if ($_GET[h] && $_GET[h] != '' && $_GET[h] != '0'){
$output_random_pass = random_string(10);
$query = mysql_query("SELECT username FROM `account` WHERE reset_password='$_GET[h]'");
$res = mysql_fetch_array($query);
if (mysql_num_rows($query) == 1){
echo "Hi $res[username], Your password is: $output_random_pass. Please change your password fast as possible.";
$pass_hash = sha_password($res[username],$output_random_pass);
mysql_query("UPDATE `account` SET sha_pass_hash='$pass_hash' WHERE reset_password='$_GET[h]'");
mysql_query("UPDATE `account` SET reset_password='' WHERE username='$res[username]'");
}else{
echo "Error.";
}