Usually I send a link containing the user ID and activation key. When they visit my activation script, if I find a match, I activate them.
When they are registered, I will probably generate 32 characters of alphanumeric upper and lower case letters and set it as an activation key. At this point, you can create an “activated” field, or you can assume that the user is not activated if he has an activation key.
uid | email | key
-------------------------------------------------- ----------
001 | j.smith@mysite.com | e09141f3f5a17fed6222fc0279b9afdf
-------------------------------------------------- ----------
002 | mary.tyler@abc.com |
-------------------------------------------------- ----------
When the user accesses the activation script, simply check the provided key with the provided identifier, and if a match is found, remove the key from the user record in the file (or update the “activated” logical field) and open the door up.
If the email address provided does not exist, no loss. You can regularly delete all rows with keys after a month of inactivity.
Sampson
source share