验证链接未激活帐户

时间:2013-01-31 10:47:49

标签: php mysql

所以我在注册后发送了一个链接来验证一个帐户,该链接包含用户的电子邮件地址和一个32个字符的代码,例如:

                $to      = $email;
                $subject = 'Signup | Verification';
                $message = '

                Thanks for signing up!
                Your account has been created, you can login with the following credentials after you have activated your account by pressing the url below.

                ------------------------
                Username: '.$username.'
                Password: '.$password.'
                ------------------------

                Please click this link to activate your account:
                localhost:8888/website/verify.php?email='.$email.'&hash='.$hash.'
                '; 

                $headers = 'From:myemail@email.com' . "\r\n"; 
                mail($to, $subject, $message, $headers); 

这一切似乎都运行正常我收到的电子邮件中包含以下链接:

http://localhost:8888/website/verify.php?email=myemail@email.com&hash=fe646d38bc2145ca6c3cf77d52820cd0

当我按照链接并尝试激活帐户时出现问题。我需要验证Verify.php,但我一直收到Invalid Approach,我无法将验证设置为1.

    <?php include "includes/base.php"; ?>

    <?php

        if(isset($_GET['Email']) && !empty($_GET['Email']) AND isset($_GET['Hash']) && !empty($_GET['Hash'])){
            $email = mysql_escape_string($_GET['Email']); 
            $hash = mysql_escape_string($_GET['Hash']); 
            $search = mysql_query("SELECT Email, Hash, Validation FROM users WHERE Email = '".$email."' AND Hash = '".$hash."' AND Validation = 0") or die(mysql_error()); 
            $match  = mysql_num_rows($search);


            if($match > 0){
                mysql_query("UPDATE users SET Validation = 1 WHERE Email = '".$email."' AND Hash = '".$hash."' AND Validation = 0") or die(mysql_error());
                echo "Your account has been activated, you can now login";
            }else{
                echo "The url is either invalid or you already have activated your account.";
            }

        }else{
            echo "Invalid approach, please use the link that has been sent to your email.";
        }


    ?>

3 个答案:

答案 0 :(得分:2)

1)此代码不安全,因为它有SQL注入问题。使用prepared statements 请记住,不再支持 mysql _ * 功能,它们是depriated

2)关于你的代码,我发现你的GET请求的'email'和'hash'都是小写的,但在PHP代码中你使用$ _GET ['Email']和$ _GET ['Hash']。 你需要改变这个:

 if(isset($_GET['Email']) && !empty($_GET['Email']) AND isset($_GET['Hash']) && !empty($_GET['Hash'])){
            $email = mysql_escape_string($_GET['Email']); 
            $hash = mysql_escape_string($_GET['Hash']); 

到此

 if(isset($_GET['email']) && !empty($_GET['email']) AND isset($_GET['eash']) && !empty($_GET['eash'])){
            $email = mysql_escape_string($_GET['email']); 
            $hash = mysql_escape_string($_GET['eash']); 

或将您的GET请求更改为下一个:

http://localhost:8888/website/verify.php?Email=myemail@email.com&Hash=fe646d38bc2145ca6c3cf77d52820cd0

答案 1 :(得分:0)

Hash更改为hash&amp; Emailemail。 (大写,但不是你发送的链接)

此外,您的代码很容易受到SQL注入攻击,因为您直接使用url中的值来查询数据库。在进行查询之前,请使用mysql_real_escape_string并执行一些健全性检查。

答案 2 :(得分:0)

PHP中有大写字母,而链接中没有大写

$_GET['Email']

verify.php?email=myemail@email.com