CODEWITHSUNDEEP
phpsecurityweb-applications
Celeritas
Celeritas

Reputation: 15063

When sending an e-mail to confirm user registration, at what point is the username/password stored in the database?

I'm designing a user registration form and am working on sending a confirmation e-mail. The script that is responsible for adding the username/password/e-mail address etc. to the database is getting rather long and I wanted to break the code responsible for e-mails into another file. I was thinking about how the two scripts would work together; would the database script include the e-mail script or redirect to it and pass the arguments. Or do I have it backwards? Would it be the e-mail script including/calling the database script?

What happens first? Does 1) an e-mail containing an account activation link get sent out before any data is added to the database or 2)is the data put in the database right away with an "activated" field set to false and when the user clicks on the link in the e-mail the field will be updated to true 3)or some other way?

Upvotes: 0

Views: 300

Answers (2)

Daniel Paul
Daniel Paul

Reputation: 11

Every system I've worked with has just stored the user in the database until it's used, but when spam becomes an issue you can look at other answers.

You need to store the username and password somewhere and sending it in the email is going to cause issues, and otherwise the link you give the email won't know which user to activate, and doing wacky things like storing it in the session is going to cause many, many ux issues.

Other than creating a second table for un-activated accounts, and searching both for the two different calls you need to search both (creating new user/email, and changing username/email), I don't see a better solution.

Upvotes: 1

Dave Chen
Dave Chen

Reputation: 10975

#2, this is so that other users don't take the username twice. If you don't save the information instantly, then other users can also activate their account and you'll have errors with that.

Most websites have an expire on their activation so that the usernames can't be held for a long period of time.

A column for state such as user/banned/confirmed/unactivated would be necessary to keep track of who has activated and who has not. A cron job could be used to sweep the database for old inactive users, basing on the timestamp of registration.

Upvotes: 4

Related Questions