Current Location: Home> Latest Articles> Best Practices for Using Email Verification in PHP to Prevent Malicious User Logins and Registrations

Best Practices for Using Email Verification in PHP to Prevent Malicious User Logins and Registrations

M66 2025-06-29

Using Email Verification in PHP to Prevent Malicious User Logins and Registrations

As the internet has become ubiquitous, user login and registration features have become standard parts of most websites and applications. However, with the increase in malicious users, ensuring the authenticity of users and preventing spam account registrations has become a critical issue. Email verification is a common method that effectively prevents malicious user registrations and logins.

Creating the Database Table

First, we need to create a database table to store user email information. Below is a simple structure for the database table:

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    email VARCHAR(255) NOT NULL,
    verification_code VARCHAR(255) NOT NULL,
    is_verified TINYINT(1) DEFAULT 0
);

In this table, we store the user's ID, email, verification code, and verification status. When a user registers, the system will generate a verification code and send it to the user's email.

Implementing the Registration Function

To implement the user registration functionality, the following steps need to be followed:

  • Validate the email address input by the user.
  • Check if the email is already registered.
  • Generate a verification code and store it in the database.
  • Send the verification code to the user's email address.

Below is an example of PHP registration functionality:

<?php
// Get the email address input by the user
$email = $_POST['email'];

// Validate the email format
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo 'Invalid email address';
    exit;
}

// Check if the email is already registered
$existingUser = $db->query("SELECT * FROM users WHERE email = '$email'")->fetch(PDO::FETCH_ASSOC);
if ($existingUser) {
    echo 'This email is already registered';
    exit;
}

// Generate the verification code
$verificationCode = md5(uniqid(rand(), true));

// Save the verification code in the database
$db->query("INSERT INTO users (email, verification_code) VALUES ('$email', '$verificationCode')");

// Send the verification code to the user's email address
$subject = 'Email Verification';
$message = 'Your verification code is: ' . $verificationCode;
$headers = 'From: noreply@example.com';
mail($email, $subject, $message, $headers);

echo 'Please check your email and enter the verification code to complete verification';
?>

In this code, we use PHP's filter_var() function to validate the email format and check if the email is already registered. If the email is valid and not already registered, we generate a verification code and store it in the database. Finally, we use the mail() function to send the verification code to the user's email address.

Implementing the Verification Function

After receiving the verification code, users need to input the code to verify their email. Below are the steps for implementing the verification functionality:

  • Retrieve the verification code input by the user.
  • Check if the verification code matches the one stored in the database.
  • Update the user's verification status.

Below is an example of PHP code for the verification functionality:

<?php
// Get the verification code input by the user
$verificationCode = $_POST['verification_code'];

// Check if the verification code matches the one stored in the database
$existingUser = $db->query("SELECT * FROM users WHERE verification_code = '$verificationCode'")->fetch(PDO::FETCH_ASSOC);
if (!$existingUser) {
    echo 'Incorrect verification code';
    exit;
}

// Update the user's verification status
$db->query("UPDATE users SET is_verified = 1 WHERE verification_code = '$verificationCode'");

echo 'You have successfully verified your email';
?>

In this code, we query the database to find a record with a matching verification code. If a matching record is found, we update the user's verification status to 'verified'.

Conclusion

By following these steps, we have implemented a basic email verification system to prevent malicious user logins and registrations. In real applications, you can combine additional security measures such as password strength requirements, IP restrictions, and multi-factor authentication to further enhance security.

Email verification not only ensures the authenticity of user registrations but also adds an extra layer of security to your website. We hope this article has helped you understand how to implement email verification in PHP to prevent malicious users from registering and logging in.

Related