function send_reset_confirmation_request($name)
{
    global $sitename;

    $rs = safe_row("email, nonce", 'txp_users', "name = '".doSlash($name)."'");

    if ($rs) {
        extract($rs);

        $confirm = bin2hex(pack('H*', substr(md5($nonce), 0, 10)).$name);

        $message = gTxt('greeting').' '.$name.','.

            n.n.gTxt('password_reset_confirmation').': '.
            n.hu.'textpattern/index.php?confirm='.$confirm;

        if (txpMail($email, "[$sitename] ".gTxt('password_reset_confirmation_request'), $message)) {
            return gTxt('password_reset_confirmation_request_sent');
        } else {
            return array(gTxt('could_not_mail'), E_ERROR);
        }
    } else {
        // Though 'unknown_author' could be thrown, send generic 'request_sent'
        // message instead so that (non-)existence of account names are not leaked.
        return gTxt('password_reset_confirmation_request_sent');
    }
}
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.