Member Avatar for vinson89 
<?php
 require_once('recaptchalib.php');
 $privatekey = "your_private_key";
 $resp = recaptcha_check_answer ($privatekey,
 $_SERVER["REMOTE_ADDR"],
 $_POST["recaptcha_challenge_field"],
 $_POST["recaptcha_response_field"]);

if (!$resp->is_valid) {
 // What happens when the CAPTCHA was entered incorrectly
 die ("The reCAPTCHA wasn't entered correctly. Go back and try it again." .
 "(reCAPTCHA said: " . $resp->error . ")");
 } else {
 $username = $_POST['username'];
 $activation_code = $_POST['activation_code'];
 $db_host = "localhost";
 $db_name = "databasename";
 $db_use = "root";
 $db_pass = "password";
 $link = mysql_connect($db_host, $db_use, $db_pass);
 mysql_select_db($db_name, $link);
 $command = "UPDATE email_activation SET check_activation='$activation_code' WHERE username='$username' and activation='$activation_code'";
 $result = mysql_query($command);
 if ($result) {
 echo "Congratulations. Your membership has been activated …";
 }else{
 echo ("You've entered an invalid username / activation code – please retry");
 }
 }
 ?>
  • 3 Contributors
  • 4 Replies
  • 220 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gabrielcastillo

Dani AI

Generated

Short summary and recommended workflow: verify the activation token, fetch the pending row from email_activation, create the real member row in members and then remove (or mark) the activation row — all inside a transaction so the move is atomic. Note: your posted email_activation table does not include postcode, so you either need to collect and store postcode at registration time or ask for it on the activation page before inserting into members.

As warned, do not use raw string interpolation — move to PDO or mysqli with prepared statements. is right that a second query is needed; below is a safer pattern using PDO that shows the essential steps (select → insert → delete) inside a transaction and handles password hashing:

// assume $pdo is a PDO instance with ERRMODE_EXCEPTION
$pdo->beginTransaction();
$stmt = $pdo->prepare('SELECT id,username,email,password,postcode FROM email_activation WHERE username=:u AND activation=:a AND check_activation=0');
$stmt->execute([':u'=>$username, ':a'=>$token]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);

if ($row) {
    $passwordHash = (password_get_info($row['password'])['algo'] === 0)
                  ? password_hash($row['password'], PASSWORD_DEFAULT)
                  : $row['password'];

    $ins = $pdo->prepare('INSERT INTO members (username,email,password,postcode,created,active) VALUES (:u,:e,:p,:pc,NOW(),1)');
    $ins->execute([':u'=>$row['username'],':e'=>$row['email'],':p'=>$passwordHash,':pc'=>$row['postcode']]);

    $del = $pdo->prepare('DELETE FROM email_activation WHERE id=:id');
    $del->execute([':id'=>$row['id']]);

    $pdo->commit();
} else {
    $pdo->rollBack();
    // invalid/expired token handling
}

Practical notes and hard requirements: always hash passwords with password_hash() (never store plain text), validate emails (filter_var), add UNIQUE constraints on username/email, use a cryptographically secure activation token (e.g., bin2hex(random_bytes(16))) with an expiration timestamp, serve activation links over HTTPS, and log failures. If you prefer one-table design, keep an active (or status) and activation_token + expires_at fields in members — simpler and safer than duplicating user data across tables.

Recommended Answers

All 4 Replies

Member Avatar for Member #120589

Give us more info with regard to what you need to update in the member db. Also this is very dangerous SQL - not cleaned so you're vulnerable to SQL injection. Use mysql_real_escape_string if you insist on using mysql_* functions. Ohterwise switch to mysqli or PDO.

Member Avatar for vinson89

Here are my email_activation db:

CREATE TABLE 'email_activation' (
  'id' int(11) NOT NULL auto_increment,
  'username' varchar(25) NOT NULL,
  'email' varchar(25) NOT NULL,
  'password' varchar(25) NOT NULL,
  'activation' int(6) NOT NULL default '0',
  'check_activation' int(6) NOT NULL default '0',
  PRIMARY KEY  ('id')
) ;

and I want to add username,email,password,postcode into member db.

Member Avatar for Member #120589

Why don't you just have an extended members table with a status and activation_code fields?

Member Avatar for gabrielcastillo

looks like you need to run another query after user has activated the membership. He is a short example, note: mysql_insert_id() will be removed in future version of php.. As diafol suggested, you should move to pdo or mysqli

if(!$result){
    //Run Error code
}else{

    $new_id = mysql_insert_id();

    $new_member = mysql_query("INSERT INTO memebers_db(id, username, email, passcode, postal) VALUES('$id', '$username', '$email', '$passcode', '$postal') LIMIT 1");

    if(!$new_member){
        die('Internal Error!', mysql_error());
    }
}
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.