Manejo de las contraseñas perdidas en PHP

<?php
/* Generate new password. */

$new_password = '';
for ($i = 0; $i < 8; $i++) {
   $new_password .= chr(mt_rand(33, 126));
}
/* Define a salt. */
define('SALT', 'flyingturtle');

/* Encrypt new password. */
$encrypted_password = hash('sha256',SALT . $new_password);

/* Save new encrypted password to the database. */
$st = $db->prepare('UPDATE users
                        SET password = ?
                        WHERE username = ?');
$st->execute(array($encrypted_password, $clean['username']));
/* Email new plain text password to user. */

mail($clean['email'], 'New Password', "Your new password is: $new_password");
?>