--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/user/uk/resetEmail.php	Thu Feb 16 22:29:02 2017 +0000
@@ -0,0 +1,78 @@
+<?php
+require "PasswordHash.php";
+include "../../private/db.php";  
+
+// emailname and password sent from form
+$userID=$_GET['userID'];
+$email=$_GET['email'];
+$mypassword=$_GET['pwd'];
+$receiveEmail=$_GET['receiveEmail'];
+$GRState=$_GET['GRState'];
+
+// To protect MySQL injection 
+$userID = stripslashes($userID);
+$userID = mysqli_real_escape_string($link,$userID);
+//echo $userID;
+$email = stripslashes($email);
+$mypassword = stripslashes($mypassword);
+$email = mysqli_real_escape_string($link,$email);
+$mypassword = mysqli_real_escape_string($link,$mypassword);
+$receiveEmail = stripslashes($receiveEmail);
+$receiveEmail = mysqli_real_escape_string($link,$receiveEmail);
+$GRState = stripslashes($GRState);
+$GRState = mysqli_real_escape_string($link,$GRState);
+
+
+	$t_hasher = new PasswordHash(8, FALSE);
+
+	$query2 = "select Password, FirstName, Surname from user where UserID = $userID";
+	$data2 = mysqli_query($link, $query2);
+
+	while($line = mysqli_fetch_assoc($data2))
+	{
+		$passHash = $line['Password'];
+		$displayName=$line['FirstName'];
+		$surname=$line['Surname'];
+	}
+	$check = $t_hasher->CheckPassword($mypassword, $passHash);
+
+	if( $check )
+	{
+		$hashpwd = $t_hasher->HashPassword($mypassword);
+		$update="UPDATE user set Email = '$email' where UserID = $userID"; 
+		//echo $update;
+		$run = mysqli_query($link, $update);
+		
+		// if successfully inserted data into database, send confirmation link to email
+		if($run){
+			if($displayName == "")
+				$displayName = $email;
+				
+			echo  $displayName . ":::" . $email . ":::" . $surname . ":::" . $receiveEmail . ":::" . $GRState . ":::" . $userID;
+
+			// ---------------- SEND MAIL FORM ----------------
+			$to=$email;
+			$subject="BookWhack confirmation";
+			$header="from: BookWhack <noreply@bookwhack.com>";
+			$message="BookWhack Confirmation\r\n";
+			$message.="Your email address has been changed successfully\r\n";
+		}
+		else {
+			$to=$email;
+			$subject="BookWhack - Error changing email";
+			$header="from: BookWhack <noreply@bookwhack.com>";
+			$message="BookWhack - Error changing email\r\n";
+			$message.="Your email reset has been unsuccessful: Database Error\r\n";
+		}
+	}
+	else
+	{
+			$to=$email;
+			$subject="BookWhack - Error changing email";
+			$header="from: BookWhack <noreply@bookwhack.com>";
+			$message="BookWhack - Error changing email\r\n";
+			$message.="Your email change has been unsuccessful: Incorrect password provided \r\n";
+			$message.="Please try again under 'Edit Preferences' and ensure you enter the correct password under 'Current Password'\r\n";
+	}
+	$sentmail = mail($to,$subject,$message,$header);
+?>
\ No newline at end of file