PHP Forgot Password: Secure Reset Link Workflow

Recommended forgot-password flow

A forgot-password page should return the same public response whether an account exists or not. If the account exists, create a short-lived random token and email a reset link. Do not email the existing password or reveal account existence.

<?php
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

// Public response stays the same to reduce account enumeration.
$message = 'If the account exists, a password-reset link will be sent.';

if ($email) {
    $stmt = $pdo->prepare('SELECT id FROM members WHERE email = :email');
    $stmt->execute([':email' => $email]);
    $memberId = $stmt->fetchColumn();

    if ($memberId) {
        $token = random_bytes(32);
        $tokenHash = hash('sha256', $token);
        $expiresAt = (new DateTimeImmutable('+30 minutes'))->format('Y-m-d H:i:s');
        // Store $tokenHash and $expiresAt, then email the raw token in a reset URL.
    }
}

echo htmlspecialchars($message, ENT_QUOTES, 'UTF-8');
?>