I just developed something similar for my application. My idea was to generate a temporary password and attach a sort of key at the front of the temporary password. Once they login with the new password I check if the first couple chars match my key and if so redirect them to a password change page.
PHP
public function tempPass() {
$key = '$a4104_';
$alphabet = "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXYZ0123456789";
$pass = array();
$alphaLength = strlen($alphabet) - 1; //Creates a temp password
for ($i = 0; $i < 25; $i++) {
$n = rand(0, $alphaLength);
$pass[] = $alphabet[$n];
}
$pass = implode($pass); //turn the array into a string
//Apply whatever hash function you'd like here
$pass = md5($pass); //Note md5 is just an example
$pass = $key.$pass;
return $pass;
//Possibly add a mail function here to send the user a new password
}
I placed this in my login script.
$tempCheck = substr($password, 0, 7);
if($tempCheck === '$a4104_') {
$temp = true;
//They have a temporary password so redirect them
}else{
$temp = false;
//Not using a temporary password
}
