title: Reset password confirmation does not work properly?
body: <p>It works if i put it like that where user_id = 3 or when i remove the where statement(WHERE user_id=".$user['user_id'].") but then all my password in the db change.</p>
  
  <p>I used get method to get the userid like that
  user_id=3&amp;reset_token=xxxxxxxxx</p>
  
  <pre><code>&lt;?php
  
  if( isset($_GET['user_id']) &amp;&amp; isset($_GET['reset_token']) ) {
  $userid = $_GET['user_id']; 
  $reset_token = $_GET['reset_token']; 
  
  // Make sure user email with matching hash exist
  $req = $heidisql-&gt;prepare("SELECT * FROM users WHERE user_id='$userid' AND reset_token='$reset_token' ");
  
  $req-&gt;execute($userid, $reset_token );
  
  $user = $req-&gt;fetch(PDO::FETCH_ASSOC);
  
  
      if ($user) {
  
         if (!preg_match ('%\A(?=[-_a-zA-Z0-9]*?[A-Z])(?=[-_a-zA-Z0-9]*?[a-z])(?=[-_a-zA-Z0-9]*?[0-9])\S{8,30}\z%', $_POST['new_pass']) 
           || $_POST['new_pass'] !== $_POST['confirm_newpass'] ) {
  
         echo 'Your new password did not match the new confirm password or is invalid!';
         exit();
  
          } 
  
     } 
  
    } else {
  
          $newpassword = escape_data($_POST['new_pass']);
          $newpass_hash = password_hash($newpassword, PASSWORD_BCRYPT);
  
          $sql= "UPDATE users SET "
                  . "password_hashcode='$newpass_hash', "
                  . "reset_allocated_time=NULL, "
                  . "reset_token=NULL "
                  . "WHERE user_id=".$user['user_id']." "; //&lt;- error here
  
          // Make sure user email with matching hash exist
          $result_newpass = $heidisql-&gt;prepare($sql);
  
          $result_newpass-&gt;execute();
  
          echo "Your password has been reset!";
  
          exit();
  
      }
  </code></pre>
  
  <p>already try user_id = '$userid'/ $_GET['user_id']
  So, how should i define the variable user_id?</p>
  
  <p>Still does not work
        $req = $heidisql->prepare("SELECT * FROM users WHERE user_id=':user_id' AND reset_token=':reset_token' ");</p>
  
  <pre><code>   $req-&gt;execute([':user_id'=&gt;$userid, ':reset_token'=&gt;$reset_token]);
  
     $sql= "UPDATE users SET password_hashcode=':password_hashcode', reset_allocated_time=NULL, reset_token=NULL WHERE user_id=:user_id";
     $result_newpass = $heidisql-&gt;prepare($sql); $result_newpass-&gt;execute([':user_id'=&gt;$userid,':password_hashcode'=&gt;$newpass_hash, ':reset_token'=&gt;NULL, ':reset_allocated_time'=&gt;NULL]);
  </code></pre>
  
  <p><strong>- I believe the problem may lies with the get method cause it seems that I cannot properly access the user_id/reset_token in the URL?</strong></p>
  
  <p>...localhost/example/reset_pass.php?user_id=xx&amp;reset_token=xxxxxxxxx</p>
  
  <ul>
  <li><p>I am getting undefined variable at user_id</p></li>
  <li><p>Anyone knows if that the problem(s) cause my password validation also does not work?</p></li>
  </ul>