Before you can add a feature to allow users to reset a forgotten password, you will need to add a simpler feature: create a Controller and View that will allow an authenticated user (already logged in) to change their password to a new one -- perhaps only after entering their current, valid password.
Once you have done that, you can use a similar mechanism to allow an un-authenticated user (one who is not logged in) to change their password to a new one -- this time, without requiring them to enter a current, valid password, since, after all, they have forgotten it!
For this second feature, you will need to create a Controller and View that are very similar to the one I mentioned in the paragraph above, minus only the field for the current password (and the logic required to validate the current password.)
You are on the right track with sending the user an email. However, emailing passwords in plaintext is a security no-no, as @DinoCoderSaurus has mentioned.
A better solution would be to create an ephemeral URL to display the "Reset Forgotten Password" View, and then email that URL to the user. You could create a reset_forgotten.php
Controller that displays a form saying "Forgot your password? Enter your userid in this box, or your e-mail address in this other box, and we will email you a link to reset your password." -- unless a certain long random string happens to be passed as an HTTP GET query string, in which case it will display a reset_forgotten_form.php
View.
I leave the implementation to you. I'll just mention that there are already some PHP functions used to generate cryptographic hashes such as SHA and MD5. You could use one of these to generate a long string, then store it in a new database table along with the ID of the user requesting a reset. Then, once the reset_forgotten_form.php
View is displayed once, you would want to remove that row from the table so that the same link would never work again.
By the way, if this helps to answer your question, please click on the green checkmark. Help keep our forum safe from undead zombie questions!