PHP session Anti-URL attack method

Session tracking, you can easily avoid this situation:

<?php Tutorial
Session_Start ();
$clean = Array ();
$email _pattern = '/^[^@s<&>]+@ ([-a-z0-9]+.) +[a-z]{2,}$/i ';
if (Preg_match ($email _pattern, $_post[' email '))
{
$clean [' email '] = $_post[' email '];
$user = $_session[' user '];
$new _password = MD5 (Uniqid (rand (), TRUE);
if ($_session[' verified '])
{
/* Update Password * *
Mail ($clean [' email '], ' Your New Password ', $new _password);
}
}
?>

http://example.org/reset.php?user=php&email=chris%40example.org

If reset.php trusts the information provided by the user, this is a semantic URL attack vulnerability. In this case, the system will generate a new password for the PHP account and send it to chris@example.org so that Chris can successfully steal the PHP account.