What are the potential security risks of directly accessing email addresses in PHP for unsubscribe functionality?

Directly accessing email addresses in PHP for unsubscribe functionality can pose security risks such as exposing email addresses to potential attackers or unauthorized users. To mitigate this risk, it is recommended to use a unique identifier (such as a token) for unsubscribing instead of directly accessing email addresses.

// Generate a unique token for unsubscribing
$token = bin2hex(random_bytes(16));

// Store the token in a database along with the email address
// When a user clicks on the unsubscribe link, verify the token before unsubscribing

// Example of verifying the token before unsubscribing
if(isset($_GET['token'])) {
    $token = $_GET['token'];
    
    // Check if the token is valid before unsubscribing
    // If valid, unsubscribe the user
}