0

When users create an account on my site, they are suppose to receive a confirmation code to verify their email address; however, about 15% of users are claiming they didn't recieve an email, even in their spam. I have not found a pattern to what emails work and which don't. In order to validate that users don't create an account with an existing email, I do lowercase emails prior to inserting into database. Could this ever cause an issue? Also, their accounts are being created successful, they just aren't receiving the code.

<?php
    if(isset($_POST['firstName']) and isset($_POST['lastName']) and isset($_POST['username']) and isset($_POST['password'])){
        $firstName = $_POST['firstName'];
        $lastName = $_POST['lastName'];

        $username = strtolower(trim($_POST['username']));   //email address
        $password = trim($_POST['password']);
        $fullName = $firstName . " " . $lastName;

        $firstNameValid = preg_match ("/^[a-zA-Z\s]+$/",$firstName);
        $lastNameValid = preg_match ("/^[a-zA-Z\s]+$/",$lastName);

        if (filter_var($username, FILTER_VALIDATE_EMAIL)) {$emailValid =true;
        } else {$emailValid = false;}
    
        if(strlen($password) >7){$passwordValid = true;} else {$passwordValid = false;}
                
        $password = password_hash($password, PASSWORD_BCRYPT, array(
                    'cost' => 12
                ));
                
        if($firstNameValid and $lastNameValid and $emailValid and $passwordValid){
            include "databaseLogin.php";
            $stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
            $stmt->bind_param('s', $username);
            $stmt->execute();
            $result = $stmt->get_result();

            while($row = mysqli_fetch_assoc($result)){
                echo "userExists";
                return;
            }

            $emailVerification = substr(str_shuffle("1234567890QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm"), -8);
            $emailVerification = $emailVerification;
            $emailVerifyEncrypted = encryptThis($emailVerification);    
            //encryptThis function is stored in databaseLogin.php file

            $stmt = $conn->prepare("INSERT INTO users (username, password, first_name, last_name, full_name, verify_email) VALUES (?, ?, ?, ?, ?, ?)");
            $stmt->bind_param("ssssss", $username, $password, $firstName, $lastName, $fullName, $emailVerifyEncrypted);

            if ($stmt->execute()){
                $lastId = $conn->insert_id;

                $message = "Hello " . $firstName . ",\r\n\r\n" . "Your verification code is: " . $emailVerification . "\r\n\r\n" . "Copy and paste your verification code into the verification box.";
                $message = wordwrap($message, 70, "\r\n");

                $headers = "Reply-To: My Website <info@mydomain.com>\r\n";
                $headers .= "Return-Path: My Website <info@mydomain.com>\r\n";
                $headers .= "From: My Website <info@mydomain.com>\r\n";
                $headers .= "Content-type: text/plain; charset=iso-8859-1\r\n";
                $subject = "Email Verification";
                
                mail($username,$subject,$message,$headers);
                echo "Success"; 
            } else {
                echo "Error: " . $sql . "<br>" . $conn->error;
            }
            $conn->close(); 
        } else {
            if(!$firstNameValid or !$lastNameValid){
                echo "invalidName";
            } else if(!$emailValid){
                echo "invalidEmail";
            } else if(!$passwordValid){
                echo "invalidPassword";
            }
        }       
    }
?>
James
  • 37
  • 1
  • 5
  • Start checking the return value for [mail](https://www.php.net/manual/en/function.mail.php), which says: "Returns true if the mail was successfully accepted for delivery, false otherwise." – Luuk May 14 '22 at 06:30
  • Sending mail is easy, just use `mail()`, it always works. Getting mail to arrive is much harder. Most people have mail boxes with advanced spam filters. To get accepted by these filters you need to do something. See: [What is DKIM & SPF? And How to Set It Up?](https://woodpecker.co/blog/spf-dkim/) and there is also DMARC. Please note that if you don't do this most people won't even get your mail in their spam box. My webhost has a mail relay which takes care of these things for me. – KIKO Software May 14 '22 at 06:31
  • 1
    If everything else fails, maybe your IP or domain is blacklisted. This can easily happen if you are on shared hosting. One option to check is here https://mxtoolbox.com/blacklists.aspx – Guido Faecke May 14 '22 at 06:31
  • I am on shared hosting. Thanks for your suggestions. I will start checking the return value for mail as well. – James May 14 '22 at 06:34

0 Answers0