Are there any best practices for securely handling email verification links in PHP scripts?

When handling email verification links in PHP scripts, it is important to ensure that the links are securely generated and validated to prevent unauthorized access to user accounts. One best practice is to use a unique token or hash in the link that expires after a certain period of time or after it has been used once. Additionally, always validate the token on the server side before allowing any actions to be taken.

// Generate a unique token for email verification link
$token = bin2hex(random_bytes(16));

// Store the token in the database along with the user's email
// Send the verification link with the token embedded in the URL

// Validate the token when the link is clicked
if(isset($_GET['token'])) {
    $token = $_GET['token'];
    
    // Check if the token exists in the database and is valid
    // Perform the necessary actions for email verification
}