Question

When a user forgets his password, there is an email sent to his email account with a link and token (unique) to resetpassword.php

When the authentication is correct then he is able to change the password. My question is how can this happen?
The quick and easy way is to email him a new password and let him change it through his CP, but is this a good user-experience?

    $result = mysql_query("SELECT member_id FROM members WHERE forgotpass='$token'");
        if(mysql_num_rows($result) == 1) {

            WHAT GOES HERE?
    }
    else {
        die("Query failed");
    }

Answer 1

WHAT GOES HERE?

there should be something like

echo 'Your password was mailed to you';
mysql_query("UPDATE members SET password = '".$random_hashed_string."' WHERE forgotpass='$token'");
mail($to, $subject, $message." password:".$random_hashed_string, "From: [e-mail]");