Mail confirmation - invalid token

Question

I'm dealing with a token confirmation problem since yesterday. So the website is supposed to send me an e-mail, where there is the ID and the Token. But when I'm at the URL, it says invalid token and I can't see why

Here is some code

confirm.php

    <?php
require '../class/Bootstrap.php';
$db = App::getDatabase();
$auth = new Auth($db);

if($auth->confirm($_GET['id'],$_GET['token'], Session::getInstance())){

    Session::getInstance()->setFlash('success',"OK, valid account");
    App::redirect('../account.php');
}
    else{
        Session::getInstance()->setFlash('danger',"Invalid token");
        App::redirect('login.php');
    }

Session class

class Session{

static $instance;

      static function getInstance(){
    if(!self::$instance){
        self::$instance = new Session();
    }
    return self::$instance;
} 

      public function write($key, $value){
    $_SESSION[$key] = $value;
}

      public function read($key){
    return isset($_SESSION[$key]) ? $_SESSION[$key] : null;
}

      public function delete($key){
    unset($_SESSION[$key]);
}

Auth class

  public function confirm($user_id,$token, $session){

    $user = $this->db->query('SELECT * FROM users WHERE id = ?', [$user_id]);
        if($user && $user->confirmation_token == $token ){
            $this->db->query('UPDATE users SET confirmation_token = NULL, confirmed_at = NOW() WHERE id = ?', [user_id]);
            $session->write('auth',$user);
            return true;
        }
        return false;

    }

may someone tell me where I'm wrong ? thanks

Answer 1

PDO::query doesn't take data as the second parameter. So it cannot be used for prepared statements.

You want to use PDO::prepare with PDOStatement::execute:

$sth = $this->db->prepare('SELECT * FROM users WHERE id = ?');
$sth->execute(array($user_id));