Question

Thanks to a youtube tutorial from Nickfrosty on being able to create a proper registration system in php, I have been able to convert his code from mysql to mysqli and was able to send an activation link by email after the user has registered.

Below is the code where it inserts the registration details in the database and sends the message and activation link to the user’s email after the user has registered.

$code = md5(rand());

$insertsql = "
INSERT INTO Teacher
(TeacherForename, TeacherSurname, TeacherEmail, TeacherAlias, TeacherUsername, TeacherPassword, Code)
VALUES
(?, ?, ?, ?, ?, ?, ?)
";
if (!$insert = $mysqli->prepare($insertsql)) {
// Handle errors with prepare operation here
}                                           

$insert->bind_param("sssssss", $getfirstname, $getsurname,
$getemail, $getid, $getuser,
$teacherpassword, $code);

$insert->execute();

if ($insert->errno) {
// Handle query error here
}

$insert->close();

$site = "http://helios.hud.ac.uk/......../Mobile_app";
$webmaster = "Mayur Patel <[e-mail]>";
$headers = "From: $webmaster";
$subject = "Activate Your Account";
$message = "Thanks for Registering. Click the link below to Acivate your Account. \n";
$message .= "$site/activate.php?user=$getuser&code=$code\n";
$message .= "You must Activate your Account to Login";

if(mail($getemail, $subject, $message, $headers)){
$errormsg = "You have been Registered. You must Activate your Account from the Activation Link sent to <b>$getemail</b>";
$getfirstname = "";
$getsurname = "";
$getid = "";
$getuser = "";
$getemail = "";
}

But I have an issue now. If I click on the link, it navigates the user to the activate.php page.

My question is: after the user has clicked on the activation link, how does it activate the user’s account? I need it to be able to recognize the user’s username and activation code by looking it up in the php above $message .= "$site/activate.php?user=$getuser&code=$code\n"; and then in the database I need it to update the Active column for that user from 0 to1`, so that the user is now active. Is the below statement correct:

"UPDATE Teacher SET Active='1' WHERE TeacherUsername = '$getuser'"
"SELECT * FROM Teacher WHERE TeacherUsername='$getuser' AND Active='1'"

The activate.php page simply displays a message, stating that account is activated. If user has already been activated, then I want it to display message stating user has already been activated.

Answer 1

This is how I’d code the activate.php :

Code :

$sUser = $_GET['username'];
$sCode = $_GET['code'];

//MYPRIVATEKEY defined on a conf.php or else
$sEncodedUser = hash_hmac('sha1', $sUser, 'MYPRIVATEKEY');

if($sEncodedUser == $sUser) {
    $sQuery = "UPDATE USER SET activated=1 WHERE USERNAME = " . escape($sUser);
    //RUN $sQuery;
    echo 'Account activated !';
} else {
    echo 'Problem when activating your account';
}