User registration with activation code

Question

Good day folks :)
I've been lurking around these forums for a long time and learning a lot, but it seems I've encountered a problem I can't yet find a suitable solution to.
I'm a student and I'm rather new to apex. There are things I've been able to do (even use some jQuery... The names 'Patrick' 'Dan' and 'Tom' immediately come to mind so thank you!) with the help of this forum but some things are really out of my reach. To get to the point, I have an application where I'd like to register users but first they need to click a link of some sort they'd receive by email that activates their account.
There are three types of user - 'ADM' (an administrator) 'AUT' (as in author) and 'STU' (as in student). Students should be able to register their accounts directly, and that's where the trouble lies.
Before I describe the process, the structure of my 'users' table is like this:
CREATE TABLE "USERS"
(     "USERID" NUMBER NOT NULL ENABLE,
     "USERNAME" VARCHAR2(50) NOT NULL ENABLE,
     "PASSWORD" VARCHAR2(100) NOT NULL ENABLE,
     "EMAIL" VARCHAR2(200) NOT NULL ENABLE,
     "NAME" VARCHAR2(100) NOT NULL ENABLE,
     "DOB" DATE NOT NULL ENABLE,
     "ADD1" VARCHAR2(300),
     "ADD2" VARCHAR2(300),
     "ADD3" VARCHAR2(300),
     "GENDER" VARCHAR2(1) NOT NULL ENABLE,
     "BIO" VARCHAR2(1000),
     "PHONE1" VARCHAR2(30),
     "PHONE2" VARCHAR2(30),
     "SECURITYQUESTION" VARCHAR2(100),
     "SECURITYANSWER" VARCHAR2(100),
     "USERTYPE" VARCHAR2(3) NOT NULL ENABLE,
     "ACTIVE" VARCHAR2(1) NOT NULL ENABLE,
     "PHOTO" BLOB,
     CONSTRAINT "USERS_PK" PRIMARY KEY ("USERID") ENABLE,
     CONSTRAINT "USERS_UK1" UNIQUE ("USERNAME", "EMAIL") ENABLE
CREATE OR REPLACE TRIGGER "BI_USERS"
before insert on "USERS"
for each row
begin
if :NEW."USERID" is null then
select "USERS_SEQ".nextval into :NEW."USERID" from dual;
end if;
end;
ALTER TRIGGER "BI_USERS" ENABLE
As you can see, there is one column of particular interest here, and that is the ACTIVE column. It simply contains a single character that can be any of the following: 'Y' for active user, 'B' for banned user and 'N' for inactive account. When a student registers, the ACTIVE column defaults to N, and they may not do any user actions until their account is activated. When they click on this link that supposedly activates their account, their status is changed to Y. When an administrator bans them, of course their status changes to B, and they may no longer access the site.
The process should flow like this:
1. User registers an account
2. The application confirms registration and emails them an activation link
3. The user views that email and clicks on the link; their account is activated.
What I'm having trouble with is not particularly emailing someone as I've found a tutorial to do that, but instead I would like to know how to generate a link that changes the value in that column when clicked from an external location (like someone's email inbox). The greatest catch is this: My application is not hosted online, it is on my local machine. So the location of apex is at the localhost:8081/link. I'm not sure how to perform either action.
Any help at all is greatly appreciated - I lost many hours researching on this issue already.
Thanks!
-J

Answer 1

Hi,
Sorry, I did not understand this " how do I cloak that URL so the user will not know what data is being sent to the application? Such as an encrypted URL perhaps?"
User knows nothing in my opinion, he does not see anything till he gets email
even if he knows your custom_hash function, if he is not regisetred, he gets nothing
It does not matter where it is hosted.
You need only to setup email smtp server in your workspace.
So, if your provider allows such things, put smtp host in internal workspace, and that is
I use the following process to send email when user press Submit on Submit process:
declare
l_subject VARCHAR2(32000);
l_body    VARCHAR2(32000);
l_link    VARCHAR2(32000);
n number;
BEGIN
l_link := :HTTP_ADDRESS
||OWA_UTIL.GET_CGI_ENV(
   param_name       => 'SCRIPT_NAME')||
'/f?p=AUTO:CONFIRM:0::NO:RP:CONF_ID,USERNAME:'||custom_hash(:P18_USERNAME,:P18_USERNAME)
||','||:P18_USERNAME;
IF :P18_PERSONAL_FL = 'N' THEN
   :P18_FIRST_NAME := :P18_COMPANY_NAME;
   :P18_LAST_NAME := null;
END IF;
IF :P18_EMAIL_LANG = 1 THEN
   l_subject:= htmldb_lang.message('REGISTRATION_SUBJECT_FI',
                         :HTTP_ADDRESS
   l_body :=   htmldb_lang.message('REGISTRATION_BODY_FI',
                    :P18_FIRST_NAME,:P18_LAST_NAME,:HTTP_ADDRESS,
                  to_char(sysdate,'DD.MM.YYYY - HH24:MI:SS'),
                  :P18_USERNAME,:P18_PASSWORD,l_link,:HTTP_ADDRESS);
ELSE
   l_subject:= htmldb_lang.message('REGISTRATION_SUBJECT_EN',:HTTP_ADDRESS);
   l_body :=   htmldb_lang.message('REGISTRATION_BODY_EN',
                    :P18_FIRST_NAME,:P18_LAST_NAME,:HTTP_ADDRESS,
                  to_char(sysdate,'DD.MM.YYYY - HH24:MI:SS'),
                  :P18_USERNAME,:P18_PASSWORD,l_link,:HTTP_ADDRESS);
END IF;
SEND_MAIL(
    p_to => trim(:P18_EMAIL),
    p_from => :CSE_EMAIL_ADDRESS,
    p_body => l_body,
    p_subj => l_subject
n := HTMLDB_PLSQL_JOB.submit_process
p_sql => '
begin
HTMLDB_MAIL.PUSH_QUEUE(''localhost'', 25);
end;',
p_when => sysdate,
p_status => 'SUBMITTED'
commit;
END;SEND_MAIL is basically Apex mail proc but more flexible
Sorry for hardcoded values, this is just sample and fore demo purposes only, I did not (and do not) put much effort in it
custom_hash is standard Apex well known function
create or replace function custom_hash (p_username in varchar2, p_password in varchar2)
return varchar2
is
  l_password varchar2(4000);
  l_salt varchar2(4000) := 'EVQELZY27PVLWPHMRN8B0CRRMAXBR8';
begin
l_password := utl_raw.cast_to_raw(dbms_obfuscation_toolkit.md5
  (input_string => p_password || substr(l_salt,10,13) || p_username ||
    substr(l_salt, 4,10)));
return l_password;
end;When email arrives, user clicks a link that i generated above, then he is redirected to page alias CONFIRM
As you can see items CONF_ID,USERNAME are populated, one with hash value another with username.
In CONFIRM page there is process that calculates the hash again out of username and compares to CONF_ID.
If it agrees, then fine, if not, then sorry.
There are other usual things: no double confirmation, no random navigation of someone to that page and etc
Hope this helps
Oleg
Edited by: oleg.lihvoinen on Feb 9, 2010 1:55 PM