This is about as simple as you can make it, and I have seen some sites that use this kinda system to validate emails or websites.
<form method=post>
<?php
if ($_POST["submit"])
{
mail($_POST["email"], "Confirm Email", "
Please click on the following link to confirm your email.
" . $_SERVER["HTTP_REFERER"] . "?email=" . $_POST["email"]);
echo "A email has been sent to your account. Please validate your email.";
}
elseif ($_GET["email"])
{
echo "Thankyou for registering your email " . $_GET["email"];
}
else
{
echo "Email: <input type=text name=email>";
echo "<input type=submit name=submit value=Submit>";
}
?>
</form>
The downside to this system is, once your confirm one email, you can confirm other emails just by editing the URL that is sent to your email account.
To improve the system, I would add the email to a database along with a random number. You then send a URL like this to the account: (Note, the md5 is just for extra protection for the email holder)
$_SERVER["HTTP_REFERER"] . "?code=$random&email=" . md5($email)
When you receive a code from people clicking on these links, you lookup the database and compare the recorded md5 email with the md5 coded email sent.
For a person to circumvent this system, a hacker would need to guess a pair of pin number (random number) and username (a md5 email). very difficult if not impossible.
