = mysql_real_escape_string($account);
    $password = mysql_real_escape_string($password);

    $query = "SELECT email and '".$password."' FROM accounts WHERE login = '".$account."'";


    $account = $_POST['account'];
    $password = $_POST['password']; 


---

By:

PHP Code:

---

$account = mysql_real_escape_string($_POST['account']);
    $password = mysql_real_escape_string($_POST['password']);

    $query = "SELECT email and '".$password."' FROM accounts WHERE login = '".$account."'"; 


---

PS: did you know you can use [ php ] and [/ php ] (without the spaces) for PHP code to be highlighted?

PPS: please use the [PHP] tag in the title instead of [HELP]

Thanks Alot, D - That resolved my issue - And I didnt know about [ php ] [ / php ] ill use them next time I got a issue and ill use PHP Tag too, thanks mate! :)


Edit; It worked, but for some reason I never received an email with the information. :|

I suggest you use PHPMailer, or SwiftMailer, which are both much better then the build-in mail() function.

Hehe alright thanks :P