$_GET["token"] returning a different value from what is in source url

[terungwa]

As part of the registration procedure, my PHP application generates the mail below and presents the option to a user to click on the url in the mail to activate his account.

Please click on this link
http://www.example.org.ng/activate.php?token=XeZNYf8uDVYxAY5+RBqldOosI1hm/FjB0cLnXB8R
to activate your account.

The activate.php script returns that their is no record of this token in the database, even though it is there.

In troubleshooting, i printed the $token = $_GET["token"] in the activate.php script; and this is what i got

XeZNYf8uDVYxAY5 RBqldOosI1hm/FjB0cLnXB8R

.

 

Notice that the $token variable is missing one character, (the +), which is the 16th character form the left!!

 

Why this would happen is unclear. Any thoughts.

 

If it helps, the is the script generating my random tokens:

function generateToken($length = 40)
{
   if(function_exists('openssl_random_pseudo_bytes')) 
   {
     $token = base64_encode(openssl_random_pseudo_bytes($length, $strong));
     if($strong == TRUE)
     return substr($token, 0, $length); //base64 is about 33% longer, so we need to truncate the result
   }
  //fallback to mt_rand if php < 5.3 or no openssl available
  $characters = '0123456789';
  $characters .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz^!$'; 
  $charactersLength = strlen($characters)-1;
  $token = '';
  //select some random characters
  for ($i = 0; $i < $length; $i++) 
  {
    $token .= $characters[mt_rand(0, $charactersLength)];
  }        
  return $token;
}
$token=generateToken($length = 40);

Edited June 9, 2014 by terungwa

[.josh]

+ is url encoded version of a space. You need to urlencode your token so that it's not decoded to a space when someone clicks on the link.

 

consider this:

 

$x = "foo bar+foobar";
echo urlencode($x); // output: foo+bar%2Bfoobar

notice how the space got encoded to a +, but the + got encoded to the encoded value of %2B. You want the generated token to look like the latter, so that when a visitor clicks on a link, it will decode %2B to a literal + instead of decode + to a space.