重发确认电子邮件问题

Question

I'd like to offer a way for me to "resend confirmation" email to users who have recently signed up for accounts at my site.

What is a good way to look up their info and make sure the request came from them?

They are able to log in without confirming their email. I was thinking I would use jquery.post to send their id to a page, which looks up their email and resends the confirmation. Is this secure enough?

If I have a session set in one page where I am sending a jquery.post from, will the session variables be passed to the page I post to?

Answer 1

The cookie identifying the user's session will be passed along when the jQuery post is sent which will automatically populate $_SESSION.

Make sure you store their user ID in their session, not as a separate cookie that the user could tamper with.