[SOLVED] activation email not always activating.

[dolcezza]

I have a register script that sends an email after registering to activate membership. It turns the field "activated" from 0 to 1. It is working sometimes and not others. It is showing the message that says "Success...", but no success email is being sent and "activate" is remaining at 0. Any ideas?

ID is coming from the link...http://.......activate.php?id=8cc1651440deadca1111e1dc2400654cfb836f23, and it is showing up in the address bar.

<?php
require_once("db_connect.php");

$id = $_GET['id'];

$query = mysql_query("SELECT * FROM mem WHERE Actkey = '$id'") or die(mysql_error());
$row = mysql_fetch_array($query);

if(mysql_num_rows($query) > 0){

$user = $row['user_id'];

$do = mysql_query("UPDATE mem SET activated = 1 WHERE user_id = '$user'") or die(mysql_error());
$send = mail($row['user_email'] , "Activation Confirmation" , "Thank you for activating your account, you are now fully registered and able to use our services.\n\nTo login, click the link below:\nhttp://www.caregivingsocal.com/signin.php" , "FROM: [email protected]");

?>
//other html here

<?php

if(($do)&&($send))
{

echo '
<div id="success">
<p>Activation successful! A confirmation email has been dispatched. You can now login!</p>
<p><a href="https://www.caregivingsocal.com/signin.php">Click here</a> to goto the login page.</p>
</div>';

} else {

echo '
<div id="error">
<p>We are sorry, there appears to be an error processing your activation. Please try again later.</p>
</div>';

}

} else {

echo '
<div id="error">
<p>Sorry, your activation code was incorrect. Please try again.</p>
</div>';

}

?>

[cooldude832]

because you could have a duplicate key

Email activations should send two or three parts of data for verification

 

1) The UserID or Username to be activated

2) The random Code used that forces the email activation

3) a second random code or phrase for redundancy to prevent a person from breaking it easily.

 

Having only a single item (#2) can allow duplicate codes to activate the wrong users

 

also try and run the query in phpmyadmin and see what it says

[dolcezza]

So since the id is in the email as part of the link, is their a way to pass the username too or do I need to have them enter it in a form?

 

[cooldude832]

it doesn't matter where the link is its linking to a file that test that id so just mod the GET query string to say

 

activate.php?username=USERNAME&id=ACTIVATEDID

 

that is all you need to do and it should solve any possibilities of duplicate Keys

[dolcezza]

Thanks, I added username and I think it works ok. It activated me.

Your help is appreciated.