Question

I am a newbie to PHP. I want to create a module in which the portal manager creates “Users” with a temporary password.

1. Once user is created, that particular user should receive email with a link that expires in 24hrs.
2. The Manager conveys the temporary password to user by some other means.
3. If the User clicks email link within 24hrs, it should ask for temporary password, new password and have a confirm new password field.
4. If temporary password is correct, then replace temporary password with new password in the database.

How should I implement this?

Answer 1

I can’t write it for you because I have no idea how your application is structured, but this would be the general approach I’d take:

1. User is created, presumably with a username, and these details are put in a database.
2. The temporary password is generated as a random string. Store a hash (MD5, SHA – google them if you don’t know) in the database along with a timestamp of NOW()
3. User logs in with username and temporary password. If the username and password match, and the current time minus the time logged is less then 24 hours, then ask for a new password. Do the same procedure, hash it and store it in the database. When they next log in, check the hashes match.

Does that make sense or are any parts totally alien and need explained further?