What are the best practices for generating unique confirmation links for password changes in PHP user management systems?

When generating unique confirmation links for password changes in PHP user management systems, it is important to use a combination of random tokens and user-specific information to ensure uniqueness and security. One common approach is to generate a random token, store it in the database along with the user's ID, and include it in the confirmation link sent to the user's email. Upon clicking the link, the token can be verified against the database to allow the user to proceed with the password change. 

// Generate a unique confirmation token
$token = bin2hex(random_bytes(16));

// Store the token in the database along with the user ID
$stmt = $pdo->prepare("INSERT INTO password_reset_tokens (user_id, token) VALUES (:user_id, :token)");
$stmt->execute(['user_id' => $user_id, 'token' => $token]);

// Send the confirmation link to the user's email
$confirmation_link = "https://example.com/reset_password.php?token=$token";
// Include $confirmation_link in the email sent to the user

// Verify the token when the user clicks the confirmation link
$token = $_GET['token'];
$stmt = $pdo->prepare("SELECT user_id FROM password_reset_tokens WHERE token = :token");
$stmt->execute(['token' => $token]);
$row = $stmt->fetch();
if ($row) {
    $user_id = $row['user_id'];
    // Allow the user to proceed with the password change
} else {
    // Invalid token
}

Keywords

hashing random_bytes password_hash unique token security

Related Questions