What is the best way to embed a newsletter link?
I think I am creating a deactivation code that is put in the unsubscribe link along with the user id. Then, when the recipient of my newsletter clicks on the link, I can find my user ID and see if the deactivation code matches.
Does this sound like the best way?
In what other ways?
a source to share
You can just use a hashing algorithm to protect the user ID (so no one can unregister your entire DB with a nasty loop).
As a result, you will receive two parameters: userID and hash.
The advantage is that you don't need to maintain any mapping between the deactivation code and the user ID.
a source to share
From an end-user perspective, excellent one-click cancellation.
However, using hash (id + secret) is unsafe because a smart attacker can very quickly overdo the secret and then proceed to unsubscribe every user in your database simply by increasing the ID.
It is safer to store the identifier "semi-secret" on the server and use the email address to find the user after unsubscribing. Thus, successful unsubscription requires pairing the email address with the correct ID. You can make this even more secure by storing a truly private key for each user and using that instead of an ID. This is especially necessary if email + ID pairs are published.
So, for example, a link to unsubscribe would look like this:
http://mydomain.com/unsubscribe?email={$email}&hash={$hash}
And the server-side function to generate $ hash would look like this in PHP:
<?php
function unsubscribeHash($id, $email) {
$hashSecret = 'Fz!Fx~36N66>io3B-vlPDshdRxos8JjCd4+Ld-s2^ca{19Q/5u';
return sha1($id . $email . $hashSecret);
}
?>
Then, to complete the unsubscribe, you will search for the user by email and confirm
$_GET['hash'] == unsubscribeHash($user_id, $_GET['email'])
a source to share