Building a PHP Password Reset Workflow

Create a short-lived, single-use reset token, then rotate the password hash and invalidate other sessions.

The objective is to understand the behavior and operational limits, not only the method name.

What It Does

Create a short-lived, single-use reset token, then rotate the password hash and invalidate other sessions.

Prerequisites

Use a dedicated development environment and sample data. Where a snippet uses an injected connection, repository, request value or mailer, supply it from your own application setup.

Example 1: Basic Use

A focused working pattern for this topic. Names such as $pdo, $authContext and $repo represent dependencies provided by the application unless initialized in the snippet.

<?php
$token = bin2hex(random_bytes(32));
$tokenHash = hash('sha256', $token);
$stmt = $pdo->prepare('INSERT INTO password_resets (user_id, token_hash, expires_at) VALUES (?, ?, ?)');
$stmt->execute([$userId, $tokenHash, date('Y-m-d H:i:s', time()+900)]);
// Mail $token in a HTTPS reset link; only tokenHash is stored.

Example 2: A Second Scenario

A second use case that adds a different operation or data flow specific to this topic.

<?php
$resetHash = hash('sha256',$providedResetToken);
$stmt = $pdo->prepare('SELECT user_id FROM reset_links WHERE token_hash=? AND expires_at>CURRENT_TIMESTAMP AND used_at IS NULL');
$stmt->execute([$resetHash]);
$resetUser = $stmt->fetchColumn();

Example 3: Practical Checks

A practical validation, failure or deployment concern specific to this topic.

<?php
$newHash = password_hash($newPassword,PASSWORD_DEFAULT);
$pdo->beginTransaction();
try { $pdo->prepare('UPDATE users SET password_hash=? WHERE id=?')->execute([$newHash,$userId]); $pdo->prepare('DELETE FROM reset_links WHERE user_id=?')->execute([$userId]); $pdo->commit(); }
catch (Throwable $e) { if ($pdo->inTransaction()) $pdo->rollBack(); throw $e; }

Important Behavior and Edge Cases

Never reveal whether an account exists; hash reset tokens and verify expiry and one-time use in a transaction.

For production use, also account for error handling, data validation, resource limits and environment-specific driver behavior.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Create a short-lived, single-use reset token, then rotate the password hash and invalidate other sessions.
• Never reveal whether an account exists; hash reset tokens and verify expiry and one-time use in a transaction.
• Use this workflow as a focused starting point rather than a substitute for application-level tests.

Choose this API or pattern when its exact semantics match your task, and verify the result against the database driver and runtime used by your application.