Member Avatar for MDGM

Hi all,

I have a registration form on my website which once filled in, it sends an email to the user with a link to "verify their email address". This link holds all of the information entered by the user in the form and looks something like this:

When the user clicks the link the php script on confirm.php gets the values from the address bar and enters them into the database.

however the address bar also holds passwords and usernames etc and so it would be very easy for somebody to steal the user's username and password, so for this reason i need to encrypt the values of the field data held in the address bar. They can be decrypted on the confirm.php page if needed.

Thanks for the help,

Max

  • 4 Contributors
  • 4 Replies
  • 177 Views
  • 19 Hours Discussion Span
  • Latest Post Latest Post by MDGM

Dani AI

Generated

Good thread — a few clarifications and a practical pattern that will keep accounts safe.

Putting usernames or passwords into a URL is the real problem here. What suggested (an encoding step) is reversible and won't protect secrets. was right that transport encryption (HTTPS) matters, but it only protects the link in transit — it does not stop the token from being exposed later (email archives, logs, referer headers). And 's POST idea doesn't apply to emailed links, because clicking a link issues a GET.

Safer pattern to implement (stateless data in the email is not required):

  • Generate a long random token server-side.
  • Store only a hash of that token together with the user id and an expiry timestamp.
  • Send the raw token in the emailed link (no password, no other secrets).
  • When confirm.php receives the token, hash it and look up the stored hash; if it matches and is unexpired, mark the account verified and invalidate the token.

Example (PHP):

$token = bin2hex(random_bytes(32));          // ~256 bits
$tokenHash = hash('sha256', $token);
// save $userId, $tokenHash, time()+86400 to a verification table
$mailLink = "https://example.com/confirm.php?token=$token";

Verification side:

$token = $_GET['token'] ?? '';
$tokenHash = hash('sha256', $token);
$row = findTokenRowByHash($tokenHash); // use prepared statements
if ($row && hash_equals($row['token_hash'], $tokenHash) && $row['expires_at'] > time()) {
    // mark verified, delete/invalidate token
}

Extra tips: set a short expiry (e.g. 24 hours), make tokens one-time use, use prepared statements, and always serve the confirmation page over HTTPS. If you need to include form fields in the link without server-side state, use authenticated encryption (libsodium or AES-GCM) — but that is more complex; the token approach is simpler and robust for email verification.

Recommended Answers

All 4 Replies

Member Avatar for buddylee17

Most good encryption methods don't have simple decryption. However, if something simple will work, you can use base64_encode and .

Member Avatar for lordspace

You can do 2 things:

#1 The confirmation script has to be changed to verify the user only by userid + hash e.g. phpbb2 and phpbb3

#2 buy an SSL certificate for your domain

Slavi

Member Avatar for ryan_vietnow

Use post method so variables will not be seen in the address.

Member Avatar for MDGM

Thanks for the help everybody,

Iv just gone for the simplist one - base64. i actually looked into this before posting this thread but for some reason dismissed it because i thought it wouldn't work! :P

The other methods at the moment are a bit out of my skill level but they will be useful for other people looking on this forum or possibly myself later in my php career :)

Thanks for the help,

Max

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.