忘记密码逻辑

Question

What I want to do is figure out how I can see if the new password and the date it was requested (0000-00-00 00:00:00) are set and then sending emails based on that. However I'm thinking I need to change my logic because if its already set I don't want it to keep mass emailing the user. Also something I'm not certain about is what if they aren't getting the email though.

Any ideas on what I should do?

EDIT: Just wanted to add that the new_password_key is NOT a password for the user to log in with. As of right now I was going to have them directed to a page from a link in an email where they can enter a new password.

if (!isset($user_data->new_password_key) && (!isset($user_data->new_password_requested)))
{
    if ($this->kow_auth->forgot_password($this->input->post('username')))
    {
        $this->kow_auth->send_email('forgot_password', 'KOW Manager Forgot Password Email', $user_data);
        echo json_encode(array('success' => 'yes', 'message' => 'A temporary password has been emailed to you!'));
    }
    else
    {

    }    
}
else
{
    echo json_encode(array('success' => 'yes', 'message' => 'Check your email for your temporary password!'));
}

EDIT 2:

There just seems to be some logic issues I have with it because what if it gets down to the if statement if ($already_sent_password) and for some reason they didn't get it. Then what? Or what if itt gets down to if (!strtotime($user_data->new_password_requested) <= (time() - 172800)) which is starting to sounds stupid to me because why make them have to wait two days to get a new password key.

function forgot_password_submit() 
{
    $this->form_validation->set_rules('username', 'Username', 'trim|required|xss_clean');

    if (!$this->form_validation->run()) 
    {
       echo json_encode(array('error' => 'yes', 'message' => 'There was a problem submitting the form! Please refresh the window and try again!')); 
        return;
    }

    $user_data = $this->users->get_user_by_username($this->input->post('username'));
    if ($user_data === NULL) 
    {
        echo json_encode(array('error' => 'yes', 'message' => 'User does not exist in the database!'));
        return;
    }

    $already_sent_password = (isset($user_data->new_password_key) && isset($user_data->new_password_requested));
    if ($already_sent_password) 
    {
        echo json_encode(array('success' => 'yes', 'message' => 'Check your email for your temporary password!'));
        return;
    }

    if (!strtotime($user_data->new_password_requested) <= (time() - 172800)) 
    {
        echo json_encode(array('error' => 'yes', 'message' => 'You have to wait 2 days before a new temp password can be emailed!'));

    } 
    else 
    {
        if ($this->kow_auth->forgot_password($this->input->post('username'))) 
        {
            $this->kow_auth->send_email('forgot_password', 'KOW Manager Forgot Password Email', $user_data);
            echo json_encode(array('error' => 'yes', 'message' => 'A temporary password has been emailed to you'));
        } 
        else 
        {
            echo json_encode(array('error' => 'yes', 'message' => 'A temporary password could not be created for you!'));
        }
    }

Answer 1

Personally, I wouldn't worry about mass emailing the user. If the user clicks the button 20 times they should expect to receive 20 emails.

However, if you wanted to not re-send an email if the last time they requested the password was under 20 minutes ago you could do the following:

<?php
// Assuming this is in UTC
$requested = strtotime($user_data->new_password_requested);
if (time() - $requested <= (60 * 20))
{
    // Don't send the email
    return false;
}

return true;