<?php
$pagetitle = "User account activation";
// user has just received a registration confirmation email, clicks it, and gets here
include_once("settings.php");
include_once("modules/databaseconnection.php");
$user = $_GET["user"]; // get the data from the browser url
$key = $_GET["key"];
$userlist = array();
$q = mysql_query("select name, activate from ".$tableprefix."users"); // prevent sql injection
while ($k = mysql_fetch_array($q, MYSQL_ASSOC)) {
	$userlist[$k{'name'}] = $k{'activate'};
}
foreach ($userlist as $name => $value) {
	if ($user == $name) {			
		if ($key == $value) { // remove the activation key from sql db and set the user to active
			if (mysql_query("update ".$tableprefix."users set active=1, activate='' where name='".$user."' and activate='".$key."'")) {
				$content = "<h3>Registration complete:</h3><p>Welcome ".$user.",</p><p>Your account has been activated, you can now log in.</p>";
			} else { // couldn't set user to active/remove activation key
				$sets = mysql_query("select value from ".$tableprefix."settings where name='email'");
				while ($email = mysql_fetch_array($sets, MYSQL_ASSOC)) {
					$mail = $email{'value'};
				}
				$content = "<h3>Error:</h3><p>We couldn't activate your account, please contact the <a href=\"".$mail."\">website administrator</a> and/or try again</p>";
			}
		} else { // key doesn't match
			$content = "<h3>Registration failed:</h3><p>Invalid key or already activated.</p>";	
		}
	} else {
		$content = "<h3>Registration failed:</h3><p>Username not found.</p>";	
	}
}
include("index.php");
?>