HGeneAnthony Posted May 13, 2011 Share Posted May 13, 2011 I'm working on a new user submission form and I was wondering whether it's safe to send a confirmation letter to the user using their hashed password as their confirmation code? Since this is a hashed password it can't be decrypted (I believe), the password is useless because it's always hashed before login so it can't be used to login to the system, it's only being emailed to the user who's account is tied to the account, and it would save me the option of having to store a confirmation code field in my DB. Is this safe? Link to comment https://forums.phpfreaks.com/topic/236285-should-i-use-a-hashed-password-for-a-confirmation-code-on-new-user-accounts/ Share on other sites More sharing options...
JasonLewis Posted May 13, 2011 Share Posted May 13, 2011 I generally just generate a random confirmation code like you mentioned. Only takes a couple extra lines of code. Link to comment https://forums.phpfreaks.com/topic/236285-should-i-use-a-hashed-password-for-a-confirmation-code-on-new-user-accounts/#findComment-1214825 Share on other sites More sharing options...
jonsjava Posted May 13, 2011 Share Posted May 13, 2011 I would do something like this function genURL($id,$uname){ $salt = rand(0,94821); return base_convert($id.$uname.$salt,34,16); } Then, store the result in your database as verification key. Link to comment https://forums.phpfreaks.com/topic/236285-should-i-use-a-hashed-password-for-a-confirmation-code-on-new-user-accounts/#findComment-1214826 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.