Question

I want to add a “Forgot password” function to my User Login module, for that i have created password Recovery action and when user enter an email system will check whether the mail is exist or not and if its exist it will send mail to user. What i want to know is how to include users current password and username to that mail.

How can i do this ?

Answer 1

You don’t do this ever, ever, EVER, you send a password recovery hash, and add a token with a time to live to your DB, then send the hash via email to the user who lost their password. Do not store passwords in the clear, it violates the clients password security, and should your DB be compromised it would release the username and password combinations to your entire userbase.

Store passwords as:

   DB.userTable.setTupple(username,sha1(username+"optionaldelimiter"+password));

Retreive passwords as:

resetPasswd(username : string, hash : string, newPasswd: string)
{
tup = DB.recoveryTable.fetchTupple(username,hash);
  if( tup != null && tup.expiresAt <= Date.now())
  {
  DB.setPasswd(username,newPasswd);
  }
}