"Global variables aren't available in the function scope unless you specifically ask for them with the global keyword." Incorrect, you can access them using $GLOBAL keyword, yes that "might" be disabled but highly unlikely, using the global keyword iirc is deprecated or should be if nothing else.

Sadly I've seen php devs work with "warnings" turned off as well.

@Pawel Dyda A reset link can also be sniffed, if your email is getting sniffed i think having a temp password in your email is the least of your worries.

At least one of the top 5 banks in Canada only allows 8 characters max also