[SOLVED] Validate Email using generated password or validation link?

[limitphp]

Is it more secure to validate a user's email address using a generated password sent to their email address or using a validation link sent to their email address?

 

Thanks

[GingerRobot]

Doesn't really matter either way so long as the link couldn't be guessed.

[limitphp]

Doesn't really matter either way so long as the link couldn't be guessed.

Would something like md5(uniqid(rand(),true).$salt) be ok to use?

 

I understand how to send a link to their email address with a unqiueID as a querystring, but I'm not sure how to implement it from there.

 

Would I create a page, like validateUser.php and on that page accept querystrings with these uniqueIDs, and match them up with a userID in a table?

 

 

 

 

[GingerRobot]

Yep, that should be fine.

 

And that sounds about right. When the user registers, you should store this validation code in the database too. You'd then search the database for the validation code that the user provides and then active that user's account.

[limitphp]

Thanks for the help!

[gevans]

You could just use a guid, php 5+ has a built in function

 

function guid(){
    if(function_exists('com_create_guid')) return substr(com_create_guid(), 1, 36);
    else {
        $uid = strtoupper(md5(uniqid(rand(), true)));
        $h = '-';
        $uuid = substr($uid, 0, .$h.substr($uid, 8, 4).$h.substr($uid,12, 4).$h.substr($uid,16, 4).$h.substr($uid,20,12);
        return $uuid;
    }
}

[limitphp]

You could just use a guid, php 5+ has a built in function

 

 

What is the difference between a guid and a uniqID?

[gevans]

Uniqid;

 

Gets a prefixed unique identifier based on the current time in microseconds

 

GUID;

 

A GUID is generated in the same way as DCE UUID's, except that the Microsoft convention is to enclose a GUID in curly braces.

 

Basically UNIQID can be used to build a GUID in older versions of PHP

[limitphp]

Uniqid;

 

Gets a prefixed unique identifier based on the current time in microseconds

 

GUID;

 

A GUID is generated in the same way as DCE UUID's, except that the Microsoft convention is to enclose a GUID in curly braces.

 

Basically UNIQID can be used to build a GUID in older versions of PHP

 

When I send the link with the unqiueID, do i need to put the link in curly braces?

ex) validate.php?verify={sdhjkjh345kjh45kjh6jha90}

 

 

[gevans]

no, The function I wrote strips the curly brackets from the start and end of the ID