Are there any best practices to follow when sending password reset links via email in PHP?

When sending password reset links via email in PHP, it is important to ensure the security of the reset process. One best practice is to generate a unique token for each password reset request and include it in the reset link. This token should be securely stored in the database along with the user's information and should expire after a certain period of time to prevent unauthorized access. 

// Generate a unique token for password reset
$token = bin2hex(random_bytes(32));

// Store the token in the database along with the user's information
// For example, using PDO
$stmt = $pdo->prepare("INSERT INTO password_resets (email, token, created_at) VALUES (:email, :token, NOW())");
$stmt->execute(['email' => $email, 'token' => $token]);

// Send the password reset link via email
$resetLink = "https://example.com/reset-password.php?token=" . $token;
$message = "Click the following link to reset your password: " . $resetLink;
mail($email, "Password Reset Link", $message);

Keywords

email password reset security PHPMailer token generation

Related Questions