Non-database based PHP email verification string generator / verification

[RyanAM]

The code below will generate a string for an email, that you can use to mail a validation email to a user with, and verify that the string is valid for that email address.

Run the script for a demo. I understand that this is not the best way to do this, nor the most secure, but this is for people who are new to PHP to use for their applications without just letting anyone make an account (potential spammers).

I made this in 20 minutes so please let me know if you experience any errors or have any problems.

<?php
	class validateEmail{

		protected function ypk(){
		//This is a private key that you should change.
			return "change this to something random...";
		}
		
		public static function getKey($email){
		//Generate a email verification string.
			return time().":".md5(time().self::ypk()).":".md5(time()."m").":".strtolower($email).":".md5(strtolower($email).self::ypk());
		}
		
		public static function verifyKey($key){
		/*
		Check that email verification string,
		return their email if is valid string,
		return false if not.
		*/
			$key = explode(":",$key);
			$time = @$key[0];
			$catch = @$key[1];
			$v_time = @$key[2];
			$email = @$key[3];
			$v_email = @$key[4];
			return md5($time."m") == $v_time ?
				($catch == md5($time.self::ypk()) ?
					(md5($email.self::ypk()) == $v_email ?
						$email : false
					) : false
				)
				: false;
		}
		
	}
	echo "<b>Your PHP Version: </b>".phpversion()."<BR><BR>";
	echo validateEmail::getKey("[email protected]")."<BR>The above is a valid key. <a href='".$_SERVER['PHP_SELF']."?key=".validateEmail::getKey("[email protected]")."'>Click here to test</a>, if below is blank, string is invalid. Otherwise, it'll return the validated email address.<BR><BR>";
	echo "<b>".validateEmail::verifyKey(@$_GET["key"])."</b>";
?>

 

[4pm]

no need to have v_email and v_time separately. hash them in one md5 salted with ypk:

time().":".strtolower($email).":".md5(strtolower($email).$ypk.time());

now only check the last part after second ":"
you can also make the link time-sensitive by adding (time() - $time) < $lifetime condition

imho

 

[RyanAM]

no need to have v_email and v_time separately. hash them in one md5 salted with ypk:

time().":".strtolower($email).":".md5(strtolower($email).$ypk.time());

now only check the last part after second ":"
you can also make the link time-sensitive by adding (time() - $time) < $lifetime condition

imho

Good call, I might do that later on. I was thinking about the two time strings, but I just kept the extra in there so the long string looks more intimidating to people trying to register spam bots on people's sites, that way the think the algorithm is more complex than it really is.