title: how to send activation link to a registered user?
body: <p>I have already asked this before but I never seem getting how it works(I tried a lot but no success at all) could someone tell me how can I send a activation link to the users email address up on registration and don't allow the user until they activate their account by following the link in the email address? What should I do? I'm not getting it at all...please help me out..</p>
  
  <p><strong>What I have in a table <code>users</code> in database:</strong></p>
  
  <pre><code>1   id          int(11)       AUTO_INCREMENT    
  2   username    varchar(255)        
  3   password    char(64)    
  4   salt        char(16)    
  5   email       varchar(255)
  </code></pre>
  
  <p><strong>register.php</strong></p>
  
  <pre><code>// First we execute our common code to connection to the database and start the session 
   require("common.php"); 
  
  // This if statement checks to determine whether the registration form has been submitted 
  // If it has, then the registration code is run, otherwise the form is displayed 
  if(!empty($_POST))
  { 
  // Ensure that the user has entered a non-empty username 
  if(empty($_POST['username']))
  { 
      echo "Please enter a username."; 
  }
  
  // Ensure that the user has entered a non-empty password 
  if(empty($_POST['password']))
  { 
      die("Please enter a password."); 
  } 
  
  // Make sure the user entered a valid E-Mail address 
  // filter_var is a useful PHP function for validating form input, see:
  if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) 
  { 
      die("Invalid E-Mail Address"); 
  } 
  
  $query = " 
      SELECT 
          1 
      FROM users 
      WHERE 
          username = :username 
  "; 
  
  $query_params = array( 
      ':username' =&gt; $_POST['username'] 
  ); 
  
  try 
  { 
      // These two statements run the query against your database table. 
      $stmt = $db-&gt;prepare($query); 
      $result = $stmt-&gt;execute($query_params); 
  } 
  catch(PDOException $ex) 
  { 
      // Note: On a production website, you should not output $ex-&gt;getMessage(). 
      // It may provide an attacker with helpful information about your code.  
      die("Failed to run query: " . $ex-&gt;getMessage()); 
  } 
  
  $row = $stmt-&gt;fetch(); 
  
  
  if($row) 
  { 
      die("This username is already in use"); 
  } 
  
  // Now we perform the same type of check for the email address, in order 
  // to ensure that it is unique. 
  $query = " 
      SELECT 
          1 
      FROM users 
      WHERE 
          email = :email 
  "; 
  
  $query_params = array( 
      ':email' =&gt; $_POST['email'] 
  ); 
  
  try 
  { 
      $stmt = $db-&gt;prepare($query); 
      $result = $stmt-&gt;execute($query_params); 
  } 
  catch(PDOException $ex) 
  { 
      die("Failed to run query: " . $ex-&gt;getMessage()); 
  } 
  
  $row = $stmt-&gt;fetch(); 
  
  if($row) 
  { 
      die("This email address is already registered"); 
  } 
  
  // An INSERT query is used to add new rows to a database table. 
  // Again, we are using special tokens (technically called parameters) to 
  // protect against SQL injection attacks. 
  $query = " 
      INSERT INTO users ( 
          username, 
          password, 
          salt, 
          email 
      ) VALUES ( 
          :username, 
          :password, 
          :salt, 
          :email 
      ) 
  "; 
  
  $to = "email";
  $subject = "Your Account Information!";
  $body = &lt;&lt;&lt;EMAIL
  Hello {'email'}, here is your account information!
  
