CREATE TABLE `otp` (
  `user_email` varchar(255) NOT NULL,
  `otp_pass` varchar(64) NOT NULL,
  `otp_timestamp` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  `otp_tries` tinyint(1) NOT NULL DEFAULT '0'
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
 
ALTER TABLE `otp`
  ADD PRIMARY KEY (`user_email`);
  <?php
class OTP {
  // (A) CONSTRUCTOR - CONNECT TO DATABASE
  protected $pdo = null;
  protected $stmt = null;
  public $error = "";
  function __construct() {
    try {
      $this->pdo = new PDO(
        "mysql:host=".DB_HOST.";dbname=".DB_NAME.";charset=".DB_CHARSET,
        DB_USER, DB_PASSWORD, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]
      );
    } catch (Exception $ex) { die($ex->getMessage()); }
  }

  // (B) DESTRUCTOR - CLOSE CONNECTION
  function __destruct() {
    if ($this->stmt !== null) { $this->stmt = null; }
    if ($this->pdo !== null) { $this->pdo = null; }
  }

  // (C) GENERATE OTP
  function generate ($email) {
    // @TODO - 
    // YOU SHOULD CHECK IF THE PROVIDED EMAIL IS A VALID USER IN YOUR SYSTEM
    
    // (C1) CHECK IF USER ALREADY HAS EXISTING OTP REQUEST
    $this->stmt = $this->pdo->prepare(
      "SELECT * FROM `otp` WHERE `user_email`=?"
    );
    $this->stmt->execute([$email]);
    $otp = $this->stmt->fetch(PDO::FETCH_NAMED);

    // (C2) ALREADY HAS OTP REQUEST
    if (is_array($otp)) {
      // @TODO - 
      // ADD YOUR OWN RULES HERE - ALLOW NEW REQUEST IF EXIPRED?
      // $validTill = strtotime($otp['otp_timestamp']) + (OTP_VALID * 60);
      // if (strtotime("now") > $validTill) { DELETE OLD REQUEST }
      // else { ERROR }
      $this->error = "You already have a pending OTP.";
      return false;
    }

    // (C3) CREATE RANDOM PASSWORD
    $alphabets = "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXYZ0123456789";
    $count = strlen($alphabets) - 1;
    $pass = "";
    for ($i=0; $i<OTP_LEN; $i++) { $pass .= $alphabets[rand(0, $count)]; } 
 
    // (C4) DATABASE ENTRY 
    try { 
      $this->stmt = $this->pdo->prepare(
        "REPLACE INTO `otp` (`user_email`, `otp_pass`) VALUES (?,?)"
      );
      $this->stmt->execute([$email, $pass]);
    } catch (Exception $ex) {
      $this->error = $ex->getMessage();
      return false;
    }

    // (C5) SEND VIA EMAIL
    // @TODO - FORMAT YOUR OWN "NICE" EMAIL OR SEND VIA SMS.
    $mailSubject = "Your OTP";
    $mailBody = "Your OTP is $pass. Enter it at 3b-challenge.php within 15 minutes.";
    if (@mail($email, $mailSubject, $mailBody)) { 
      return true; 
    } else {
      $this->error = "Failed to send OTP email.";
      return false;
    }
  }

  // (D) CHALLENGE OTP
  function challenge ($email, $pass) {
    // (D1) GET THE OTP ENTRY
    $this->stmt = $this->pdo->prepare(
      "SELECT * FROM `otp` WHERE `user_email`=?"
    );
    $this->stmt->execute([$email]);
    $otp = $this->stmt->fetch(PDO::FETCH_NAMED);

    // (D2) OTP ENTRY NOT FOUND
    if (!is_array($otp)) {
      $this->error = "The specified OTP request is not found.";
      return false;
    }

    // (D3) TOO MANY TRIES
    if ($otp['otp_tries'] >= OTP_TRIES) {
      $this->error = "Too many tries for OTP.";
      return false;
    }

    // (D4) EXPIRED
    $validTill = strtotime($otp['otp_timestamp']) + (OTP_VALID * 60);
    if (strtotime("now") > $validTill) {
      $this->error = "OTP has expired.";
      return false;
    }

    // (D5) INCORRECT PASSWORD - ADD STRIKE
    if ($pass != $otp['otp_pass']) {
      $strikes = $otp['otp_tries'] + 1;
      $this->stmt = $this->pdo->prepare(
        "UPDATE `otp` SET `otp_tries`=? WHERE `user_email`=?"
      );
      $this->stmt->execute([$strikes, $email]);

      // @TODO - TOO MANY STRIKES 
      // LOCK ACCOUNT? REQUIRE MANUAL VERIFICATION? SUSPEND FOR 24 HOURS?
      // if ($strikes >= OTP_TRIES) { DO SOMETHING }

      $this->error = "Incorrect OTP.";
      return false;
    }

    // (D6) ALL OK - DELETE OTP
    $this->stmt = $this->pdo->prepare(
      "DELETE FROM `otp` WHERE `user_email`=?"
    );
    $this->stmt->execute([$email]);
    return true;
  }
}

// (E) DATABASE SETTINGS - CHANGE TO YOUR OWN!
define('DB_HOST', 'localhost');
define('DB_NAME', 'test');
define('DB_CHARSET', 'utf8');
define('DB_USER', 'root');
define('DB_PASSWORD', '');

// (F) ONE-TIME PASSWORD SETTINGS
define('OTP_VALID', "15"); // VALID FOR X MINUTES
define('OTP_TRIES', "3"); // MAX TRIES
define('OTP_LEN', "8"); // PASSWORD LENGTH

// (G) NEW OTP OBJECT
$_OTP = new OTP();
<!-- (A) OTP REQUEST FORM -->
<h1>OTP REQUEST</h1>
<form method="post" target="_self">
  <input type="email" name="email" required value="[email protected]"/><br>
  <input type="submit" value="Go"/>
</form>
 
<?php
// (B) PROCESS OTP REQUEST
if (isset($_POST['email'])) {
  require "2-otp.php";
  $pass = $_OTP->generate($_POST['email']);
  echo $pass ? "<div>OTP SENT.</div>" : "<div>".$_OTP->error."</div>" ;
}
?>
<!-- (A) OTP CHALLENGE FORM -->
<h1>OTP CHALLENGE</h1>
<form method="post" target="_self">
  <input type="email" name="email" required value="[email protected]"/><br>
  <input type="text" name="otp" required/><br>
  <input type="submit" value="Go"/>
</form>
 
<?php
// (B) PROCESS OTP CHALLENGE
if (isset($_POST['email'])) {
  require "2-otp.php";
  $pass = $_OTP->challenge($_POST['email'], $_POST['otp']);
  echo $pass ? "<div>OTP VERIFIED.</div>" : "<div>".$_OTP->error."</div>" ;
}
?>