
11-10-2003, 04:08 PM
|
|
Thinker
Join Date: Jul 2003
Posts: 443
|
|
If a user has lost their password, they should have the ability to create a temporary password that is stored in a separate table in the database. This password is good for one login only, and is destroyed when it is used, or when the user logs in normally.
Storing passwords in cleartext as you seem to be doing is a big security risk. You should use PHPs crypt() or md5() functions and store a hash of the pass in the database, not the actual password.
|
| |
|
|
|