PHP & MySQL login question.

Question

Lets say a member forgets there username, email or password for logging in to our site what is the best way for me to have them retrieve them? an example or tutorial will help out greatly.

Answer 1

Since you should be storing passwords hashed in your database (not in plaintext, not encrypted), there would be no way to retrieve them.

The best pattern is email to email the user a secret link which allows users to reset their password. For forgotten usernames, they can just enter their email address and they'll get an email notifying them.

Here's a basic tutorial on hashing passwords:

http://phpsec.org/articles/2005/password-hashing.html

Answer 2

Then he has fully lost access to the site and the only hope is contacting (via another email or telephone) the website admin in order to have his password reset. The admin will have to ask his name and attempt to somehow validate that it's him (kind of hard to do nowadays).

Users will usually not forget their email credentials, so sending a password reset link is the best solution.

Answer 3

If your user forgets their password, email them with a reset-password and a verify code. You will have to use a verify email table for this.

If your user forgets their email, I don't see an issue unless their email is their login name. But you should have their email on file from when they used it to verify their email upon signup.

If your user forgets their username, you have to find some method of verifying their identity according to information already stored on your site. I have recorded users IPs and browser information in my statistics table, and could easily verify their information by comparing IP and browser that the "forgot username" request form sends to me against information already in the table. Probably not the best method, but it has worked for me so far.