title: Activating user account by sending an email to user with a clickable link with unique url using PHP $_GET
body: <p>Hi maybe this is not the right forum to ask this question. But I would just like an input on my system, this is the first time I built such thing and im not sure if this is the right way.</p>
  
  <p>The system has a build in newsletter, where user can sign up to a newsletter subscription. If users do want to sign up, Name, Surname and email must be provided. Once user enter those information and successfully sing up, all this information will be stored in a sql database with an unique ID to the user.</p>
  
  <p>Email will be send to the user with a link to finish activating their account.</p>
  
  <p>The activating link looks more or less something like this.</p>
  
  <pre><code> http://my-website/newsletter/newsletter-activation.php?activation=63
  </code></pre>
  
  <p>Where number 63 is the unique ID from the sql table for that particular user.</p>
  
  <p>In the php file I get that unique ID and check if the user is activated or not, if it is not then I activate them, this is done simply by having a column called Activation. with input "no" or "yes".</p>
  
  <p>Here is a bit of the code for the email link:</p>
  
  <p>Email:      http://my-website/newsletter/newsletter-activation.php?activation=$id'>Click here</p>
  
  <p>$id is the unique ID queried from the sql database.</p>
  
  <p>This is the check to see if user is already activated.</p>
  
  <pre><code>if(!isset($_GET['activation'])){
      header("location: ../index.php");
      exit();
  }else{
      $id = $_GET['activation'];
      $sql = mysqli_query($connection, "SELECT ACCEPTED FROM MAIL_LIST WHERE ID = '$id';");
      $result = mysqli_fetch_object($sql);
      if($result-&gt;ACCEPTED === "NO"){
          $sql = mysqli_query($connection,"UPDATE MAIL_LIST SET ACCEPTED = 'YES' WHERE ID = '$id';");
          $h1 = "You have successfully activated our newsletter subscription!";
      }else if($result-&gt;ACCEPTED === "YES"){
          $h1 = "You have already activated your subscription!";
      }else{
          header("location: ../index.php");
          exit();
      }
  }
  </code></pre>
  
  <p>So the question Im looking for is am I doing the right thing? is this how website active their customers? </p>
  
  <p>The issue Im having is that if someone wants to play around with my website they could just keep changing the url unique ID numbers (?activation=63 64 65 66 67) and so on, which could lead to activating an account that may not wish to be activated. How could I fix these issue?</p>