Part of my web site design (PHP running on Linux server) sends a link to the user via e-mail containing a 32 character key as a GET parameter. So the link looks like this: https://sylvesterbradley.org/swchoir/edit_member.php?x=1&key=0V88jzAfEQfZ6QcIID5BdeuLvQxuGOiG. The user is asked to click the link, which takes him to a page where (if the link matches what we have stored in the database, and has not time expired) he can enter a new password. Sometimes when such a link is clicked, the $_GET variable is empty, i.e. is equal to []. Why might this be? How do I find out what is going wrong and fix it?

Thank you - Rowan

It's hard to say what might be clearing the value. You could parse the URL token and store it as a session variable instead, then clear it when a users password is reset. That way you won't lose access if the user navigates away.

Subsequent forgotten passwords should also overwrite the value in the session to the new token to prevent the system from trying to use expired tokens.

Obviously you'll still need to check for token validity against your DB as well.

---

https://www.php.net/manual/en/function.parse-url.php

Setting:

<?php
  if( !isset($_SESSION['pw_reset_token']) ) {
    $_SESSION['pw_reset_token'] = 'url value';
  };
?> 

Clearing:

<?php unset($_SESSION['pw_reset_token']); ?>