title: How do i make a token expire
body: <p>I'm trying to code a password recovery script with PHP, and after having a look around here in SO, the consensus for best practice seems to be</p>
  
  <ul>
  <li>Generate Token with expiry</li>
  <li>Send token via email to user</li>
  <li>User clicks on token and changes password.</li>
  </ul>
  
  <p>I currently have functions to generate a token, but how would i go about making it expire?Also, what would be a good shelf-life for the token?</p>
  
  <p>Token Generation code:</p>
  
  <pre><code>    function crypto_rand_secure($min, $max) {
          $range = $max - $min;
          if ($range &lt; 0) return $min; // not so random...
          $log = log($range, 2);
          $bytes = (int) ($log / 8) + 1; // length in bytes
          $bits = (int) $log + 1; // length in bits
          $filter = (int) (1 &lt;&lt; $bits) - 1; // set all lower bits to 1
          do {
              $rnd = hexdec(bin2hex(openssl_random_pseudo_bytes($bytes)));
              $rnd = $rnd &amp; $filter; // discard irrelevant bits
          } while ($rnd &gt;= $range);
          return $min + $rnd;
  }
  
  function GenerateToken($length){
      $token = "";
      $codeAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
      $codeAlphabet.= "abcdefghijklmnopqrstuvwxyz";
      $codeAlphabet.= "0123456789";
      for($i=0;$i&lt;$length;$i++){
          $token .= $codeAlphabet[crypto_rand_secure(0,strlen($codeAlphabet))];
      }
      return $token;
  }
  </code></pre>
  
  <p>P.s the code above was copy-pasted from another question here on S.O</p>