no, you shouldn't be storing plain-text passwords.

you need to create a function that generates a new, random password, and then your password recovery form updates the database with this new password, and also emails a copy of the new password to the account holder.

order of doing things:
  • generate new, random password: newPassword
  • store md5(newPassword) in database
  • email newPassword to user's email