Is it safe to save a user's email into php session variable for later use?

Question

I'm in the process of creating a password reset functionality for my project. I currently have my website send a password reset link to the user's email if they request it and validates the link properly when clicked (checks for selector and validator tokens and not expired) before displaying the form to create a new password. The problem I'm having is finding a way to updating the correct user's password in the database once they submit the new password. One method I have thought of to achieving this, is to get the email associated with the matched selector and validator tokens in my password reset database table and storing it into a session variable so it can be accessed by another php file to update that user's password in my users database table. I'm wondering if this approach has any security risks to the user or is it a valid method?

Answer 1

Create a table for reset tokens, with username, email, token and expiration time.

When the user submits the form, submit back the token. Look on the table and get the correct email, and delete/invalidate the record.

Answer 2

For sake of completeness, another option is to go stateless. All necessary parameters (e.g. user's email or account ID, reset expiration time etc.) are encoded into the reset password URI, and signed cryptographically using HMAC to preserve integrity. Then, the server decodes the URI and verifies these values upon submission of the new password.

An excellent Python library for this is itsdangerous, and there appears to be an outdated PHP port (itsdangerous-php) as well, but it is lacking much of the functionality.