num_rows < 1) { error("login", "No account found with that email address"); } $result = $query->fetch_assoc(); $username = $result['username']; $id = $result['id']; $password = RandomString(8); $password_hash = password_hash($password, PASSWORD_BCRYPT); $sql = "UPDATE `user` SET `password`='$password_hash' WHERE `id`=$id"; ExecQuery($mysqli, $sql); //Logout everywhere else $sql = "DELETE FROM `session` WHERE `user`=$id"; ExecQuery($mysqli, $sql); $msg = "Dear $username,\n\n"; $msg .= "Your password has been reset.\nEvery active session has been logged out.\n"; $msg .= "New password: " . $password . ""; sendMail($email, "Password reset", $msg); success("login", "Your password has been reset, an email has been sent to " . $email); ?>