[SOLVED] Subscription removal

[zVirx]

Hello, i have an issue with the design of a news subscription script..

well here is the problem...

 

It a news teller subscription script and its for anyone not necessary a user .. so it takes only the email:

- Validate it .

- Check if its already in the database.

- Add it to the database.

 

The issue if the one who subscribed wants to remove his subscription...

that's another script that also takes only the email:

- Validate it.

- Check if its in the database.

- Remove it from the database.

 

Now anyone can remove any email form the database, by just typing a correct email that exist in the database in the un-subscription script.

 

I can't find a proper way of validating the integrity of the input email.

I was thinking maybe i could send him an email with an ID key, which he must use to un-subscribe his email ! .. but i don't know if that's the right way to go.

 

What do you guys think, Thanks.

[Daniel0]

I'd just generate an unsubscribe token when they subscribe and store it with the email in the database. Then in the bottom of each email you could have a like like this:

 

http://example.com/unsubscribe.php?email=john@doe.com&token=Kjha987Hlad8a7Dkjhadd

[zVirx]

Oh i was thinking of giving the unsubscribe script its own form... but that's actually better.

One question though, there is no security issues with using the ID of the email instead of the token , is there ?

 

so the link would look like:

http://example.com/unsubscribe.php?email=john@doe.com&id=1

 

its just i don't want to overflow the database with hashes like this.

[Daniel0]

Unless you can somehow predict the order in which people subscribed, I suppose not.

[gevans]

http://example.com/unsubscribe.php?email=john@doe.com&id=1

 

Again, if someone knows a valid email address and really wants to piss someone off it wouldn't be to hard to write some javascript to push out a load of links with that email address and an incrementing id.

 

Daniel's original suggestion of a token would be a better option IMO. The only person that will ever see the token is the receiver of the email. Nice and simple, easy to do.

[zVirx]

Unless you can somehow predict the order in which people subscribed, I suppose not.

 

I was thinking the same thing :S

But thought no one would go through it.

 

Again, if someone knows a valid email address and really wants to piss someone off it wouldn't be to hard to write some javascript to push out a load of links with that email address and an incrementing id.

 

Daniel's original suggestion of a token would be a better option IMO. The only person that will ever see the token is the receiver of the email. Nice and simple, easy to do.

 

Umm thats true... Ok i'll go with the tokens instead. i was just concerned about the performance but i guess that wouldn't affect it that much.

 

Thanks guys.