Security on a booking form

[NCC1701]

Hi guys, i have a problem.

i have created a page for a website that has a booking form to enable a customer to book a table, at this point i have no validation on it so people could enter any data in and it would insert it into the database.

My question is, how can i ensure the validity of the booking so not just anybody can book a table annonomosly and mess up the restaurants bookings and prevewnt other genuine customers from booking at particular times? i thought i valid mobile or email woud be enough, any suggestions?

NCC1701

[drew010]

maybe you can send a validation email to the person and say their reservation wont be active until they click the link in their email verifying the reservation. that way people trying to use bogus emails to mess it up will have trouble doing that.

[NCC1701]

thats a great idea mate, i already have email confirmation once the form has been sent, how would i go about creating this verification?

[drew010]

i would recommend you add another field in the database where you can store another piece of data. when they fill out the form, you should generate a random value, store it in the database, and email it to them as well. make a page that they need to enter the code on before it verifies their reservation.
basically if they enter the code right, you can delete the data from that field so it is empty, and then you can identify all verified reservations have no data in that field, and pending ones have the random code in it.

[NCC1701]

bingo, your a star, thanks mate, thats a exactly what im after!!