What are the best practices for handling user authentication and activation processes in PHP applications, especially when using email verification?

// Generate unique activation token
$activation_token = md5(uniqid(rand(), true));

// Store user credentials and activation token in database
$stmt = $pdo->prepare("INSERT INTO users (email, password, activation_token) VALUES (:email, :password, :activation_token)");
$stmt->bindParam(':email', $email);
$stmt->bindParam(':password', $password);
$stmt->bindParam(':activation_token', $activation_token);
$stmt->execute();

// Send verification email with activation link
$to = $email;
$subject = 'Activate Your Account';
$message = 'Click the following link to activate your account: http://example.com/activate.php?token=' . $activation_token;
$headers = 'From: admin@example.com';
mail($to, $subject, $message, $headers);

// Handle user activation upon verification
if(isset($_GET['token'])) {
    $token = $_GET['token'];
    $stmt = $pdo->prepare("SELECT * FROM users WHERE activation_token = :token");
    $stmt->bindParam(':token', $token);
    $stmt->execute();
    
    if($stmt->rowCount() > 0) {
        // Activate user account
        $user = $stmt->fetch(PDO::FETCH_ASSOC);
        $stmt = $pdo->prepare("UPDATE users SET activated = 1 WHERE id = :id");
        $stmt->bindParam(':id', $user['id']);
        $stmt->execute();
        echo 'Your account has been activated successfully.';
    } else {
        echo 'Invalid activation token.';
    }
}