Best practices for email confirmation codes

Question

I\'m creating a PHP website which involves users signing up, and I\'m wondering about best practices for \"email confirmation\" codes.

New users must confirm their e

Answer 1

It was secure enough right up until the point where you published your method on the Internet! This is because you were relying on security by obscurity, which is not a good idea.

You ought to use some sort of keyed hash function or MAC ideally, which incorporates a secret key known only to you.