电子邮件激活安全校验和
我一直在我的网站上询问一些反馈，收到的一条评论如下
“我注册了 [电子邮件受保护] 并设法通过 http://www.mysite.co.uk/[电子邮件受保护]
您需要校验和才能阻止它。"
有人可以详细说明这一点以及我如何将它们实施到我的激活中吗？
理论上，如果我要在数据库中创建名为“rand_key”的行，并且当用户注册时，随机密钥存储在该列中，那么我可以使用它作为激活而不是电子邮件吗？从而使其不可猜测？
Ive been asking around for some feedback on my website and one comment I received was the following
"I signed up with [email protected] and managed to active my account with http://www.mysite.co.uk/[email protected]
You need checksums to stop it."
Can anybody elaborate on this and how I can implement them into my activation?
In theory, If I was to create a row named "rand_key" in my DB and when a user registers a random key is stored in the column, could I then use this as the activation as opposed to the email? thus making it un guessable?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您需要创建一个唯一的用户密钥，该密钥不应与用户数据相关。通常，您可以执行一些操作，例如对随机生成器函数的输出进行哈希处理，以使其唯一并使用它。然后你将他们指向链接：
http://www .mysite.co.uk/activateuser.php?userid= generated-unique-hashed-key
此唯一用户密钥应作为额外字段添加到存储用户信息或与用户相关的表中以其他方式。通过保持密钥与用户数据无关，您可以确保没有人可以发现用户的密钥并代替您的用户恶意激活/执行其他操作。
然后，您应该在到达时测试用户密钥的某些条件：
另外，应该有一个与您的用户关联的到期日期，在此日期后您只需停用该用户即可他的钥匙。
You need to create a unique user key, which shouldn't be related to user data. Usually you could do something like hashing the output of a random generator function in order to make it unique and use that. Then you point them to the link:
http://www.mysite.co.uk/activateuser.php?userid=generated-unique-hashed-key
This unique user key should be added as an extra field to the table where you store your user info, or related to the user in some other way. By keeping the key unrelated to user data you make sure nobody can discover a user's key and maliciously activate/do another action instead of your user.
Then you should test the user key on arrival for some conditions:
Also, there should be an expiration date associated with your user, upon which you just deactivate the user along with his key.
此人意味着您可以通过访问该网址并将电子邮件地址放入该网址来激活您的地址。您可以在没有实际收到激活电子邮件的情况下执行此操作。
通过使用校验和，您可以强制用户单击该链接。例如
[电子邮件受保护]&check=A1234b23
发送电子邮件时，您会生成一个随机代码。将其存储在数据库中的某个位置。将其附加到给定用户的 url 中。当用户单击该链接时，您会检查该代码是否与为该电子邮件地址存储的代码相匹配。如果匹配，请验证电子邮件。否则不。
The person means you can activate your address by going to that url and simply putting the email address in thr url. You could do this without actually getting the activation email.
By using a checksum, you force thr user to click the link. E.g.
[email protected]&check=A1234b23
At the time of sending the email you would geneate a random code. Store this in your database somewhere. Append it to the url the user is given. When the user clicks the link, you check that the code matches the code stored for that email address. If it matches, validate the email. Else do not.
是的。请记住，您不一定需要随机性，而需要唯一性（以避免两个电子邮件地址意外获得相同的激活码）。
你可以这样做：
这很难猜测，并且保证是唯一的。
Yes. Keep in mind that you don't necessarily want random as much as you want unique (in order to avoid two email addresses accidentally getting the same activation code).
You could do something like:
That would be tough to guess and would be guaranteed unique.