Email Verification – How To in PHP

While developing any web application, email verification is something that you must be doing as part of first step of the security for your web application. This feature confirms that real owner of an email address is actually using that email address and nobody else is creating account using the actual owner’s email address.

This feature initially irritated the users who were used to click on signup button and were able to login instantly.

The extra actions of log in into mailboxes and searching for activation mail in inbox and then clicking on them, really bothered users those days. But this adds an extra step of security for identity threat. Now you cannot find a website where you won’t be needing email or phone number validation. In this blog I will discuss step by step how can the email address verification be added to a PHP based web application.

Step 1: Database (Split it up)

For dynamic web applications database does play a very crucial role because most of the contents of the application are stored in database and they get pulled up logically based on the code and logic written on the pages.

All user’s information are stored in database tables. A lazy and early days programmer store all user information in one table. But to implement the email verification feature and for the sake of best practices we will segregate user’s attributes into 2 categories and use 2 separate tables

user_account_master – For Account Attributes
user_profile_master – For Profile Attributes

Account Attributes are attributes necessary to have users’ account set up and ready to authenticate.
Examples of Account attributes are , username, email address, password etc.

Profile Attributes are the additional attributes related to the users. Examples of profile attributes are First name, Last name, Address etc.

In this post we will deal with only account attributes so the table we will be considering is only user_account_master.

This table will have regular attributes for login except the below 2

1. act_key
2. status

The ‘status’ column will have integer value and we will consider

0 = Activation Required
1 = Active

The act_key will hold the encrypted value of the Activation key or OTP.

So the complete user_account_master will look as below

user_account_master

Step 2: Signup Page

This is a simple HTML page with a very simple form. This page serves as the first page where users will be asked to provide only few details required for signup.

User Name
Password
Confirm Password
Email Address
Confirm Email Address
So our basic Signup.html will have the below HTML code

Username

Email Address

Password

Retype Password

Step 3 : register.php

Once the previous HTML page is submitted the form will be posted to a PHP page. In this PHP page will do the below actions one by one

Generate a random key.

This is how we can generate a random key. This will give a random integer number between 1 and 100. You can use any logic you want.

rand(1,100)

Hash that key (I used MD5). I used below code to generate and hash altogether.

$key = md5(rand(1,100));

Insert other account details and the hashed key into database. While inserting the value of status column will be 0

$uname = $_REQUEST[‘uname’];
$password=$_REQUEST[‘passwd’];
$email=$_REQUEST[’email’];
$key = md5(rand(1,100));
$query=”insert into user_account_master values(”,’$uname’,’$email’,’$password’,now(),0,’$key’)”;
mysql_query($query);

Generate the content of the email and activation url to be sent to user.

Query the user_account_master table to get UID for the newly created user. While querying can search with email or user-name as those are unique. Then form a url to activate.php with UID and Key in header as below.

http://example.com/activation.php?uid=12345&key=xxxxxxxxxxxxxxxxxxx

I used a function to generate the mail content and the code for the funstion is as below

function generateMailBody($uname,$uid,$key)
{
$body =CONTENT1.$uname.CONTENT2.CONTENT3.CONTENT4.CONTENT5.SITE_URL.”/activate.php?uid=”.$uid.”&key=”.$key.CONTENT6.CONTENT7.CONTENT8.SITE_NAME;
return $body;

}

The mail content will look like below

Activation Email Content

Where clicking on the link will take user to the url

http://localhost/signup/phpMailVerification/activate.php?uid=15&key=e4da3b7fbbce2345d7772b0674a318d5

The database entry for newly created user at this stage will look like below

After Signup

Step 4: Activation Code – activate.php

In this example the activate.php will serve the action of activating account upon receiving exact act_key for specific user. This page will take 2 request parameters

The url formed during registration process will be of the below format
http://example.com/activate.php?uid=12345&key=xxxxxxxxxxxxxxxxxxx

This page will simply update the status in user_account_master table for the record matching the uid and key passed in url.

$uid=$_REQUEST[‘uid’];
$key=$_REQUEST[‘key’];

$update_query =”update user_account_master set state=1 where uid=$uid and act_key=’$key'”;
mysql_query($update_query);
$num= mysql_affected_rows();

Now the $num will be 1if any record is updated else it will be 0.

So if we get $num=1 we can display a success message else a failure message.

After successful activation the same entry in database will look like below

After Activation

5. Secure Login Page

The login page is the final part where we need to put a check for user status. While querying data-base for successful login we must query with username , password and status.

username and password will be passed by users and status must be equals to 1 to be able to login.

This way it will restrict users from login until unless email account is verified.

Simple login html will look as below

The code for login will be as below

$uname=$_REQUEST[‘uname’];
$password=$_REQUEST[‘passwd’];

$login_query=”select * from user_account_master where uname=’$uname’ and password=’$password’ and state=1″;
$login_result=mysql_query($login_query);
$num_rows=mysql_num_rows($login_result);

If $num_rows =1 then login is successful , else login will be considered failure.

For the 2 users in database screen-shot below login will be successful for test91 , while it will fail for test92 as email is not yet verified and account is not yet activated (state=0)

Both types of accounts

Final words

This is a basic tutorial to show how to do basic email verification / account activation. This can be leveraged to develop features like OTP , forgot password etc.

All the source codes used for this blog and the MySql table structure are on the below Github workspace https://github.com/anisoftcorporation/phpMailVerification.git

I welcome readers’ comments and suggestions.

Please follow and like us: