Forgot Password

Enter your email address and we'll send you a password reset link.

if (isLoggedIn()) { redirect('/dashboard/dashboard.php'); } $error = ''; $success = ''; $step = 1; // step 1: enter email, step 2: enter token + new password if ($_SERVER['REQUEST_METHOD'] === 'POST') { if (!isset($_POST['_token']) || $_POST['_token'] !== ($_SESSION['csrf_token'] ?? '')) { $error = 'Invalid security token. Please refresh and try again.'; } else { $pdo = getDB(); $step = (int)($_POST['step'] ?? 1); if ($step === 1) { $email = strtolower(trim($_POST['email'] ?? '')); if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { $error = 'Please enter a valid email address.'; } else { $stmt = $pdo->prepare('SELECT id FROM users WHERE email = ? LIMIT 1'); $stmt->execute([$email]); $user = $stmt->fetch(); if ($user) { $token = bin2hex(random_bytes(32)); $expires = date('Y-m-d H:i:s', time() + 3600); $pdo->prepare('DELETE FROM password_reset_tokens WHERE email = ?')->execute([$email]); $pdo->prepare('INSERT INTO password_reset_tokens (email, token, expires_at) VALUES (?, ?, ?)') ->execute([$email, $token, $expires]); $_SESSION['reset_email'] = $email; $success = 'Reset token generated. For this local installation, use token: ' . htmlspecialchars($token, ENT_QUOTES, 'UTF-8') . ''; } else { // Don't reveal whether email exists $success = 'If that email is registered, a reset token has been generated.'; } $step = 2; } } elseif ($step === 2) { $email = strtolower(trim($_POST['email'] ?? '')); $token = trim($_POST['token'] ?? ''); $password = $_POST['password'] ?? ''; $passConf = $_POST['password_confirmation'] ?? ''; if (strlen($password) < 6) { $error = 'Password must be at least 6 characters.'; $step = 2; } elseif ($password !== $passConf) { $error = 'Passwords do not match.'; $step = 2; } else { $stmt = $pdo->prepare( 'SELECT * FROM password_reset_tokens WHERE email = ? AND token = ? AND expires_at > NOW() LIMIT 1' ); $stmt->execute([$email, $token]); $reset = $stmt->fetch(); if (!$reset) { $error = 'Invalid or expired reset token.'; $step = 2; } else { $hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]); $pdo->prepare('UPDATE users SET password = ? WHERE email = ?')->execute([$hash, $email]); $pdo->prepare('DELETE FROM password_reset_tokens WHERE email = ?')->execute([$email]); $success = 'Password reset successfully! Sign in now.'; $step = 1; } } } } } $csrfToken = csrfToken(); $resetEmail = htmlspecialchars($_SESSION['reset_email'] ?? ($_POST['email'] ?? ''), ENT_QUOTES, 'UTF-8'); ?> Forgot Password – prime edge pips

Reset Password

← Back to Sign In