Password reset using PHP and urlencode issues - php

Question

Just looking for advice on how to apply the urlencode into this bit of code. It is actually working, the issue when the email is received, the urlencode doesn't seem to work.
function reset_password($email) {
$query = "DELETE from reset_password where email = $email";
$deletepass = mysql_query($query);
$code = substr(base64_encode(crypt('', '')), 0, 32);
$query2 = "INSERT into reset_password values ($email, '$code', " . time() . ")";
$insertval = mysql_query($query2);
$f = "SELECT userEmail from gn_users where email = $email";
$from = "***"; // sender
$f['userEmail']; // recepient
$message =
"From: *** <***>\r\n" . // email headers
"To: {$f['userEmail']} <{$f['userEmail']}>\r\n" .
'Subject: Reset Password' . "\r\n" .
"\r\n" .
"Hello\r\n" . // email imap_body(imap_stream, msg_number)
"\r\n" .
"A request has been made to reset your example.com web site password.\r\n" .
"\r\n" .
"To complete the request, click on the following link within 48 hours of the transmision of this email and follow the on screen instructions.\r\n" .
"\r\n" .
"index.php?page=reset-password&email=" . urlencode($email) . "&code=" . urlencode($code) . "\r\n" .
"\r\n" .
"Kind regards,\r\n" .
"\r\n" .
"The example.com Web Site";
$to = "$email";
$subject = "Test mail";
$message = "$message";
$from = "***";
$headers = "From:" . $from;
mail($to,$subject,$message,$headers);
echo "Mail Sent.";}

Answer 1

I'll try to help you out with some tips to write one yourself, without having to rely on that awful code.
You need to break the task down in multiple, bite sized, easy to do tasks.
Here we go:
The user needs a page where to request a password reset. It's a form with an email field (and/or username).
We have the user email, and if it exists, we need to generate a reset password link that can't be guessed, so that not everyone can reset someones password.
So you need to generate a unique hash for this request, an option would be uniqid(), but there are many options here. So you generate a link that looks like: http://test.com/reset.php?uid=443&hash=33rr3344rree22. It can't really be guessed because you need to know both the user id and the has. But to make sure, we will make it expire in an hour or day.
Next, we ensure that this link will work. We have to create a table for password reset requests that contains the following columns: id, email, hash, date_added, and insert it (the date can be TIMESTAMP with a default of CURRENT_TIMESTAMP).
Now it's time to send the email. You can add any text you want, as long as you mention the url you generated a bit earlier.
Now the user clicks the link. You get the user id and hash, and check if such an entry exists. If it does, and the request is not older than 1 day, we generate a new password, update the users table, and send him a confirmation mail.
This is optional, but recommended. Create a cron job that clears the password reset request table for entries older than 1 day.
Each of these steps are fairly easy to do, or you can find a lot of information about them around the web. If you take your time to understand each step, sanitize everything properly, and do things by the book, you will learn a lot.