SecurityAssist includes an option to create a random password.
You use that to store a session variable with a random password.
You use that session variable to update a field you add to the users table to store it. You update the same account that you are sending the email to.
In the email you use that same session variable to append a parameter in the link back to a page on your site like: http://www.yoursite.com/updatepassword.php?verificationCode={session variable with random value}
then on the page updatepassword.php you can allow the user to update the record that matches the verificationCode and email address they entered. You are ensured it is the correct user because they got the email with the random code.
Now the alternative is that you just store the random password you generated into that session variable as the new password, and just send that to them as their new password and let them update it if they want on their own.
