[Newbie PHP]Email Activation

[Cooper]

I'm pretty new to PHP, however, I'd say I have quite a good understanding of it.

I'm currently writing a sign up script which is basically a registration form which enters info into a database and a login form which does something with sessions (I'm still learning about that ;p)

Now, I may be wrong, so if I am, please correct me...

What I need to do is, when someone submits the registration form; enter a random activation code into the member’s row under a new field like “activation_code”.
Then I would use PHP mail() to send an email to the person who has just signed up a link to activate their account with a URL which is something like activate.php?do=ACTIVATIONCODE
When they click the link sent in the email, the script will check the activation code at the end of the URL against that of the one in the database. If they match the members field, change the group field from (say) 1 to 2 (1 being not activated, 2 being activated and having full access to members pages)

My question is, how would I generate such a code? Also, how would I get the script to recognise that someone has gone to activate.php?do=ACTIVATIONCODE and use the activation code in the URL to check if it matches that of the one in the database?

Any help here would be brilliant, thanks

 

[abdulmueid]

Hello Cooper.

To generate a random number, you can use function like rand() i.e. if you need a 5 digit random number, you could use rand(10000, 99999) and it would generate random numbers between the specified range.

For the activation:
1. Create two fields, let's say "activ" and "activ_code".
2. By default set "activ" to 0 and store the random number in "activ_code" when the user submitted the activation form.
3. In the email, include a link to activate.php?user=USERNAME&do=ACTIVATIONCODE
4. In activate.php use a search query to look for the activation code in "activ_code" field of the corresponding username and if the activation code exists, execute another query that changes the value for "activ" to 1 meaning the user has activated his account!

 

[Shorty]

Well first of all it would need to be activate.php?username=Whatever&&do=ACTIVATIONCODE.

Then on activate.php you need:
$username = $_GET['username'];
$activationcode = $_GET['do'];

So then you simply do a MySQL query to SELECT activationcode from users WHERE username=$username. (Not perfect syntax but you get the idea.)

And then an if statement along the following lines:
if ($activationcode == $database_activationcode) {
// Approve the user
} else {
// The activation code didnt match that in the database, do whatever you want
}

 

[Eric]

As for generating that activation code, here's something i've used before:

<?php

$act_code = md5(sha1(uniqid(mt_rand(), true)));

?>

Which produces something like: d6420b35b18fb0ee782215ad8223b4b0

 

[Cooper]

+Rep to you all. Thanks, that pretty much clears everything up

 

[abdulmueid]

No problem Cooper It's always a pleasure.
And thanks for the +rep

 

[Cooper]

Well I've written something, however, acivate.php doesn't seem to be working. Below is acivate.php

<?PHP 
require_once('mysql_connect.php');
				
$user_id = $_GET['user'];
$activationcode = $_GET['code'];

$query = ("SELECT activation_code FROM members WHERE id='$user_id'");
$result = @mysql_query($query); 

if ($result == $activationcode) {

mysql_query("UPDATE members SET active=2 WHERE id='$user_id' LIMIT 1") ;

echo "You have sucsessfully activated your account!";
}
 else {
echo "That is the wrong activation code";
}
?>

I have a feeling something is wrong with the query. Any help here?

 

[Eric]

<?php

require_once('mysql_connect.php');

// I strongly recommend some input validation here!
// Wide open to all sorts of vulnerabilities.
$user_id = $_GET['user'];
$activationcode = $_GET['code'];

$query = mysql_query("SELECT activation_code FROM members WHERE id=$user_id") or die("Error");
$row = mysql_fetch_array($query);

if ($row['activation_code'] == $activationcode)
{
    mysql_query("UPDATE members SET active=2 WHERE id=$user_id LIMIT 1") or die("Error");

    echo 'You have successfully activated your account!';
}
else
{
    echo 'That is the wrong activation code.';
}

?>

 

[Cooper]

Thanks dude, works great!

Also, what do you mean by input validation?

 

[Eric]

Np

http://www.google.com/search?q=php+input+validation
http://www.google.com/search?q=sql+injection
http://en.wikipedia.org/wiki/SQL_Injection
http://phpsec.org/library/