I need to know if it is safe to use user_activation_key (from WP_User) for other purpose like email verification (a functionality that I would be creating that would send an email verification first before activating the account created)?

So here's how things will work. A user will register using my custom registration form which will be available only on front-end. Upon successful registration, the user will be notified via email that the account has been created along the activation link that is created upon registration using the following convention:


Do you think this will be safe?


Do you think this will be safe?

Maybe. Two issues.

You also need to make sure the key isn't guessable. No incrementing numbers. You can use something like wp_generate_password to get some psuedo random characters. Use a random "salt" plus the user's email and sign up time or uniqid and you stand a pretty good chance of ensuring uniqueness (see below) and creating a non-guessable key.

$user_email = some_function_to_get_user_email();
$salt = wp_generate_password(20); // 20 character "random" string
$key = sha1($salt . $user_email . uniqid(time(), true));

You'll also need to ensure the uniqueness of the key: there's shouldn't be any collisions.

There's no constraints on on the user_activation_key column in the database that ensure uniqueness, so it's up to your app (eg. WordPress and the PHP side of things) to make sure it is. In other words, either before or after you generate the key make sure it doesn't exist already in the database. Simple, untested example:

$key = some_function_that_generates_a_key();
$res = $wpdb->get_col($wpdb->prepare("SELECT EXISTS(SELECT 1 FROM {$wpdb->users} WHERE user_activation_key = %s)", $key));
if ($res) {
    // the key exists, try again!
} else {
    // good to go.

If you need a guide, trying looking at how WordPress does password reset emails. The process is the same: generate a non-guessable key, make sure it's unique, insert into the database with the corresponding user, then send them an email with a link to reset the password.

| improve this answer | |
  • Thank you for that wonderful answer. (I know the reply was late haha! But this one is really useful.) – mcometa Sep 18 '13 at 9:14
  • Or if you don't want to bother about collision simply pass the user id in the verification request as well – Tofandel Feb 24 '19 at 16:03

No it is not safe, because anyone use this. but if you can you give your email id then it is refer you to a specific activation key or number then it is safe

| improve this answer | |
  • Hi @Ajay, I edited my question for more complete details. Please check again as I didn't understand what you meant by "anyone use this". – mcometa Oct 28 '12 at 9:05
  • I think what he means is it needs to be made more specific to the user whose activation key it is. This will stop individuals using brute force methods to gain access to someone else's account. – Ollie Oct 28 '12 at 12:20
  • @Ollie I made it sure that the activation key is sent to the email address of the user trying to register. Also the activation key contains hashed value of the username, password and timestamp. Am I doing the right thing? Kind of new to these stuff with Wordpress. – mcometa Oct 28 '12 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.