Here is the PHP code that processing the password recovery...
<?php
include("../../config.php");
if(isset($_POST)){
$error = array();
if(testStr("empty", $_POST["email"])){
$email = testStr("clean", $_POST["email"]);
$check = mysql_select("users", "", "email = '{$email}'", NULL, 1);
if(!mysql_num_rows($check)){$error[] = "That email address does not exist.";}
}else{$error[] = "Please enter your email address.";}
if(count($error) == 0){
$headers = "From: ".config('email/name')." ".config('email/address')."\r\n";
$headers.= "MIME-Version: 1.0\r\n";
$headers.= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$pass = makePassword(15);
$salt = salt();
$password = encrypt($pass, $salt);
$htmlMessage = "
<html>
<body>
<h2>Password Recovery for Ed's Login System</h2>
<p>Hi, you requested a password change. Below you will find your new password.<br />
Once you have logged in, you will be prompted to change it again, this time - remember it!</p>
<p><strong>Your New Password:</strong> {$pass}</p>
</body>
</html>
";
if(mail($email, "Password Recovery", $htmlMessage, $headers)){
$update = mysql_update("users", array("password", "salt", "p_prompt"), array($password, $salt, 1), "email = '".$_POST["email"]."'");
if($update && count($error) == 0){
echo json_encode(array("success" => true, "message" => "Password has been changed successfully, check your email for your new password."));
}else{$error[] = "Failed to update password.";}
}else{$error[] = "Something went wrong creating your password.";}
}
if(count($error) > 0){
echo json_encode(array("success" => false,"error" => $error));
}
}
?>