phpweb忘记账号密码

<!-- reset_password_form.html -->
<form action="reset_password.php" method="post">
    <label for="email">Email:</label>
    <input type="email" id="email" name="email" required>
    <button type="submit">Reset Password</button>
</form>

<?php
// reset_password.php
session_start();

// 连接数据库
$db = new PDO('mysql:host=localhost;dbname=your_database', 'username', 'password');

// 获取用户输入的邮箱
$email = $_POST['email'];

// 生成唯一的重置令牌
$token = bin2hex(random_bytes(32));

// 将令牌和邮箱关联并存储到数据库
$stmt = $db->prepare("UPDATE users SET reset_token = :token WHERE email = :email");
$stmt->bindParam(':token', $token);
$stmt->bindParam(':email', $email);
$stmt->execute();

// 发送重置密码邮件
$resetLink = "https://yourdomain.com/reset_password.php?token=" . urlencode($token);
$subject = "Password Reset Request";
$message = "Click the link to reset your password: " . $resetLink;
$headers = "From: no-reply@yourdomain.com";

mail($email, $subject, $message, $headers);

// 提示用户检查邮箱
echo "An email with instructions to reset your password has been sent to your email address.";
?>

<?php
// reset_password.php
session_start();

// 检查是否有有效的重置令牌
if (isset($_GET['token'])) {
    $token = $_GET['token'];

    // 查询数据库，验证令牌是否有效
    $db = new PDO('mysql:host=localhost;dbname=your_database', 'username', 'password');
    $stmt = $db->prepare("SELECT * FROM users WHERE reset_token = :token");
    $stmt->bindParam(':token', $token);
    $stmt->execute();
    $user = $stmt->fetch();

    if ($user) {
        // 显示重置密码表单
        echo '
            <form action="reset_password_process.php" method="post">
                <input type="hidden" name="token" value="' . htmlspecialchars($token) . '">
                <label for="new_password">New Password:</label>
                <input type="password" id="new_password" name="new_password" required>
                <label for="confirm_password">Confirm Password:</label>
                <input type="password" id="confirm_password" name="confirm_password" required>
                <button type="submit">Reset Password</button>
            </form>
        ';
    } else {
        echo "Invalid or expired reset link.";
    }
} else {
    echo "Invalid request.";
}
?>

<?php
// reset_password_process.php
session_start();

// 检查是否有有效的重置令牌和新密码
if (isset($_POST['token']) && isset($_POST['new_password']) && isset($_POST['confirm_password'])) {
    $token = $_POST['token'];
    $new_password = $_POST['new_password'];
    $confirm_password = $_POST['confirm_password'];

    if ($new_password === $confirm_password) {
        // 连接数据库
        $db = new PDO('mysql:host=localhost;dbname=your_database', 'username', 'password');

        // 更新用户密码
        $stmt = $db->prepare("UPDATE users SET password = :password, reset_token = NULL WHERE reset_token = :token");
        $hashed_password = password_hash($new_password, PASSWORD_DEFAULT);
        $stmt->bindParam(':password', $hashed_password);
        $stmt->bindParam(':token', $token);
        $stmt->execute();

        echo "Your password has been successfully reset.";
    } else {
        echo "Passwords do not match.";
    }
} else {
    echo "Invalid request.";
}
?>