title: how do I send validation link to email address?
body: <p>I have got a php login system but it lacks to features. I would like to send activation link to a users email address before they log in, they have to click on a link to activate the account. I also would like to let them require new password in case they forget the one they have...everything else works fine except these two issues.how I do achieve that? thanks</p>
  
  <p><strong>What I have in a table <code>users</code> in database:</strong></p>
  
  <pre><code>1   id          int(11)       AUTO_INCREMENT    
  2   username    varchar(255)        
  3   password    char(64)    
  4   salt        char(16)    
  5   email       varchar(255)
  </code></pre>
  
  <p><strong>register.php</strong>
      
  
  <pre><code>// First we execute our common code to connection to the database and start the session 
  require("common.php"); 
  
  // This if statement checks to determine whether the registration form has been submitted 
  // If it has, then the registration code is run, otherwise the form is displayed 
  if(!empty($_POST)) 
  { 
      // Ensure that the user has entered a non-empty username 
      if(empty($_POST['username'])) 
      { 
          echo "Please enter a username."; 
      } 
  
      // Ensure that the user has entered a non-empty password 
      if(empty($_POST['password'])) 
      { 
          die("Please enter a password."); 
      } 
  
      // Make sure the user entered a valid E-Mail address 
      // filter_var is a useful PHP function for validating form input, see:
      if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) 
      { 
          die("Invalid E-Mail Address"); 
      } 
  
      $query = " 
          SELECT 
              1 
          FROM users 
          WHERE 
              username = :username 
      "; 
  
      $query_params = array( 
          ':username' =&gt; $_POST['username'] 
      ); 
  
      try 
      { 
          // These two statements run the query against your database table. 
          $stmt = $db-&gt;prepare($query); 
          $result = $stmt-&gt;execute($query_params); 
      } 
      catch(PDOException $ex) 
      { 
          // Note: On a production website, you should not output $ex-&gt;getMessage(). 
          // It may provide an attacker with helpful information about your code.  
          die("Failed to run query: " . $ex-&gt;getMessage()); 
      } 
  
      $row = $stmt-&gt;fetch(); 
  
  
      if($row) 
      { 
          die("This username is already in use"); 
      } 
  
      // Now we perform the same type of check for the email address, in order 
      // to ensure that it is unique. 
      $query = " 
          SELECT 
              1 
          FROM users 
          WHERE 
              email = :email 
      "; 
  
      $query_params = array( 
          ':email' =&gt; $_POST['email'] 
      ); 
  
      try 
      { 
          $stmt = $db-&gt;prepare($query); 
          $result = $stmt-&gt;execute($query_params); 
      } 
      catch(PDOException $ex) 
      { 
          die("Failed to run query: " . $ex-&gt;getMessage()); 
      } 
  
      $row = $stmt-&gt;fetch(); 
  
      if($row) 
      { 
          die("This email address is already registered"); 
      } 
  
      // An INSERT query is used to add new rows to a database table. 
      // Again, we are using special tokens (technically called parameters) to 
      // protect against SQL injection attacks. 
      $query = " 
          INSERT INTO users ( 
              username, 
              password, 
              salt, 
              email 
          ) VALUES ( 
              :username, 
              :password, 
              :salt, 
              :email 
          ) 
      "; 
  
      $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); 
  
  
      $password = hash('sha256', $_POST['password'] . $salt); 
  
      for($round = 0; $round &lt; 65536; $round++) 
      { 
          $password = hash('sha256', $password . $salt); 
      } 
  
  
      $query_params = array( 
          ':username' =&gt; $_POST['username'], 
          ':password' =&gt; $password, 
          ':salt' =&gt; $salt, 
          ':email' =&gt; $_POST['email'] 
      ); 
  
      try 
      { 
          // Execute the query to create the user 
          $stmt = $db-&gt;prepare($query); 
          $result = $stmt-&gt;execute($query_params); 
      } 
      catch(PDOException $ex) 
      { 
  
      } 
      header("Location: login.php"); 
      die("Redirecting to login.php"); 
  } 
  
  ?&gt; 
  &lt;h1&gt;Register&lt;/h1&gt; 
  &lt;form action="" method="post"&gt; 
  Username:&lt;br /&gt; 
  &lt;input type="text" name="username"  required value="" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  E-Mail:&lt;br /&gt; 
  &lt;input type="text" name="email" required value="" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  Password:&lt;br /&gt; 
  &lt;input type="password" required  name="password" value="" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  &lt;input type="submit"  value="Register" /&gt; 
  &lt;/form&gt;
  </code></pre>
  
  <p><strong>login.php</strong></p>
  
  <pre><code>&lt;?php 
  
  // First we execute our common code to connection to the database and start the session 
  require("common.php"); 
  
  $submitted_username = '';
  if(!empty($_POST)) 
  { 
      $query = " 
          SELECT 
              id, 
              username, 
              password, 
              salt, 
              email 
          FROM users 
          WHERE 
              username = :username 
      "; 
  
      // The parameter values 
      $query_params = array( 
          ':username' =&gt; $_POST['username'] 
      ); 
  
      try 
      { 
          // Execute the query against the database 
          $stmt = $db-&gt;prepare($query); 
          $result = $stmt-&gt;execute($query_params); 
      } 
      catch(PDOException $ex) 
      { 
          die("Failed to run query: " . $ex-&gt;getMessage()); 
      } 
  
      $login_ok = false; 
  
      $row = $stmt-&gt;fetch(); 
      if($row) 
      { 
  
          $check_password = hash('sha256', $_POST['password'] . $row['salt']); 
          for($round = 0; $round &lt; 65536; $round++) 
          { 
              $check_password = hash('sha256', $check_password . $row['salt']); 
          } 
  
          if($check_password === $row['password']) 
          { 
              $login_ok = true; 
          } 
      } 
  
      if($login_ok) 
      { 
  
          unset($row['salt']); 
          unset($row['password']); 
  
          $_SESSION['user'] = $row; 
  
          // Redirect the user to the private members-only page. 
          header("Location: private.php"); 
          die("Redirecting to: private.php"); 
      } 
      else 
      { 
          // Tell the user they failed 
          print("The Username/Password is invalid."); 
  
          $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); 
      } 
  } 
  
  ?&gt; 
  &lt;h1&gt;Login&lt;/h1&gt; 
  &lt;form action="login.php" method="post"&gt; 
  Username:&lt;br /&gt; 
  &lt;input type="text" name="username" required value="&lt;?php echo $submitted_username; ?&gt;" /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  Password:&lt;br /&gt; 
  &lt;input type="password" name="password" value="" required /&gt; 
  &lt;br /&gt;&lt;br /&gt; 
  &lt;input type="submit" value="Login" /&gt; 
  &lt;/form&gt; 
  &lt;a href="register.php"&gt;Register&lt;/a&gt;
  </code></pre>