Password recovery asp - html

Question

i am requesting a problem about forgot password .
if user forgot his/her password how can i return his/her same password in email address? My problem would be the SQL database password is encrypted how am I suppose to retrieve the same password instead encrypted.
i did like this:
<!--
METADATA
TYPE="typelib"
UUID="CD000000-8B95-11D1-82DB-00C04FB1625D"
NAME="CDO for Windows 2000 Library"
-->
<%
DIM strEmail
strEmail = Request.Form("email")
IF strEmail <> "" THEN
%>
<%
DIM objDB, rs, rssql
Set objDB = Server.CreateObject("ADODB.Connection")
objDB.Open "Provider=MSDASQL.1;Password=langas;Persist Security Info=True;User ID=mmsg;Data Source=mmsg_web"
rssql = "SELECT email_addr, medacist_password FROM medacist_user WHERE email_addr = '" & strEmail & "'"
Set rs = objDB.Execute(rssql)
IF rs.EOF THEN
Response.Write "That email address was not found in our database. Please click Back on your browser and enter the email address you registered with."
ELSE
DIM strPassword
set strPassword = rs("medacist_password")
Set cdoConfig = CreateObject("CDO.Configuration")
With cdoConfig.Fields
.Item(cdoSendUsingMethod) = cdoSendUsingPort
.Item(cdoSMTPServer) = "10.1.1.186" 'Ongoing sever SMTP required \\'
'' .Item(cdoSMTPAuthenticate) = 1'
'' .Item(cdoSendUsername) ="<enter_username>"
' ' .Item(cdoSendPassword) ="<enter_password>"''
.Update
End With
Set cdoMessage = CreateObject("CDO.Message")
With cdoMessage
Set .Configuration = cdoConfig
.From = "clu#medacist.com"
.To = strEmail
.Subject = "Forgotten Password"
.HTMLBody = "Here is your password: " & strPassword
.Importance = 1
.Send
End With
Set cdoMessage = Nothing
Set cdoConfig = Nothing
Response.Write "Your password has been sent to your email address."
END IF
ELSE
Response.Write "Please click Back on your browser and enter the email address you registered with."
END IF
%>
<!-- "Please click below link to reset your password: <br> <a href='https://www.medacist.com/login/test_globals.asp'>Click this link to reset your password</a>" -->

Answer 1

You aren't supposed to retrieve the password.
You should generate a long, pesudo-random token. Store it for a short time (e.g. 24 hours). Send it to the user (normally embedded in a URL). When the user follows the link in the email, they should get a page allowing them to set a new password (and you can use the token in the URL to identify which user's password is being changed).