How to Implement Email Verification for New Members

How to Implement Email Verification for New Members

Have you ever created an account with a website, and were required to check your email and click through a verification link sent by the company in order to activate it? Doing so highly reduces the number of spam accounts. In this lesson, we’ll learn how to do this very thing!

Looking for a Shortcut?

This tutorial teaches you to build an email verification script from scratch, but if you want something that you can use on your website right away, check out some of the great email forms and scripts on CodeCanyon.

  • PHP
    20 Best PHP Email Forms
    Esther Vaati

Building an Email Verification and Sign-up Script

What Are We Going to Build?

We are going to build a nice PHP sign-up script where a user can create an account to gain access to the “members only section” of a website.

After the user creates their account, the account will then be locked until the user clicks a verification link that they will receive in their  email inbox.

1. Build a Sign-up Page

We first need a simple page where our visitors can sign up their accounts.

index.php: This is our sign up page with a basic form.

css/style.css: This is the stylesheet for index.php and other pages.

Here’s what the HTML and CSS look like when they’re rendered in the browser.

Sign Up Form

As you can see, I have added a comment to each line that describes what they do. Also, you might have noticed the following comment in the index.php file:

We are going to write our PHP between these 2 lines!

2. Input Validation

The first thing we are going to build is a piece of code that’s going to validate the information. Here is a short list detailing what needs to be validated.

  • the name field is not empty
  • the name is not to short
  • the email field is not empty
  • the email address is valid with the form xxx@xxx.xxx

So our first step is checking if the form is being submitted, and that the fields are not empty.

Time for a breakdown! We start of with an IF statement and we are first validating the name field:

So if you would submit the form now with empty fields, nothing happens. If you fill in both fields then our script will run the code between the brackets.

Now we are going to create a piece of code that will check if an email address is valid. If it’s not, we will return a error. Also let’s turn our post variables into local variables:

We can now reach our data via our local variables. As you can see, I also added a MySQL escape string to prevent MySQL injection when inserting the data into the MySQL database.

The mysql_real_escape_string() function escapes special characters in a string for use in an SQL statement.

Regular Expressions

Next up is a small snippet that checks if the email address is valid.

Please note that I did not personally write this regular expression, it’s a small snippet from php.net. Basically, it verifies if the email is written in the following format:

In the eregi function call, you can see that it checks if the email contains characters from the alphabet, if it has any numbers, or a phantom dash (_), and of course the basic requirements for an email with an @ symbol and a . in the domain. If these characteristics are not found, the expression returns false. 

Okay, so now we need to add some basic error messages.

As you can see we have made a local variable $msg, this allows us to show the error or the success message anywhere on the page.

And we are going to display it between the instruction text and the form.

Finally, we’ll add a bit of CSS to style.css, to style our status message a bit.

Sign Up Form

3. Creating the Database & Establishing a Connection

Now we need to establish a database connection and create a table to insert the account data. So let’s go to PHPMyAdmin and create a new database with the name registrations and create a user account that has access to that database in order to insert and update data.

Let’s create our users table, with 5 fields:

Create DB

Now we must enter details for these fields:

Create Table

For those who don’t want to input this data manually, you can instead run the following SQL code.

Our database is created, now we need to establish a connection using PHP. We’ll write the following code at the start of our script just below the following line:

We’ll use the following code to connect to the database server and select the registrations database with a basic MySQL connection.

Now that we’ve established a connection to our database, we can move on to the next step and insert the account details.

4. Insert Account

Now it’s time to enter the submitted account details to our database and generate an activation hash. Write the following code below this line:

Activation Hash

In our database we made a field called hash, this hash is a 32 character string of text. We also send this code to the user’s email address. They then can click the link (which contains the hash) and we will verify if it matches up with the one in the database. Let’s create a local variable called $hash and generate a random MD5 hash.

What did we do? Well we are using the PHP function rand to generate a random number between 0 and 1000. Next our MD5 function will turn this number into a 32 character string of text which we will use in our activation email. 