  Username:{'username'}
  Password:{'password'}
  
  Please activate your account by clicking the following activation link:
  http://www.mywebsite.com/activate.php?aid={$aid}
  
  EMAIL;
  
  $headers = 'From: noreply@yourdomain.com' . "\r\n" .
  'Reply-To: noreply@yourdomain.com' . "\r\n" .
  'X-Mailer: PHP/' . phpversion();
  
  if(mail($to, $subject, $body, $headers)){
  echo("&lt;p&gt;Your account information was successfully sent to your email - ('email')! &lt;br&gt;&lt;br&gt;Please open your    email and click the activation link to activate your account.&lt;/p&gt;&lt;br&gt;&lt;p&gt;If you do not see your account information in your inbox within 60 seconds please check your spam/junk folder.&lt;/p&gt;");
  } else {
     echo("&lt;p&gt; Unfortunately, your account information was &lt;u&gt;unsuccessfully&lt;/u&gt; sent to  your email - ('email'). &lt;/p&gt;");
  }
  
  $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); 
  
  $password = hash('sha256', $_POST['password'] . $salt); 
  
  for($round = 0; $round &lt; 65536; $round++) 
  {
      $password = hash('sha256', $password . $salt); 
  }
  
  
  $query_params = array( 
      ':username' =&gt; $_POST['username'], 
      ':password' =&gt; $password, 
      ':salt' =&gt; $salt, 
      ':email' =&gt; $_POST['email'] 
  ); 
  
  try
  { 
      // Execute the query to create the user 
      $stmt = $db-&gt;prepare($query); 
      $result = $stmt-&gt;execute($query_params); 
  }
  catch(PDOException $ex)
  { 
  
  }
  header("Location: login.php"); 
  die("Redirecting to login.php"); 
  }
  ?&gt; 
  &lt;h1&gt;Register&lt;/h1&gt; 
  &lt;form action="" method="post"&gt; 
  Username:&lt;br /&gt; 
  &lt;input type="text" name="username"  required value="" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  E-Mail:&lt;br /&gt; 
  &lt;input type="text" name="email" required value="" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  Password:&lt;br /&gt; 
  &lt;input type="password" required  name="password" value="" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  &lt;input type="submit"  value="Register" /&gt; 
  &lt;/form&gt;
  </code></pre>
  
  <p><strong>login.php</strong></p>
  
  <pre><code>&lt;?php 
  
  // First we execute our common code to connection to the database and start the session 
  require("common.php"); 
  
  $submitted_username = '';
  if(!empty($_POST)) 
  { 
  $query = " 
      SELECT 
          id, 
          username, 
          password, 
          salt, 
          email 
      FROM users 
      WHERE 
          username = :username 
  "; 
  
  // The parameter values 
  $query_params = array( 
      ':username' =&gt; $_POST['username'] 
  ); 
  
  try 
  { 
      // Execute the query against the database 
      $stmt = $db-&gt;prepare($query); 
      $result = $stmt-&gt;execute($query_params); 
  } 
  catch(PDOException $ex) 
  { 
      die("Failed to run query: " . $ex-&gt;getMessage()); 
  } 
  
  $login_ok = false; 
  
  $row = $stmt-&gt;fetch(); 
  if($row) 
  { 
  
      $check_password = hash('sha256', $_POST['password'] . $row['salt']); 
      for($round = 0; $round &lt; 65536; $round++) 
      { 
          $check_password = hash('sha256', $check_password . $row['salt']); 
      } 
  
      if($check_password === $row['password']) 
      { 
          $login_ok = true; 
      } 
  } 
  
  if($login_ok) 
  { 
  
      unset($row['salt']); 
      unset($row['password']); 
  
      $_SESSION['user'] = $row; 
  
      // Redirect the user to the private members-only page. 
      header("Location: private.php"); 
      die("Redirecting to: private.php"); 
  } 
  else 
  { 
      // Tell the user they failed 
      print("The Username/Password is invalid."); 
  
      $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); 
  } 
  } 
  
      ?&gt; 
      &lt;h1&gt;Login&lt;/h1&gt; 
      &lt;form action="login.php" method="post"&gt; 
  Username:&lt;br /&gt; 
  &lt;input type="text" name="username" required value="&lt;?php echo $submitted_username; ?&gt;" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  Password:&lt;br /&gt; 
  &lt;input type="password" name="password" value="" required /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  &lt;input type="submit" value="Login" /&gt; 
  &lt;/form&gt; 
  &lt;a href="register.php"&gt;Register&lt;/a&gt;
  </code></pre>