id/reset_password.php

<?php
global $pdo;
if (!empty($query)) {
	$reset_id = $query['reset_id'];
	$reset_token = $query['reset_token'];
} else {
	die("Invalid URL.");
}


$password_valid = validate_password_reset($reset_id, $reset_token);

if (!$password_valid) {
	die("This incident will be reported.");
}

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    $password = $_POST['password'];
    $repeat_password = $_POST['repeat_password'];
    $bcid = get_id_for_password_reset($reset_id, $reset_token);

    if ($password == $repeat_password) {
        $new_password = password_hash($password, PASSWORD_DEFAULT);
        $sql = 'UPDATE accounts SET password = ? WHERE id = ?';

        try {
	        $pdo->prepare($sql)->execute([$new_password, $bcid]);
        } catch (PDOException $e) {
            die ($e);
        }

        // delete the password reset stuff
        delete_password_reset($reset_id, $reset_token);
    }
}

?>

<p>Please submit your new password:</p>
<form method="post">
    <label for="password">New password</label>
	<input type="password" name="password" id="repeat_password">
    <label for="repeat_password">Repeat new password</label>
	<input type="password" name="repeat_password" id="repeat_password">
	<button type="submit">Reset password</button>
</form>