I see a lot of people say to hash for the token on email verification when dealing with member registration.
I am wondering, if the email token is only to activate the account and nothing else, would the email token still need to be hashed ? Or do I need to hash the email token?
My thought: Since it has no correlation on the account information, it has no direct affect/access to the account. even the user tries to change the email token, it will only possibly affect the database
active column from 0 to 1 (inactive to active).