Question

So the connection has been established and here is the code. What im trying to do is get two var from the url and save them as a var. I am getting an error and the php is not working and i know the information in the url is correct and matched the database. The error is “The url is either invalid or you already have activated your account.” which is what the php returns if there isnt a match so im guessing that the disconnect is between the url and var setting.
Code:

if(isset($_GET['email']) && !empty($_GET['email']) AND isset($_GET['hash']) &&     !empty($_GET['hash'])){  
// Verify data  
$email = mysql_escape_string($_GET['email']); // Set email variable  
$hash = mysql_escape_string($_GET['hash']); // Set hash variable  

$search = mysql_query("SELECT email, hash, active FROM users WHERE email='".$email."' AND hash='".$hash."' AND active='0'") or die(mysql_error());  
$match  = mysql_num_rows($search);  

if($match > 0){  
    // We have a match, activate the account  
    mysql_query("UPDATE users SET active='1' WHERE email='".$email."' AND hash='".$hash."' AND active='0'") or die(mysql_error());  
    echo '<div class="statusmsg">Your account has been activated, you can now login</div>';  
}else{  
    // No match -> invalid url or account has already been activated.  
    echo '<div class="statusmsg">The url is either invalid or you already have activated your account.</div>';  
}  

}else{  
// Invalid approach  
echo '<div class="statusmsg">Invalid approach, please use the link that has been send to your email.</div>';  
}  
?>

URL:

http://www.aliahealthcare.com/verify.php?email=‘[e-mail].’&hash=’.67f7fb873eaf29526a11a9b7ac33bfac.’

Answer 1

It looks like the PHP is solid, so I don’t think that is your issue. I couldn’t help but notice, though that you have a couple of '.' in the URL. I think you need to get rid of them:

http://www.aliahealthcare.com/verify.php?email=[e-mail]&hash=67f7fb873eaf29526a11a9b7ac33bfac

To be sure, try echoing out the email and hash values before using mysql_real_escape_string. I’ll wager the code is fine, but I suspect the input.