Question

So I’m learning PHP with MYSQL right now. Making a user registration and mail verification system for fun.
So I understand that it is standard to use md5 hash verification. However I was just wondering what is the standard way of activating the account once the hashes match.

I was thinking of maybe doing something like changing a default 0 to a 1 when the verification has been done.
And use that to determine unverified vs verified accounts. I just want to know is there anything wrong with this and is there a better way?

Thanks!

Answer 1

Your approach should be fine.

Using MD5 isn’t considered particularly good practise these days, since MD5s can be quite easy to crack. In this case, using a suitable salt should be sufficient to avoid the issue though.

It might be better to use bcrypt (or another hashing algorithm that allows you to adjust the work factor) as a general rule, so you can ensure that brute-force cracking is never feasible.