php mail onclick on link execute mysql command - php

Question

I'm trying to do a password reset using mail, so what will happen is the user will enter his email on the forgot password and on button click it will be sent to the email that is on the database. Now what i will do is give the user a new random password and to do this the user should click on the link on the email to verify that he really wants to change the password, will that be possible? Here is my code
if (isset($_POST['mytxtmail']))
{
$newid = ($_POST['mytxtmail']);
$result = mysqli_query($con,"SELECT EMAIL FROM members WHERE EMAIL='$newid'");
if($result->num_rows == 0) {
echo 'Mail Successfully Sent to '.$newid;
return false;
}
else
$to = $newid;
$subject = 'the subject';
$message = 'Please Click here to Verify the Change of Password';
$headers = 'From: webmaster#example.com' . "\r\n" .
'Reply-To: webmaster#example.com' . "\r\n" .
'X-Mailer: PHP/' . phpversion();
mail($to, $subject, $message, $headers);
echo 'Mail Successfully Sent to '.$newid;
}

Answer 1

It's a bit of a long procedure to write the full code here.
One way you can do is, make a new column in your users table, let's say pass_request_hash , now whenever the user clicks on forgot password option and enters his e-mail ID and submits, an update query runs to dump a random value into pass_request_hash for that user and at the same time a mail is sent with that same hash value and also his e-mail ID as GET parameters.
Now when the user has clicked on the link sent to him by e-mail, the link points to a PHP script which checks with the database if the hash and e-mail received from the GET parameter matches with those in the database, if yes then you can have another script getting executed to send a new password to that e-mail ID.
You can also set a timeout for that hash.
There are other ways to do it too, check out some of these tutorials:
One
Two
Three

Answer 2

You should include the link in the email which would take the user to the password verification script (it could be the same you are using here, only add needed functionality).