So, I was doing a complete registering process for my iPhone app with a MySQL-database. Registering a user and finally logging in worked pretty well. But now I want that the user has to verify his E-mail first to be able to log in.
In my knowledge I'm finished, but it doesn't seem to work properly. Here's my code:
//signup.php
header('Content-type: application/json');
if($_POST) {
$username = $_POST['username'];
$password = $_POST['password'];
$c_password = $_POST['c_password'];
if($_POST['username']) {
if ( $password == $c_password ) {
$db_name = 'db';
$db_user = 'user1';
$db_password = 'myPassword';
$server_url = 'localhost';
$mysqli = new mysqli('localhost', $db_user, $db_password, $db_name);
/* check connection */
if (mysqli_connect_errno()) {
error_log("Connect failed: " . mysqli_connect_error());
echo '{"success":0,"error_message":"' . mysqli_connect_error() . '"}';
} else {
$hash = md5( rand(0,1000) );
$stmt = $mysqli->prepare("INSERT INTO users (username, password, hash) VALUES (?, ?, ?)");
$password = md5($password);
$stmt->bind_param('sss', $username, $password, $hash);
/* execute prepared statement */
$stmt->execute();
if ($stmt->error) {
error_log("Error: " . $stmt->error);
}
$success = $stmt->affected_rows;
/* close statement and connection */
$stmt->close();
/* close connection */
$mysqli->close();
error_log("Success: $success");
if ($success > 0) {
$to = $username; // Send email to our user
$subject = 'Signup | Verification'; // Give the email a subject
$message = '
Thanks for signing up!
Your account has been created, you can login with the following credentials after you have activated your account by pressing the url below.
------------------------
Username: '.$username.'
Password: '.$password.'
------------------------
Please click this link to activate your account:
http://www.mywebsite.ch/verify.php?email='.$username.'&hash='.$hash.'
'; // Our message above including the link
$headers = 'From:noreply@mywebsite.ch' . "\r\n"; // Set from headers
mail($to, $subject, $message, $headers); // Send our email
error_log("User '$username' created.");
echo '{"success":1}';
}
else {
echo '{"success":0,"error_message":"Username Exist."}';
}
}
}
else {
echo '{"success":0,"error_message":"Passwords does not match."}';
}
}
else {
echo '{"success":0,"error_message":"Invalid Username."}';
}
}
else {
echo '{"success":0,"error_message":"Invalid Data."}';
}
And here's my code for verifying:
//verify.php
header('Content-type: application/json');
$mysqli = new mysqli("localhost", "user", "myPassword", "db");
if (mysqli_connect_errno()) {
error_log("Connect failed: " . mysqli_connect_error());
echo '{"success":0,"error_message":"' . mysqli_connect_error() . '"}';
}
else
{
if(isset($_GET['username']) && !empty($_GET['username']) AND isset($_GET['hash']) && !empty($_GET['hash'])){
$username = mysqli_real_escape_string($GET['username']);
$hash = mysqli_real_escape_string($GET['hash']);
$stmt = $mysqli->query("SELECT username, hash, active FROM users WHERE username='".$username."' AND hash='".$hash."' AND active='0'");
$match = mysqli_num_rows($stmt);
if($match > 0){
// We have a match, activate the account
$mysqli->query("UPDATE users SET active='1' WHERE username='".$username."' AND hash='".$hash."' AND active='0'");
echo "Your account has been activated, you can now log in.";
}
}
else{
// No match -> invalid url or account has already been activated.
echo "The url is either invalid or you already have activated your account.";
}
}
else{
// Invalid approach
echo "Invalid approach, please use the link that has been sent to your E-mail.";
}
I get an E-mail with the same username and hash, which is saved in the database, but it still doesn't work. Instead I get a output of "Invalid approach, please use the link that has been sent to your E-mail".
I think it's logic error, because I studied a lot and changed a lot before making here a thread.
Note: I know, I should not use md5 and instead use the given functions from PHP. I promise you, that I will bring this code to the latest stage of PHP, but first I want to bring it to work. I'm actually new in this area, so for any mistakes, I apologize in advance.
Any help would be really appreciated.
