Implementing Email Verification in PHP

Email verification checks mailbox control using a one-time expiring token. The examples separate the essential operation from the conditions a production implementation must enforce.

What It Does

Email verification checks mailbox control using a one-time expiring token.

Prerequisites

Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.

Example 1: Core Behavior

The first example isolates the core operation so its result is easy to understand.

<?php
$token=bin2hex(random_bytes(32)); $tokenHash=hash('sha256',$token); $expiry=time()+1800;
echo json_encode(['tokenHash'=>$tokenHash,'expiresAt'=>$expiry]);

Example 2: Alternative or Failure Case

The second example demonstrates an alternative outcome, rule or failure condition.

<?php
$provided='invalid'; $savedHash=hash('sha256','genuine');
echo hash_equals($savedHash,hash('sha256',$provided))?'Valid token':'Rejected';

Practical Example: Applying the Rule

This practical workflow performs the relevant operation, with strict error checks. Configure the required transport or database driver before running it.

<?php
$pdo = new PDO('sqlite::memory:', null, null, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$pdo->exec('CREATE TABLE verifications (user_id INTEGER, token_hash TEXT PRIMARY KEY, expires_at INTEGER, used INTEGER DEFAULT 0)');
$userId = 17; $token = bin2hex(random_bytes(32));
$pdo->prepare('INSERT INTO verifications (user_id, token_hash, expires_at) VALUES (?, ?, ?)')
    ->execute([$userId, hash('sha256', $token), time() + 1800]);
$consume = $pdo->prepare('UPDATE verifications SET used = 1 WHERE token_hash = ? AND expires_at > ? AND used = 0');
$consume->execute([hash('sha256', $token), time()]);
echo $consume->rowCount() === 1 ? 'Email verified once' : 'Invalid or expired token';

Important Behavior and Edge Cases

Store the token hash, not its plaintext; do not automatically grant broader permissions.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Email verification checks mailbox control using a one-time expiring token.
• Store the token hash, not its plaintext; do not automatically grant broader permissions.
• A password reset token should also be single-use but authorizes a different action.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.