mysql update user's password and activation key

Question

Instead of using the Default WP reset password form, I'm creating my own and I'm stumped on this prepared statement.

I'm trying to update the user's password by checking their user_login and user_activation_key. When I run this query and echo the result, I'm getting a return of int(0). It seems like it's not returning any row of the user.

I also echo each POST variables to make sure it's the values are correct and it is so I'm not sure where the problem lies.

$newpassword = $_POST['newpass'];
$wp_hasher = new PasswordHash(16, FALSE);
$hashedPwd = wp_hash_password($newpassword);

$useremail = $_POST['useremail'];
$key = $_POST['key'];

$resetQuery = $wpdb -> query($wpdb -> prepare("UPDATE wp_users SET user_pass = %s, user_activation_key = '' WHERE user_login = %s AND user_activation_key = %s", 
                                                $hashedPwd, $useremail, $key));

If anyone can please help me, that would be great! Thanks.

Answer 1

You are using the user email as the user login. Your code, formatted for readability, looks like:

$resetQuery = $wpdb -> query(
  $wpdb -> prepare(
    "UPDATE wp_users 
    SET user_pass = %s, user_activation_key = '' 
    WHERE user_login = %s AND user_activation_key = %s", 
    $hashedPwd, 
    $useremail, 
    $key
  )
);

The $useremail argument matches the user_login = %s placeholder.

Having the user_login match user_email is not normal. Unless you have altered your user registration so that the login always matches the email that isn't going to work, and I suspect that that is your problem. You need to rewrite the query, and/or supporting code, so that either the query matches user_login to user_login or user_email to user_email.