A HitchHackers guide through WordPress

Source code

function send_confirmation_on_profile_email() {

	global $errors, $wpdb;

	$current_user = wp_get_current_user();

	if ( ! is_object($errors) )

		$errors = new WP_Error();



	if ( $current_user->id != $_POST['user_id'] )

		return false;



	if ( $current_user->user_email != $_POST['email'] ) {

		if ( !is_email( $_POST['email'] ) ) {

			$errors->add( 'user_email', __( "<strong>ERROR</strong>: The e-mail address isn't correct." ), array( 'form-field' => 'email' ) );

			return;

		}



		if ( $wpdb->get_var( $wpdb->prepare( "SELECT user_email FROM {$wpdb->users} WHERE user_email=%s", $_POST['email'] ) ) ) {

			$errors->add( 'user_email', __( "<strong>ERROR</strong>: The e-mail address is already used." ), array( 'form-field' => 'email' ) );

			delete_option( $current_user->ID . '_new_email' );

			return;

		}



		$hash = md5( $_POST['email'] . time() . mt_rand() );

		$new_user_email = array(

				'hash' => $hash,

				'newemail' => $_POST['email']

				);

		update_option( $current_user->ID . '_new_email', $new_user_email );



		$content = apply_filters( 'new_user_email_content', __( "Dear user,



You recently requested to have the email address on your account changed.

If this is correct, please click on the following link to change it:

###ADMIN_URL###



You can safely ignore and delete this email if you do not want to

take this action.



This email has been sent to ###EMAIL###



Regards,

All at ###SITENAME###

###SITEURL###" ), $new_user_email );



		$content = str_replace( '###ADMIN_URL###', esc_url( admin_url( 'profile.php?newuseremail='.$hash ) ), $content );

		$content = str_replace( '###EMAIL###', $_POST['email'], $content);

		$content = str_replace( '###SITENAME###', get_site_option( 'site_name' ), $content );

		$content = str_replace( '###SITEURL###', network_home_url(), $content );



		wp_mail( $_POST['email'], sprintf( __( '[%s] New Email Address' ), get_option( 'blogname' ) ), $content );

		$_POST['email'] = $current_user->user_email;

	}