[thesunny]

Yes, that is correct. But we probably shouldn't email the password to the user. Just let them change it. Might consider a one-way hash instead of a two-way one though.

[eru]

Minor nitpick: There's no such thing as a two-way hash.