User registration and email activation
Creating your own user registration system allows you to obtain interesting information about the visitors to your site. You can offer tailored content, provide additional services and keep track of what is being used. But how do users actually register for your site? They will be using a user registration system that may or may not be coded by yourself. One of the key parts of this system will be the validation of their account.
You will no doubt have registered for a website or discussion forum and been told that your account will be activated after you have validated your e-mail address. After submission of the registration form, you will be sent an e-mail with a link in. Upon clicking this link, your account will be validated and you can then proceed to use it. But how does this e-mail activation system work and how can you add it to your own website to be sure that 'real' people are registering, and not just spam bots? This article will walk you through coding your own e-mail validation system.
User Registration
In this article, I shall only be covering the activation part of a user registration system. I suggest you look at 'User Registration & Login System' by Matt Eunson which will guide you through the creation of your own user authentication application.
In your user database, you will need to add an extra column, 'status', which will show whether the user is activated or not. The default value should be 0. This indicates that the user has not yet activated their account. You can then incorporate a check into your login code to display an error if the status is 0. Upon, clicking the link sent via e-mail, the status will be set to 1 and the account is activated.
In addition to this, add an extra 'timestamp' column to your database. This can be generated using the PHP function time(). This will provide an identifier for the user.
Once the new user has been added to your database with their status set to 0 and a timestamp generated, you can then send them an activation e-mail. You can set the text to whatever you wish, the activation link is what is important. Using our user's timestamp and password, we can generate a link which will be able to uniquely identify them in the database. We will not, however, display the details in clear text and will encode them into the URL:
Using the md5() and base64_encode() functions, you can irreversibly hash the password and encode the timestamp (so you can get it back again in the processing script).
$url = 'http://www.olate.com/activate.php?hash='.md5($password).'&stamp='.base64_encode($stamp);
It is safe to use the timestamp and password hash to locate the user because it is very unlikely that another person will register at exactly the same time with exactly the same password as another user. However, if you wish, you could easily add the ID of the user by getting the mysql_insert_id() value after you have added the user to the database, then appending it to the URL.
This code constructs the URL. The $password variable is the value your user submitted and the $stamp contains the result of the time() function which was entered into the database. This can then be e-mailed to the newly registered member.
Account Activation
Once the user has received the e-mail, they will click it and be taken to activate.php providing the hash and stamp which can be accessed from the $_GET array. We will perform the activation based on the hash and the stamp:
UPDATE users
SET status = 1
WHERE (password = "'.md5($_GET['hash']).'") AND (timestamp = '.base64_decode($_GET['stamp'].')
You can then check mysql_affected_rows() to make sure that only 1 row was changed; if so, send the welcome e-mail (if you wish to, or just display a success message) otherwise, display an error.
Although I have not provided much code, the point of this article is to allow you to discover the logic behind e-mail validation and then incorporate it into your own system. The concepts behind the hash/stamp generation and coding remain the same, whatever value you use the create them.
By adding this feature to your system, you have immediately increase overall security by ensuring that a real person has to validate their account.
Tutorial provided by olate.com/olate.co.uk
