[RESOLVED] reply-to this URL to become a member: methodology?

promeus

Hi all,

I'm working on a site and I'd like to set up the registration process to send an email to the potential member with the URL for them to click to finish the registration process.

Currently, they just create a username, write in a password, and then they are members. I'd like to slow this process down a little to keep someone from running a user-creation bot against my site (or rather, to keep the less serious miscreants from doing so).

If someone knows of a fairly easy script that I can hack for my needs that's fine, but I also don't mind coding it myself. I just need a little help with the methodology. Basically, just how is this normally done?

My thoughts on how to do it off hand:
1) when they sign up, their userid and usrename are somehow hashed to create a value, and this is put in some table in the database.
2) this value is then used to create a temporary web page with a function that, if you login to it, finishes the registration process.

I can do what I just wrote but don't want to re-invent the wheel. Any help appreciated.

Cheers

bradgrafelman

Do you also collect e-mail addresses from them? If not, ignore suggestion #2 below. Otherwise:

Implement a CAPTCHA on the registration form. Google the term if you've never heard of it before.
Add two columns to your users table: 'activated' and 'act_has' (example names - change to whatever you want). The default value of 'activated' should be 0 (or false, or however you want to do this). This means they aren't allowed to login. When they register, you should generate a hash (use [man]md5[/man] or [man]sha1[/man] to hash [man]microtime/man, their username, a combination, whatever) and store it in that second column. You would then send an e-mail to the address they provided with the link to an activation script.

stolzyboy

most canned options will have a lot of added "fluff" you won't need...

your methodology/sequence is correct, now get coding 🙂

promeus

Thank you all very much, I consider this resolved! I'll be using option 2 above, because I do collect emails.

cheers!

bradgrafelman

I would also highly recommend implementing a CAPTCHA before a spammer finds your form.

stolzyboy

yes, captcha's are getting to be a necessity nowdays, not an option...

promeus

captcha - ya, i looked into that and am considering that for my 2nd phase. I'm also going to impliment some sort of control over how many usernames a person can make from a given IP address. Even if they use dhcp, it'll be a pain for them to have to switch it (provided they have that much control) in order to spam.

I think there's a free service out there for captcha that is add-driven. Thanks again all.

stolzyboy

captcha is pretty easy to do...

this is a simple example using uploaded ttf's and a bit of rotation/sizing/etc... and based off a png file

<?
session_start();

$md5 = md5(microtime() * mktime());

$string = substr($md5,0,6);

$captcha = imagecreatefrompng("graphics/captcha.png");

$red = imagecolorallocate($captcha, 255, 0, 0);
$black = imagecolorallocate($captcha, 0, 0, 0);
$blue = imagecolorallocate($captcha, 0, 0, 255);
$line = imagecolorallocate($captcha, 0, 0, 0);

$font1 = "fonts/vrinda.ttf";
$font2 = "fonts/comic.ttf";
$font3 = "fonts/GARA.TTF";

imagettftext($captcha, 20, -5, 5, 20, $red, $font1, substr($string, 0, 1));
imagettftext($captcha, 22, 10, 30, 25, $black, $font2, substr($string, 1, 1));
imagettftext($captcha, 18, 15, 65, 20, $blue, $font3, substr($string, 2, 1));
imagettftext($captcha, 16, -10, 80, 30, $red, $font1, substr($string, 3, 1));
imagettftext($captcha, 22, 0, 100, 25, $black, $font2, substr($string, 4, 1));
imagettftext($captcha, 16, 20, 125, 20, $blue, $font3, substr($string, 5, 1));

$_SESSION['key'] = md5($string);

header("Content-type: image/png");
imagepng($captcha);
?>

promeus

stolzyboy - you rule! I can't believe you posted that great code 🙂 I have to use it of course, but I'm sure it'll work great. I just started my first steps in php, coming mainly from perl (all server-side scripting as a sys-admin), and php has sort of breathed new life into me. The fact that I'm going to be manipulating png files fairly soon is just too cool!

Thank you very much,
Promeus