add mysql_real_escape_string function to protect sql injection into password reset script