MD5 is a good choice for generating random strings. It also used to be a common choice for hashing passwords, but it has been shown to not be secure for passwords. Instead, use the password_hash function.

Creating a Random Password

The next thing we need to is to create a random password for our member:

Insert the following information into our database using a MySQL query

As you can see, we insert all data with a MySQL escape string around it to prevent any MySQL injection.

You also might notice that the password_hash function changes the random password into a secure hash for protection. Example: if an “evil” person gains access to the database, he can’t read the passwords.

For testing, fill in the form and check if the data is being inserted into our database.

5. Send the Verification Email

Right after we have inserted the information into our database, we need to send an email to the user with the verification link. So let’s use the PHP mail function to do just that.

In the code above we send a short description to our user which contains the username and password—using the local variables we created when the data was posted. Then we created a dynamic link. 

The result of all this will look as follows:

Email Result

As you can see, it creates a URL which is impossible to guess. This is a very secure way to verify the email address of a user.

6. Account Activation

As you can see, our URL links to verify.php so let’s create that file, using the same basic template we used for index.php.

However, remove the form from the template.

The first thing we need to do is check if we have our $_GET variables (for the email and hash).

To make things a bit easier, let’s assign our local variables. We’ll also add some MySQL injection prevention by, once again, using the MySQL escape string.

Next thing is to check the data from the URL against the data in our database using a MySQL query.

In the code above, we used a MySQL SELECT statement, and checked if the email and hash matched. But beside that, we checked if the status of the account is inactive. Finally, we use mysql_num_rows to determine how many matches have been found. So let’s try this out. Just use a simple echo to return the results.

Link Result

We have a match! To change the result, simply change the email and you’ll see that the number returned is 0.

So, we can use our $match variable to either activate the account or return a error when no match has been found.

In order to activate the account, we must update the active field to 1 using a MySQL query.

So we use the same search terms for the update as we used in our MySQL select query. We change active to 1 wherever the emailhash and active fields have the right values. We also return a message telling the user that his account has been activated. You can add a message like we did here to the no match part. So the final code should look similar to the following:

Account Activation

If you visit verify.php without any strings, the follow error will be shown:

Invalid Approch

7. Create the Login 

In this final step, I will show you how to create a basic login form and check if the account is activated. First create a new file called login.php with the basic template we used before, but this time I changed the form into a login form.

The form is basic HTML, and is almost the same as the signup form, so no further explanation is needed. 

Now it’s time to write the code for the login script. We’ll add this just below the MySQL connection code. We start with something we also did in the signup form.

We first check to see if the data is being posted, and we make sure that it’s not empty.

Next, we’ve created the connection to our users table and verified if the entered data is correct. We wrote a MySQL query which would select the password hash from the database associated with the entered username. Finally, we’ve used the password_verify function to verify the input password. The $result contains TRUE if the user has entered the correct password, otherwise it would be FALSE.

And the active condition is important! This is what makes sure that you can only login if your account has been activated.

In the code above we check if the login was a success or not.

Conclusion

And that’s all it takes to create a complete email validation and login system in PHP! I hope you enjoyed the post, and if you did please leave a comment below!

Coding your own PHP is great fun and of course is the foundation for a good app. However, to save time creating more specialized features or for complete applications that you can use and customize, take a look the professional PHP scripts on CodeCanyon.

You can explore thousands of the best and most useful PHP scripts ever created on CodeCanyon.

Here are a few of the best-selling and up-and-coming PHP scripts available on CodeCanyon for 2020.

  • PHP
    11 Best PHP Event Calendar and Booking Scripts… and 3 Free Options
    Monty Shokeen
  • PHP
    10 Best PHP URL Shortener Scripts
    Monty Shokeen
  • PHP
    18 Best Contact Form PHP Scripts for 2020
    Monty Shokeen
  • PHP
    Comparing the 5 Best PHP Form Builders (And 4 Free Scripts)
    Monty Shokeen
  • PHP
    Create Beautiful Forms With PHP Form Builder
    Ashraff Hathibelagal

Leave a Comment