PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Implementing User Authentication
595
Listing 27.20 notify_password()Function from user_auth_fns.php—This
Function Emails a Reset Password to a User
function notify_password($username, $password) {
// notify the user that their password has been changed
$conn = db_connect();
$result = $conn->query("select email from user
where username='".$username."'");
if (!$result) {
throw new Exception('Could not find email address.');
} else if ($result->num_rows == 0) {
throw new Exception('Could not find email address.');
// username not in db
} else {
$row = $result->fetch_object();
$email = $row->email;
$from = "From: support@phpbookmark \r\n";
$mesg = "Your PHPBookmark password has been changed to ".$password."\r\n"
."Please change it next time you log in.\r\n";
}
if (mail($email, 'PHPBookmark login information', $mesg, $from)) {
return true;
} else {
throw new Exception('Could not send email.');
}
}
In the notify_password() function, given a username and new password, you simply
look up the email address for that user in the database and use PHP’s mail() function to
send it to her.
It would be more secure to give users a truly random password—made from any
combination of upper and lowercase letters, numbers, and punctuation—rather than the
random word and number. However, a password like zigzag487 will be easier for users
to read and type than a truly random one. It is often confusing for users to work out
whether a character in a random string is 0 or O (zero or capital O), or 1 or l (one or a
lowercase L).
On our system, the dictionary file contains about 45,000 words. If a cracker knew
how we were creating passwords and knew a user’s name, he would still have to try
22,500,000 passwords on average to guess one.This level of security seems adequate for
this type of application even if our users disregard our emailed advice to change their
password.