基于MD5哈希的PHP邮箱验证与MySQL写入及表单后端实现咨询

Alright, let's break down a practical, secure solution for implementing MD5-based email validation and storing your form data in MySQL. Here's what you need to do:

1. Fix Your HTML Form First #

Notice your age input uses type="month"—that's for selecting a year/month, not entering a numeric age. Let's correct that to make the form functional:

<form id="contact-form" action="mail.php" method="POST">
  <input type="number" name="age" id="your-age" min="1" max="120" placeholder="(your age here)" required>
  <p>and</p>
  <input type="email" name="email" id="email" placeholder="(your email address)" required>
  <p>
    <button type="submit">
      <svg version="1.1" class="send-icn" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 120 120">
        <path d="M105.9,11.6L12.5,56.2c-2.3,1-4,3.3-4,5.8c0,2.5,1.7,4.8,4,5.8l93.4,44.6c3.6,1.7,7.8-0.6,7.8-4.3V15.9C113.7,12.2,109.5,9.9,105.9,11.6z M91.8,28.7L31.6,59.1l60.2,30.4V28.7z"/>
      </svg>
      Send
    </button>
  </p>
</form>

2. Backend Implementation (PHP + MySQL) #

We'll split this into two core parts: handling form submission and sending validation emails, then processing the email verification to finalize data storage.

First: Set Up Your MySQL Database #

Create a table to track submissions, with a flag to confirm email verification status:

CREATE TABLE user_submissions (
    id INT AUTO_INCREMENT PRIMARY KEY,
    age INT NOT NULL,
    email VARCHAR(255) NOT NULL UNIQUE,
    verification_token VARCHAR(32) NOT NULL, -- Stores our MD5 validation token
    verified TINYINT(1) DEFAULT 0, -- 0 = unverified, 1 = verified
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

Second: mail.php (Form Submission Handler) #

This script validates user input, generates an MD5 verification token, stores temporary data, and sends a validation email:

<?php
// Configuration - update these with your own database/email details
define('DB_HOST', 'localhost');
define('DB_USER', 'your_db_username');
define('DB_PASS', 'your_db_password');
define('DB_NAME', 'your_db_name');
define('SECRET_KEY', 'your_secure_random_secret_key'); // Use a long, random string here
define('FROM_EMAIL', 'noreply@yourdomain.com');
define('VERIFY_URL', 'https://yourdomain.com/verify.php');

// Connect to MySQL with PDO (safer than mysqli for preventing SQL injection)
try {
    $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME.";charset=utf8mb4", DB_USER, DB_PASS);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
    die("Database connection failed: " . $e->getMessage());
}

// Only accept POST requests
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    die("Invalid request method.");
}

// Validate and sanitize user input
$age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT, ['options' => ['min_range' => 1, 'max_range' => 120]]);
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

if (!$age || !$email) {
    die("Invalid input: Please check your age (1-120) and email format.");
}

// Generate MD5 verification token (combines email, secret key, and timestamp for uniqueness)
$timestamp = time();
$token = md5($email . SECRET_KEY . $timestamp);

// Check if the email has already been submitted (even if unverified)
$stmt = $pdo->prepare("SELECT id FROM user_submissions WHERE email = ?");
$stmt->execute([$email]);
if ($stmt->rowCount() > 0) {
    die("This email has already been submitted. Check your inbox for a verification link, or contact support.");
}

// Store temporary submission data
try {
    $stmt = $pdo->prepare("INSERT INTO user_submissions (age, email, verification_token) VALUES (?, ?, ?)");
    $stmt->execute([$age, $email, $token]);

    // Send verification email to the user
    $subject = "Please Verify Your Email";
    $message = "Click the link below to verify your email and save your submission:\n" . VERIFY_URL . "?token=" . $token . "&email=" . urlencode($email);
    $headers = "From: " . FROM_EMAIL . "\r\n" . "Reply-To: " . FROM_EMAIL . "\r\n" . "Content-Type: text/plain; charset=utf-8";

    if (mail($email, $subject, $message, $headers)) {
        echo "Submission successful! Check your email for a verification link to complete the process.";
    } else {
        // Clean up database entry if email fails to send
        $stmt = $pdo->prepare("DELETE FROM user_submissions WHERE email = ?");
        $stmt->execute([$email]);
        die("Submission successful, but we couldn't send your verification email. Please try again later.");
    }
} catch(PDOException $e) {
    die("Failed to store data: " . $e->getMessage());
}
?>

Third: verify.php (Email Verification Handler) #

This script validates the MD5 token and marks the submission as verified in the database:

<?php
// Reuse configuration (better to move this to a shared config.php file for consistency)
define('DB_HOST', 'localhost');
define('DB_USER', 'your_db_username');
define('DB_PASS', 'your_db_password');
define('DB_NAME', 'your_db_name');

// Connect to MySQL
try {
    $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME.";charset=utf8mb4", DB_USER, DB_PASS);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
    die("Database connection failed: " . $e->getMessage());
}

// Get verification parameters from the URL
$token = filter_input(INPUT_GET, 'token', FILTER_SANITIZE_STRING);
$email = filter_input(INPUT_GET, 'email', FILTER_VALIDATE_EMAIL);

if (!$token || !$email) {
    die("Invalid verification link. Please check the link and try again.");
}

// Find the corresponding unverified submission
$stmt = $pdo->prepare("SELECT id, verification_token FROM user_submissions WHERE email = ? AND verified = 0");
$stmt->execute([$email]);
$submission = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$submission) {
    die("This email hasn't been submitted, or it's already verified.");
}

// Validate the MD5 token against the stored value
if ($submission['verification_token'] !== $token) {
    die("Invalid verification token. Request a new verification link if needed.");
}

// Mark the submission as verified
try {
    $stmt = $pdo->prepare("UPDATE user_submissions SET verified = 1 WHERE id = ?");
    $stmt->execute([$submission['id']]);
    echo "Email verified successfully! Your submission has been saved.";
} catch(PDOException $e) {
    die("Verification failed: " . $e->getMessage());
}
?>

3. Important Notes & Security Tips #

• MD5 Limitations: MD5 is not secure for storing sensitive data (like passwords), but it's acceptable for short-lived verification tokens since they're tied to a secret key. For enhanced security, consider using hash_hmac('sha256', $email . $timestamp, SECRET_KEY) instead, but MD5 works perfectly for this use case.
• Prevent SQL Injection: We use PDO prepared statements everywhere—never concatenate user input directly into SQL queries.
• Token Expiry: Add an expires_at column to your table (set to created_at + INTERVAL 24 HOUR) and check it in verify.php to invalidate old, unused links.
• Email Reliability: The built-in mail() function can be inconsistent. For better deliverability, use a library like PHPMailer with SMTP.
• Secret Key Security: Store your SECRET_KEY in an environment variable instead of hardcoding it. Never expose it in public code.

内容的提问来源于stack exchange，提问作者Mike Sanches