To answer your second question: you cannot use the PHP mail() function to send mail from the CS50 IDE because Cloud 9 blocks outgoing SMTP traffic on port 25 by firewall policy, to prevent spammers from using free Cloud 9 accounts to broadcast unsolicited bulk email.
Instead, you must use PHPMailer, which can be configured to authenticate with an external email account (at GMail or wherever) and send mail from this external mail server. Luckily, if you go back to the froshims studio, David Malan will show you how to set up PHPMailer.
In other news, you are making a big mistake by attempting to send a password in clear text via email. This makes your first question a moot point, because you should not use this approach.
Why not?
First of all, it's a big security no-no. Plaintext email is like a postcard: as the message is sent across the network, anyone can intercept it and read its contents.
But even if you think you don't care about security, there's another reason to avoid this approach: it won't work, because a password hash is a one-way encryption which cannot be reversed (at least, not in normal usage).
And if you are not hashing passwords before storing them in the database (as you apparently are not) that's another major security problem.
In fact, it's arguably worse, because an intercepted email will only compromise one user account, while a data breach due to SQL injection could compromise every user account at once!
This answerThis answer will give you more details, and hint at a better approach.
Since you asked for more info about creating an ephemeral URL, you should already be familiar with the idea of appending an HTTP GET query to a URL.
For example:
http://example.com?query=foo
And you should know how to write PHP code that checks to see the value of $_GET["query"] and conditionally does something if it matches:
if ($_GET["query"] == "foo")
{
// do something cool
}
So what you want to do here is write a PHP Controller (for example, reset_forgotten.php) that will display a form saying "Forgot your password? Enter your userid in this box, or your e-mail address in this other box, and we will email you a link to reset your password." -- unless a certain long random string happens to be passed as an HTTP GET query string, in which case it will display a reset_forgotten_form.php View.
This long random string is something that you can safely email in plaintext as part of a password reset URL:
http://example.com/reset_forgotten.php?q=fhqwhgadshgnsdhjsdbkhsdabkfabkveybvf
In this case, you would need to create a new table in the database where each row would contain a Primary Key (auto-increment), a user_id for the user who wants to reset their password, and a reset VARCHAR containing "fhqwhgadshgnsdhjsdbkhsdabkfabkveybvf" (or whatever).
To make it a one-time link that expires after it is used once, you would delete the row from the table after showing the password reset form.
Finally, to generate a long pseudo-random string programmatically, take a look at cryptographic hash functions like MD5 and SHA.
Hope this helps!
