Can't find Security Questions

[rosscoD]

Can someone tell me how I can display what question a user has selected as their security question? I know how to retrieve the securityqid but I cannot find the actual question in the database anywhere. Is the actual question encrypted? How can I display the question if I know the ID?

 

Thanks

[jeremyhaber]

From what I can tell the security questions are encrypted for whatever reason. WHMCS seems to have a decrypt function to decrypt the questions.

 

Though I am not sure exactly how to decrypt them. Maybe this API function can decrypt the security questions?

http://wiki.whmcs.com/API:Decrypt_Password

[robb3369]

Try this:

$result = mysql_query("SELECT question,securityqans FROM tblclients,tbladminsecurityquestions WHERE tblclients.id=".$_SESSION["uid"]." AND tblclients.securityqid = tbladminsecurityquestions.id");
while($row = @mysql_fetch_array( $result )) {
 $question = decrypt($row['question']);
}
if (!$question) {
 echo 'No question set';
}else{
 echo $question;
}

Edited April 24, 2010 by robb3369
fixed query

[rosscoD]

For some reason this did not work, I even hard coded the userID and this didn't show a question. No matter what 'no question set' was displayed.

 

Since I do all my own coding etc I just decided to hard code the question selections in an array and used securityqid to select the correct question from the array. Works as well with only one obvious drawback.

[robb3369]

You are running that query within the context of the whmcs system correct? I just re-verified the folliwng snippet of code by appending it to the bottom of the clientareadetails.tpl template and it worked like a champ:

{php}
$result = mysql_query("SELECT question,securityqans FROM tblclients,tbladminsecurityquestions WHERE tblclients.id=".$_SESSION["uid"]." AND tblclients.securityqid = tbladminsecurityquestions.id");
while($row = @mysql_fetch_array( $result )) {
 $question = decrypt($row['question']);
}
if (!$question) {
 echo 'No question set';
}else{
 echo $question;
}
{/php}

And just for a sanity check, does the whmcs admin page for the client (Clients Profile -> Profile Tab) show a security question set?