Question about reset password in lesson08 of David Powers (Dreamweaver CS5 with PHP)

Question

I'm at the page 299 that found a problem in reset password. I managed to received email of link to reset password. In the reset password form, why no checking of password length entered or password unmatch with confirmed password input ? Instead it displays error message of 'Sorry, there was an error. Make sure you used the complete URL in the email you received. The URL can be used to change your password only once. If necessary...' The error message of 'Passwords don't match' or 'Use 8-15 letters or numbers only' not processed.
Please help !
Thank You

Answer 1

I can see the 32 characters attached to URL and also I can see the 32 characters stored in database. It actually can reset the the password if entered within the requirement of 8-15. But when I entered less than 8, it does not show the error message of 'Use 8-15 letters or numbers only'.
I noticed that $_SESSION['nomatch'] was assigned to True after the validation of 8-15 length. Below is the code for reference.
<?php
session_start();
$errors = array();
$success = FALSE;
$_SESSION['nomatch'] = TRUE;
require_once('library.php');
try {
  if (isset($_GET['id']) && isset($_GET['token'])) {
          $id = $dbRead->quote($_GET['id']);
          $token = $dbRead->quote($_GET['token']);
          $sql = "SELECT user_id FROM users WHERE user_id = $id AND token = $token";
          $result = $dbRead->fetchRow($sql);
          if ($result) {
      $_SESSION['user_id'] = $_GET['id'];
            $_SESSION['token'] = $_GET['token'];
            $_SESSION['nomatch'] = FALSE;
  if (isset($_POST['reset'])) {
          // password reset code goes here
          $val = new Zend_Validate();
          $val->addValidator(new Zend_Validate_StringLength(8,15));
          $val->addValidator(new Zend_Validate_Alnum());
          if (!$val->isValid($_POST['password'])) {
            $errors['password'] = 'Use 8-15 letters or numbers only';
          $val = new Zend_Validate_Identical($_POST['password']);
          if (!$val->isValid($_POST['conf_password'])) {
            $errors['conf_password'] = "Passwords don't match";
          if (!$errors) {
            // update the password
            $data = array('password' => sha1($_POST['password']),
                          'token'    => NULL);
            $where['user_id = ?'] = $_SESSION['user_id'];
            $where['token = ?'] = $_SESSION['token'];
            $success = $dbWrite->update('users', $data, $where);
            unset($_SESSION['user_id']);
            unset($_SESSION['token']);
            unset($_SESSION['nomatch']);
} catch (Exception $e) {
  echo $e->getMessage();