Expert Advice Needed On Voucher System

[WeeBubba]

hello there.

i have another question regarding my ecommerce website service.

all users of my website service must sign up to a set of terms and conditions. this is very important to protect me legally. however at the same time i want to offer customers the opportunity to purchase the service for their family and friends as a gift. so how do i marry these 2 together?

here's how i saw this working

1. joe bloggs visits the website. he signs up. he ticks the terms and conditions and pays for his mum as a gift.
2. when joe bloggs payment is approved i email him a voucher for 1 person containing a username and password. this voucher advises that it entitles 1 person to use my service but they must sign up and tick the terms and conditions before the service will start.
3. joe bloggs emails this voucher onto his mum or prints it out and puts it inside an Xmas card - whatever - i dont care.
4. joe bloggs mum uses the information on the voucher to visit my website and sign up.

using this system i have married together the ability to sign up other individuals with my need for those individuals to sign a terms and conditions. however i have 2 issues with this system and was wondering if some bright spark can may be suggest a better way. my issues are 2 fold:

1. i am sending a username and password out over email.
2. what happens if somebody calls in and says 'i received the voucher but when i tried to access the service it said somebody had already activated it. how can i prove whether said user is taking me for a ride or not?

many thanks.

[shri]

Not sure if I understand this correctly but I would seperate the username from the password or voucher code.

A voucher code should be a what is is ... a code.

The user can then signup with whatever login / password they want and then use the gift cert / code.

Now, when they signup to use the code, you have captured their unique, self entered email address / mailing address etc -- that should be sufficient proof as to who used the voucher.

Like I said .. I might me missing something in your question, but this works well for us.

[WeeBubba]

thanks for your reply shri.

so let me get this right. when i email the voucher i just include a unique code of some sort. then when the user visits the website to register the voucher it is at that point that i ask them for a username and password. that sounds better. thanks.

how do i ensure nobody hacks the voucher code or guesses it at random? what do you use for the voucher code?

thanks.

[shri]

>> what do you use for the voucher code?

randomly generated alpha-numeric code of 32 characters in length.

[Corey Bryant]

Most server side languages will allow you to generate a random code. Also you might want to have them use a 4-digit pin as well and not email that to them.

That way if the email is intercepted - they still cannot get in bcause they don't know the PIN

-Corey

[WeeBubba]

thanks.

corey - i like ur suggestion - but how can i get my gift recipient to know what the 4 digit pin is if i dont email it to them?

[Corey Bryant]

It could possibly be in a separate email. This way, chances of the email being hacked twice might be reduced. A lot of companies will send out a user name in one email and the password in the other - sort of like when you get a debit card in the mail. The PIN comes in another envelope for protection.

And if the buyer does not give the PIN out, then if the buyer gave the customer's email address, the person could choose to send the PIN to the buy or customer's email.

-Corey