Login - Activated/Not Activated Accounts

[scykofreak]

I have customised 2 tutorials into 1 for my website. I am just needing a little help with a little more custom code I want to add.

When users register their account, it goes into the database as “unactivated”. Later they can activate it through another script I have. The part I need a little help with is that at the login page I want it to give an error when the account is still not activated.

I have tried for a few days to get it to work, but I am still quite new to PHP and just haven’t been able to crack it by myself.

So if anyone is willing to help, here are the details. Firstly… the login code…

[php]// Reset errors and success messages
$errors = array();
$success = array();

// Login attempt
if(isset($_POST[‘loginSubmit’]) && $_POST[‘loginSubmit’] == ‘true’){
$loginEmail = trim($_POST[‘email’]);
$loginPassword = trim($_POST[‘password’]);

if(!preg_match("/^[_\.0-9a-zA-Z-]+@([0-9a-zA-Z][0-9a-zA-Z-]+\.)+[a-zA-Z]{2,6}$/i", $loginEmail))
	$errors['loginEmail'] = 'Error: Please enter a valid email address.';

if(strlen($loginPassword) < 6 || strlen($loginPassword) > 12)
	$errors['loginPassword'] = 'Error: Your password must be between 6-12 characters.';

if(!$errors){
	$query 	= 'SELECT * FROM users WHERE email = "' . mysql_real_escape_string($loginEmail) . '" AND password = MD5("' . $loginPassword . '") LIMIT 1';
	$result = mysql_query($query);
	if(mysql_num_rows($result) == 1){
		$user = mysql_fetch_assoc($result);
		$query = 'UPDATE users SET session_id = "' . session_id() . '" WHERE id = ' . $user['id'] . ' LIMIT 1';
		mysql_query($query);
		header('Location: index.php');
		exit;
	}else{
		$errors['login'] = 'Error: Invalid email address/password combination.';
	}
}

}[/php]

I would appreciate it if you could show me in the right direction to check the database to find out if the user is activated or not, and also add a new error, “Account Innactive” or something similar in the same way as it is already done for the other errors.

Thanks to anyone who can help

[sarthakpatel]

Well, what you can try to do is when a new user registers, set a flag in database (i.e. a field). And when user attempts login, check if the username and password are correct. But before redirecting, check the flag. If the flag = inactive( or 0), then display the eror message “you need to activate your account”. When the user activates his account, you can then set flag = active(or 1).

[php]$result = mysql_query($query);
if(mysql_num_rows($result) == 1){
$user = mysql_fetch_assoc($result);
if($user[‘flag’]==0){
$errors[‘activation’] = ‘Error: You need to activate your account first.’;
}
else{
$query = ‘UPDATE users SET session_id = "’ . session_id() . ‘" WHERE id = ’ . $user[‘id’] . ’ LIMIT 1’;
mysql_query($query);
header(‘Location: index.php’);
exit;
}[/php]

[codeguru]

Hi skykofreak,

You would want to restrict access to “unactivated” users and that only “verified” users can access the page. Well, I supposed you have a column named “account_status” in your table users with values of either “unactivated” and “activated”.

Now, change this query

[php]‘SELECT * FROM users WHERE email = "’ . mysql_real_escape_string($loginEmail) . ‘" AND password = MD5("’ . $loginPassword . ‘") LIMIT 1’;[/php]

into

[php]‘SELECT * FROM users WHERE email = "’ . mysql_real_escape_string($loginEmail) . ‘" AND password = MD5("’ . $loginPassword . ‘") AND account_status = “activated” LIMIT 1’;[/php]

Cheers…