From 039d1b1f2abec050aa6618626faad128f57c458a Mon Sep 17 00:00:00 2001 From: Thies Mueller Date: Tue, 12 Jan 2021 17:33:41 +0100 Subject: [PATCH] commented activation.php --- activation.php | 57 +++++++++++++++++++++++++------------------------- 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/activation.php b/activation.php index 3ee8403..9e061fe 100644 --- a/activation.php +++ b/activation.php @@ -7,11 +7,11 @@ No Valid User in Session. Please Login Again!'; - } else { - $statement = $pdo->prepare("SELECT * FROM users WHERE username = :username"); + } else { //if theres a valid session do this: + $statement = $pdo->prepare("SELECT * FROM users WHERE username = :username"); //sql statement username = $sessionuser $result = $statement->execute(array('username' => $sessionuser)); $user = $statement->fetch(); - if($user === false) { + if($user === false) { //in some cases users have a valid session, but the account was deleted in the background, this has that case covered: $error = 'no user found'; } - if($user['username'] == ""){ + if($user['username'] == ""){ //if you've managed to create a user without username, print an error. $error = 'no user found'; } - if($user['activated'] == "1"){ + if($user['activated'] == "1"){ //if your account is already activated: $error = 'user already activated!'; } else { - //check if theres a code already - $activationcode = random_string(); - $statement = $pdo->prepare("UPDATE users SET activationcode = :activationcode, activationcode_time = NOW() WHERE id = :userid"); - $result = $statement->execute(array('activationcode' => sha1($activationcode), 'userid' => $user['id'])); - - $mailrcpt = $user['email']; - $mailsubject = "Activate the Account of ".$user['username']; - $from = "From: Account Activation Service "; //place a real address if we use this in production - $url_activationcode = 'https://'.$_SERVER['HTTP_HOST'].'/activate.php?userid='.$user['id'].'&code='.$activationcode; //this shouldnt be my domain in prod.. - $text = 'Hallo '.$user['username'].', + $activationcode = random_string(); //store a random string in this variable + $statement = $pdo->prepare("UPDATE users SET activationcode = :activationcode, activationcode_time = NOW() WHERE id = :userid"); //prepare the statement + $result = $statement->execute(array('activationcode' => sha1($activationcode), 'userid' => $user['id'])); //activationcode in db is sha1 of real activationcode + //now lets compose a mail: + $mailrcpt = $user['email']; //mail goes to user that should be validated. + $mailsubject = "Activate the Account of ".$user['username']; //the subject + $from = "From: Account Activation Service "; //send mail from "activatemyaccount@%urlyourusingtoaccessthisscript%" + $url_activationcode = 'https://'.$_SERVER['HTTP_HOST'].'/activate.php?userid='.$user['id'].'&code='.$activationcode; //url for activation is https://%urlyourusingtoaccessthisscript%/activate.php?userid=$userid&code=$activationcode + //thats the content of the mail: + $text = 'Hallo '.$user['username'].', please use the following URL to activate your account in the next 24h: '.$url_activationcode.' @@ -64,15 +64,16 @@ If this mail comes unsolicited, please just ignore the mail. cheers loginpagefoo script'; - mail($mailrcpt, $mailsubject, $text, $from); + mail($mailrcpt, $mailsubject, $text, $from); //sending the mail with the build-in mail function. echo 'Link send. Going back to profile page. '; + //afterwards going back to profile, and dont render the form again. $showForm = false; } } } -if($showForm): +if($showForm): //you guessed it: html & the form: ?>

Activate user

@@ -88,5 +89,5 @@ if(isset($error) && !empty($error)) { \ No newline at end of file